infrawrench-sdk 0.28.0 → 0.30.0

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v0.28.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v0.30.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 0.28.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 0.30.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -79,6 +79,134 @@ module Infrawrench
     end
   end
 
+  # `client.accounts.plugins`
+  class AccountsPluginsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List installed plugins and their credential fields
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/accounts/plugins
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PluginSummary>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts/plugins",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Generate a least-privilege credential template for a plugin
+    #
+    # Returns the paste-ready credential document (IAM policy JSON, custom role
+    # YAML, token template…) scoped to the requested capability ids. Omitting
+    # `capabilities` (or sending it empty) selects every declared capability;
+    # any unknown capability id is rejected with 400. 400 also for plugins that
+    # don't provide a template.
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/accounts/plugins/{pluginId}/policy-template
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param capabilities [String, nil] Comma-separated capability ids, e.g. `resources,costs`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PolicyTemplateResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def policy_template(plugin_id:, org_id: nil, capabilities: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts/plugins/{pluginId}/policy-template",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id },
+        query: { "capabilities" => capabilities },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.accounts.preflight`
+  class AccountsPreflightNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Probe credentials before creating an account
+    #
+    # Runs the plugin's per-capability permission checks against the submitted
+    # credentials. Nothing is stored — use it from the add-account flow before
+    # committing.
+    #
+    # _Requires permission: `accounts:write`._
+    #
+    # POST /api/org/{orgId}/accounts/preflight
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `PreflightRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PreflightReport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/accounts/preflight",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Re-run credential preflight on a stored account
+    #
+    # _Requires permission: `accounts:write`._
+    #
+    # POST /api/org/{orgId}/accounts/{id}/preflight
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PreflightReport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def post_org_org_id_accounts_id_preflight(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/accounts/{id}/preflight",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.accounts.sync_type`
   class AccountsSyncTypeNamespace
     # @api private
@@ -119,6 +247,10 @@ module Infrawrench
   class AccountsNamespace
     # @return [AccountsCredentialsNamespace] `client.accounts.credentials`
     attr_reader :credentials
+    # @return [AccountsPluginsNamespace] `client.accounts.plugins`
+    attr_reader :plugins
+    # @return [AccountsPreflightNamespace] `client.accounts.preflight`
+    attr_reader :preflight
     # @return [AccountsSyncTypeNamespace] `client.accounts.sync_type`
     attr_reader :sync_type
 
@@ -127,6 +259,8 @@ module Infrawrench
     def initialize(transport)
       @transport = transport
       @credentials = AccountsCredentialsNamespace.new(@transport)
+      @plugins = AccountsPluginsNamespace.new(@transport)
+      @preflight = AccountsPreflightNamespace.new(@transport)
       @sync_type = AccountsSyncTypeNamespace.new(@transport)
     end
 
@@ -226,27 +360,6 @@ module Infrawrench
       )
     end
 
-    # List installed plugins and their credential fields
-    #
-    # _Requires permission: `accounts:read`._
-    #
-    # GET /api/org/{orgId}/accounts/plugins
-    #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PluginSummary>` — see
-    #   `sig/infrawrench/sdk.rbs`.
-    # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def plugins(org_id: nil, request_options: nil)
-      @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/accounts/plugins",
-        path_params: { "orgId" => org_id },
-        request_options: request_options
-      )
-    end
-
     # List cached resources for an account
     #
     # _Requires permission: `resources:read`._
@@ -1515,422 +1628,730 @@ module Infrawrench
     end
   end
 
-  # `client.costs.anomaly_settings`
-  class CostsAnomalySettingsNamespace
+  # `client.cost_centres.rules`
+  class CostCentresRulesNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Get the organization's anomaly detection thresholds
+    # Create an allocation rule
     #
-    # The tunable part of cost anomaly detection. Everything else about the
-    # model — the 28-day baseline, the 7-day notification cooldown, the minimum
-    # history a baseline needs — is fixed. An organization that has never
-    # changed a threshold reads back the defaults. The response also carries the
-    # derived, read-only `smsConfigured`.
+    # Maps spend onto a cost centre. Rules evaluate first-match-wins by
+    # ascending priority against each cost row's tags, account, provider, and
+    # service.
     #
-    # _Requires permission: `costs:read`._
+    # _Requires permission: `costs:write`._
     #
-    # GET /api/org/{orgId}/costs/anomaly-settings
+    # POST /api/org/{orgId}/cost-centres/rules
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param body [Hash] Request body, shaped as `AllocationRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostAnomalySettingsView` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `AllocationRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/costs/anomaly-settings",
+        http_method: "POST",
+        path: "/api/org/{orgId}/cost-centres/rules",
         path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Update the organization's anomaly detection thresholds
-    #
-    # Takes effect on the next detection pass (which runs after each cost
-    # collection). Anomalies already stored are not re-judged. All four fields
-    # are required — this is a PUT of the whole settings object, not a patch —
-    # and `smsAlerts` deliberately has no server-side default, so a client that
-    # omits it is rejected rather than silently switching an organization's SMS
-    # paging back off. `smsConfigured` is derived and is not accepted here.
+    # Delete an allocation rule
     #
     # _Requires permission: `costs:write`._
     #
-    # PUT /api/org/{orgId}/costs/anomaly-settings
+    # DELETE /api/org/{orgId}/cost-centres/rules/{id}
     #
-    # Raises on 400: Bad request
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CostAnomalySettings`.
+    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostAnomalySettingsView` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(body:, org_id: nil, request_options: nil)
+    def delete(id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "PUT",
-        path: "/api/org/{orgId}/costs/anomaly-settings",
-        path_params: { "orgId" => org_id },
-        body: body,
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/cost-centres/rules/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
-  end
-
-  # `client.costs`
-  class CostsNamespace
-    # @return [CostsAnomalySettingsNamespace] `client.costs.anomaly_settings`
-    attr_reader :anomaly_settings
-
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-      @anomaly_settings = CostsAnomalySettingsNamespace.new(@transport)
-    end
 
-    # List recently detected cost anomalies
-    #
-    # Spend anomalies detected by the daily background pass. Two kinds share the
-    # list: a `spike`, where a provider's or service's spend exceeded its
-    # trailing 28-day baseline by a statistical threshold (mean + N·stddev, with
-    # an absolute floor to ignore penny-scale noise), and a `new_source`, where
-    # a provider or service with no spend at all across that window suddenly
-    # billed a material amount. Thresholds are per organization — see GET
-    # /costs/anomaly-settings. Newest day first, capped at 200 rows.
+    # List allocation rules in evaluation order
     #
     # _Requires permission: `costs:read`._
     #
-    # GET /api/org/{orgId}/costs/anomalies
-    #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/cost-centres/rules
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param days [String, nil] Window in days over anomalous days, 1-90. Defaults to 30.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<AllocationRule>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def anomalies(org_id: nil, days: nil, request_options: nil)
+    def list(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/costs/anomalies",
+        path: "/api/org/{orgId}/cost-centres/rules",
         path_params: { "orgId" => org_id },
-        query: { "days" => days },
         request_options: request_options
       )
     end
 
-    # List distinct values for a cost dimension
+    # Swap the priorities of two allocation rules
     #
-    # Feeds the filter and group-by pickers. Pass dimension=tag-keys for tag
-    # keys; dimension=tag requires tagKey.
+    # Atomically swaps priorities so first-match-wins order can be edited
+    # without a half-applied pair of independent updates.
     #
-    # _Requires permission: `costs:read`._
+    # _Requires permission: `costs:write`._
     #
-    # GET /api/org/{orgId}/costs/dimensions
+    # POST /api/org/{orgId}/cost-centres/rules/swap
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param dimension [String]
-    # @param tag_key [String, nil]
+    # @param body [Hash] Request body, shaped as `SwapAllocationRulesBody`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostDimensionValues` — see
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<AllocationRule>` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def dimensions(dimension:, org_id: nil, tag_key: nil, request_options: nil)
+    def swap(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/costs/dimensions",
+        http_method: "POST",
+        path: "/api/org/{orgId}/cost-centres/rules/swap",
         path_params: { "orgId" => org_id },
-        query: { "dimension" => dimension, "tagKey" => tag_key },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Query aggregated cost series
+    # Update an allocation rule
     #
-    # Aggregates collected provider spend into per-bucket, per-group series for
-    # cost graphs. Currencies are never merged; mixed-currency orgs get one
-    # series per currency. Optionally returns a previous-period comparison and a
-    # trend forecast.
-    #
-    # _Requires permission: `costs:read`._
+    # _Requires permission: `costs:write`._
     #
-    # POST /api/org/{orgId}/costs/query
+    # PUT /api/org/{orgId}/cost-centres/rules/{id}
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CostQueryRequest`.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `AllocationRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostQueryResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `AllocationRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def query(body:, org_id: nil, request_options: nil)
+    def update(id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/costs/query",
-        path_params: { "orgId" => org_id },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/cost-centres/rules/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         body: body,
         request_options: request_options
       )
     end
+  end
 
-    # Push cost rows from your own systems
+  # `client.cost_centres`
+  class CostCentresNamespace
+    # @return [CostCentresRulesNamespace] `client.cost_centres.rules`
+    attr_reader :rules
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @rules = CostCentresRulesNamespace.new(@transport)
+    end
+
+    # Create a cost centre
     #
-    # Reports spend Infrawrench has no provider plugin for — a parsed SaaS
-    # invoice, an internal chargeback, a colo bill — into the same store the
-    # provider collectors write to, so it appears in cost graphs, dimension
-    # filters, and budgets alongside everything else.
+    # _Requires permission: `costs:write`._
     #
-    # Rows are grouped under a caller-chosen `source`. Writes are idempotent per
-    # `(source, day, service, region, resourceId, tags, currency)`: pushing the
-    # same day again restates that day rather than adding to it, so a nightly
-    # job can safely re-push a trailing window. Rows pushed under a source can
-    # never overwrite rows a provider collector wrote.
-    #
-    # The whole batch is validated before anything is stored, so a 400 means
-    # nothing was written.
-    #
-    # _Requires permission: `costs:write`._
-    #
-    # POST /api/org/{orgId}/costs/rows
+    # POST /api/org/{orgId}/cost-centres
     #
     # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CostPushRequest`.
+    # @param body [Hash] Request body, shaped as `CostCentreInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostPushResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `CostCentre` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def rows(body:, org_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/costs/rows",
+        path: "/api/org/{orgId}/cost-centres",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Per-account cost collection status
+    # Delete a cost centre (its allocation rules go with it)
     #
-    # Which accounts support cost collection, whether their history backfill has
-    # completed, and the ingested date coverage.
+    # _Requires permission: `costs:write`._
+    #
+    # DELETE /api/org/{orgId}/cost-centres/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/cost-centres/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List cost centres
     #
     # _Requires permission: `costs:read`._
     #
-    # GET /api/org/{orgId}/costs/status
+    # GET /api/org/{orgId}/cost-centres
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<CostCentre>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def status(org_id: nil, request_options: nil)
+    def list(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/costs/status",
+        path: "/api/org/{orgId}/cost-centres",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
+
+    # Update a cost centre
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # PUT /api/org/{orgId}/cost-centres/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `CostCentreInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostCentre` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/cost-centres/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
   end
 
-  # `client.custom_graphs`
-  class CustomGraphsNamespace
+  # `client.costs.anomaly_settings`
+  class CostsAnomalySettingsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Type-check custom-graph source without saving it
+    # Get the organization's anomaly detection thresholds
     #
-    # _Requires permission: `dashboards:read`._
+    # The tunable part of cost anomaly detection. Everything else about the
+    # model — the 28-day baseline, the 7-day notification cooldown, the minimum
+    # history a baseline needs — is fixed. An organization that has never
+    # changed a threshold reads back the defaults. The response also carries the
+    # derived, read-only `smsConfigured`.
     #
-    # POST /api/org/{orgId}/custom-graphs/check
+    # _Requires permission: `costs:read`._
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/costs/anomaly-settings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CustomGraphCheckRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CustomGraphCheckResult` — see
+    # @return [Hash] Parsed JSON, shaped as `CostAnomalySettingsView` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def check(body:, org_id: nil, request_options: nil)
+    def get(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/custom-graphs/check",
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/anomaly-settings",
         path_params: { "orgId" => org_id },
-        body: body,
         request_options: request_options
       )
     end
 
-    # Create a custom graph (paid plan required)
+    # Update the organization's anomaly detection thresholds
     #
-    # _Requires permission: `dashboards:write`._
+    # Takes effect on the next detection pass (which runs after each cost
+    # collection). Anomalies already stored are not re-judged. All four fields
+    # are required — this is a PUT of the whole settings object, not a patch —
+    # and `smsAlerts` deliberately has no server-side default, so a client that
+    # omits it is rejected rather than silently switching an organization's SMS
+    # paging back off. `smsConfigured` is derived and is not accepted here.
     #
-    # POST /api/org/{orgId}/custom-graphs
+    # _Requires permission: `costs:write`._
     #
-    # Raises on 400: Bad request
+    # PUT /api/org/{orgId}/costs/anomaly-settings
     #
-    # Raises on 402: Payment required — the organization's plan does not include
-    # this
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CustomGraphInput`.
+    # @param body [Hash] Request body, shaped as `CostAnomalySettings`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CustomGraphFull` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `CostAnomalySettingsView` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(body:, org_id: nil, request_options: nil)
+    def update(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/custom-graphs",
+        http_method: "PUT",
+        path: "/api/org/{orgId}/costs/anomaly-settings",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
+  end
 
-    # Delete a custom graph (and its dashboard cards)
+  # `client.costs`
+  class CostsNamespace
+    # @return [CostsAnomalySettingsNamespace] `client.costs.anomaly_settings`
+    attr_reader :anomaly_settings
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @anomaly_settings = CostsAnomalySettingsNamespace.new(@transport)
+    end
+
+    # List recently detected cost anomalies
     #
-    # _Requires permission: `dashboards:write`._
+    # Spend anomalies detected by the daily background pass. Two kinds share the
+    # list: a `spike`, where a provider's or service's spend exceeded its
+    # trailing 28-day baseline by a statistical threshold (mean + N·stddev, with
+    # an absolute floor to ignore penny-scale noise), and a `new_source`, where
+    # a provider or service with no spend at all across that window suddenly
+    # billed a material amount. Thresholds are per organization — see GET
+    # /costs/anomaly-settings. Newest day first, capped at 200 rows.
     #
-    # DELETE /api/org/{orgId}/custom-graphs/{id}
+    # _Requires permission: `costs:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/costs/anomalies
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
+    # @param days [String, nil] Window in days over anomalous days, 1-90. Defaults to 30.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(id:, org_id: nil, request_options: nil)
+    def anomalies(org_id: nil, days: nil, request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/custom-graphs/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/anomalies",
+        path_params: { "orgId" => org_id },
+        query: { "days" => days },
         request_options: request_options
       )
     end
 
-    # Get a custom graph (including source)
+    # List distinct values for a cost dimension
     #
-    # _Requires permission: `dashboards:read`._
+    # Feeds the filter and group-by pickers. Pass dimension=tag-keys for tag
+    # keys; dimension=tag requires tagKey.
     #
-    # GET /api/org/{orgId}/custom-graphs/{id}
+    # _Requires permission: `costs:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/costs/dimensions
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
+    # @param dimension [String]
+    # @param tag_key [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CustomGraphFull` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `CostDimensionValues` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(id:, org_id: nil, request_options: nil)
+    def dimensions(dimension:, org_id: nil, tag_key: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/custom-graphs/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/costs/dimensions",
+        path_params: { "orgId" => org_id },
+        query: { "dimension" => dimension, "tagKey" => tag_key },
         request_options: request_options
       )
     end
 
-    # List custom graphs
+    # Query aggregated cost series
     #
-    # _Requires permission: `dashboards:read`._
+    # Aggregates collected provider spend into per-bucket, per-group series for
+    # cost graphs. Currencies are never merged; mixed-currency orgs get one
+    # series per currency. Optionally returns a previous-period comparison and a
+    # trend forecast.
     #
-    # GET /api/org/{orgId}/custom-graphs
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/costs/query
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param body [Hash] Request body, shaped as `CostQueryRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<CustomGraphSummary>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `CostQueryResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def list(org_id: nil, request_options: nil)
+    def query(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/custom-graphs",
+        http_method: "POST",
+        path: "/api/org/{orgId}/costs/query",
         path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Run the graph's script and return its render spec (paid plan required)
+    # Push cost rows from your own systems
     #
-    # _Requires permission: `dashboards:read`._
+    # Reports spend Infrawrench has no provider plugin for — a parsed SaaS
+    # invoice, an internal chargeback, a colo bill — into the same store the
+    # provider collectors write to, so it appears in cost graphs, dimension
+    # filters, and budgets alongside everything else.
     #
-    # POST /api/org/{orgId}/custom-graphs/{id}/render
+    # Rows are grouped under a caller-chosen `source`. Writes are idempotent per
+    # `(source, day, service, region, resourceId, tags, currency)`: pushing the
+    # same day again restates that day rather than adding to it, so a nightly
+    # job can safely re-push a trailing window. Rows pushed under a source can
+    # never overwrite rows a provider collector wrote.
     #
-    # Raises on 400: Bad request
+    # The whole batch is validated before anything is stored, so a 400 means
+    # nothing was written.
     #
-    # Raises on 402: Payment required — the organization's plan does not include
-    # this
+    # _Requires permission: `costs:write`._
     #
-    # Raises on 404: Not found
+    # POST /api/org/{orgId}/costs/rows
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
-    # @param body [Hash, nil] Request body, shaped as `CustomGraphRenderRequest`.
+    # @param body [Hash] Request body, shaped as `CostPushRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CustomGraphRenderResult` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `CostPushResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def render(id:, org_id: nil, body: nil, request_options: nil)
+    def rows(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/custom-graphs/{id}/render",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/costs/rows",
+        path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # The ambient graph.d.ts for custom-graph source
+    # Spend grouped by cost centre (showback)
     #
-    # _Requires permission: `dashboards:read`._
+    # Runs the org's allocation rules over collected spend and sums per cost
+    # centre and currency. Spend no rule claims comes back as the "Unallocated"
+    # bucket; every defined centre appears even with zero spend.
     #
-    # GET /api/org/{orgId}/custom-graphs/typings
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/showback
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param from [String, nil] Defaults to 30 days ago.
+    # @param to [String, nil] Defaults to today.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [String] Raw response bytes.
+    # @return [Hash] Parsed JSON, shaped as `ShowbackReport` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def typings(org_id: nil, request_options: nil)
+    def showback(org_id: nil, from: nil, to: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/custom-graphs/typings",
+        path: "/api/org/{orgId}/costs/showback",
         path_params: { "orgId" => org_id },
-        accept: :binary,
+        query: { "from" => from, "to" => to },
         request_options: request_options
       )
     end
 
-    # Update a custom graph (paid plan required)
+    # Per-account cost collection status
     #
-    # _Requires permission: `dashboards:write`._
+    # Which accounts support cost collection, whether their history backfill has
+    # completed, and the ingested date coverage.
     #
-    # PUT /api/org/{orgId}/custom-graphs/{id}
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/status
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def status(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/status",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Untagged spend over the required tag keys
+    #
+    # Spend on cost rows missing at least one of the org's required tag keys,
+    # overall and per key, plus the largest untagged (account, service) buckets.
+    # Empty when no tag policy is configured — untagged is only meaningful
+    # against a policy.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/untagged
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param from [String, nil] Defaults to 30 days ago.
+    # @param to [String, nil] Defaults to today.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `UntaggedSpendReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def untagged(org_id: nil, from: nil, to: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/untagged",
+        path_params: { "orgId" => org_id },
+        query: { "from" => from, "to" => to },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.custom_graphs`
+  class CustomGraphsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Type-check custom-graph source without saving it
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # POST /api/org/{orgId}/custom-graphs/check
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CustomGraphCheckRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CustomGraphCheckResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def check(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/custom-graphs/check",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Create a custom graph (paid plan required)
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # POST /api/org/{orgId}/custom-graphs
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 402: Payment required — the organization's plan does not include
+    # this
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CustomGraphInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CustomGraphFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/custom-graphs",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a custom graph (and its dashboard cards)
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # DELETE /api/org/{orgId}/custom-graphs/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/custom-graphs/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a custom graph (including source)
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/custom-graphs/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CustomGraphFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/custom-graphs/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List custom graphs
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/custom-graphs
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<CustomGraphSummary>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/custom-graphs",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Run the graph's script and return its render spec (paid plan required)
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # POST /api/org/{orgId}/custom-graphs/{id}/render
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 402: Payment required — the organization's plan does not include
+    # this
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash, nil] Request body, shaped as `CustomGraphRenderRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CustomGraphRenderResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def render(id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/custom-graphs/{id}/render",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # The ambient graph.d.ts for custom-graph source
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/custom-graphs/typings
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def typings(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/custom-graphs/typings",
+        path_params: { "orgId" => org_id },
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+
+    # Update a custom graph (paid plan required)
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # PUT /api/org/{orgId}/custom-graphs/{id}
     #
     # Raises on 400: Bad request
     #
@@ -2594,554 +3015,1089 @@ module Infrawrench
     # @param id [String]
     # @param body [Hash, nil] Request body, shaped as `DeployRollbackInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DeployPlanResult` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `DeployPlanResult` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def rollback(id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/deployments/runs/{id}/rollback",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.deployments.triggers`
+  class DeploymentsTriggersNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Deploy an environment whenever a branch moves
+    #
+    # Arming a trigger records the branch's current commit WITHOUT deploying it
+    # — the trigger fires on the next push, not on the state at the moment it
+    # was created. The environment is validated against the Infrafile at that
+    # branch head, so a typo fails here rather than silently never firing.
+    #
+    # _Requires permission: `deployments:write`._
+    #
+    # POST /api/org/{orgId}/deployments/triggers
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `DeployTriggerInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DeployTrigger` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/deployments/triggers",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a deploy trigger
+    #
+    # _Requires permission: `deployments:write`._
+    #
+    # DELETE /api/org/{orgId}/deployments/triggers/{id}
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/deployments/triggers/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List deploy-on-push triggers
+    #
+    # _Requires permission: `deployments:read`._
+    #
+    # GET /api/org/{orgId}/deployments/triggers
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<DeployTrigger>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/deployments/triggers",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Enable or disable a deploy trigger
+    #
+    # _Requires permission: `deployments:write`._
+    #
+    # PATCH /api/org/{orgId}/deployments/triggers/{id}
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DeployTrigger` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/deployments/triggers/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.deployments`
+  class DeploymentsNamespace
+    # @return [DeploymentsRunsNamespace] `client.deployments.runs`
+    attr_reader :runs
+    # @return [DeploymentsTriggersNamespace] `client.deployments.triggers`
+    attr_reader :triggers
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @runs = DeploymentsRunsNamespace.new(@transport)
+      @triggers = DeploymentsTriggersNamespace.new(@transport)
+    end
+
+    # List the environments a repository's Infrafile declares
+    #
+    # Reads `Infrafile` at the branch head and returns its declared
+    # environments. The file is parsed, not executed.
+    #
+    # _Requires permission: `deployments:read`._
+    #
+    # POST /api/org/{orgId}/deployments/envs
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `DeployEnvsInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DeployEnvs` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def envs(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/deployments/envs",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Preview a deploy without building
+    #
+    # Runs the Infrafile's `plan()` and renders its Dockerfile, then stops.
+    # Nothing is built or deployed.
+    #
+    # _Requires permission: `deployments:plan`._
+    #
+    # POST /api/org/{orgId}/deployments/plan
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `DeployPlanInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DeployPlanResult` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def plan(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/deployments/plan",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List repositories this organization can deploy from
+    #
+    # Repositories visible to the organization's GitHub App installations. Empty
+    # when the app is not configured.
+    #
+    # _Requires permission: `deployments:read`._
+    #
+    # GET /api/org/{orgId}/deployments/repos
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<DeployRepo>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def repos(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/deployments/repos",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.digest.recipients`
+  class DigestRecipientsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Add a digest email recipient
+    #
+    # Adding an address the organization already has is a no-op that returns the
+    # existing entry, so a double submit cannot double-deliver.
+    #
+    # POST /api/org/{orgId}/digest/recipients
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `DigestEmailRecipientCreate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DigestEmailRecipient` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/digest/recipients",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Remove a digest email recipient
+    #
+    # DELETE /api/org/{orgId}/digest/recipients/{recipientId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param recipient_id [String] Recipient id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(recipient_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/digest/recipients/{recipientId}",
+        path_params: { "orgId" => org_id, "recipientId" => recipient_id },
+        request_options: request_options
+      )
+    end
+
+    # List the organization's digest email recipients
+    #
+    # Email is a digest-only transport, so its destinations are an
+    # organization-level address list rather than a per-channel trigger.
+    # Addresses need not belong to Infrawrench users — a finance alias is a
+    # valid recipient.
+    #
+    # GET /api/org/{orgId}/digest/recipients
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DigestEmailRecipientList` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/digest/recipients",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.digest`
+  class DigestNamespace
+    # @return [DigestRecipientsNamespace] `client.digest.recipients`
+    attr_reader :recipients
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @recipients = DigestRecipientsNamespace.new(@transport)
+    end
+
+    # Get the organization's weekly digest settings
+    #
+    # The weekly digest is a summary of the last complete Monday-to-Sunday
+    # week's spend (with week-over-week movers), sync incidents, and resource
+    # churn, delivered to the Slack channels and Teams webhooks opted into the
+    # weeklyDigest trigger and to the organization's digest email recipients.
+    # The response also carries the outcome of the most recent delivery attempt
+    # so a silently failing digest is visible.
+    #
+    # GET /api/org/{orgId}/digest
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DigestSettings` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/digest",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Compose and send last week's digest now
+    #
+    # Ignores the schedule and the enabled flag — composes the digest for the
+    # last complete week and sends it to every opted-in channel and email
+    # recipient. This is also the manual recovery for a partial delivery, which
+    # is never retried automatically. Fails when nothing is routed to receive
+    # the digest, or when every destination rejected it.
+    #
+    # POST /api/org/{orgId}/digest/send
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DigestSendResult` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def post_org_org_id_digest_send(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/digest/send",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Update the weekly digest settings
+    #
+    # Every field is optional. Enabling schedules the first digest for the next
+    # configured send time rather than sending immediately — use POST
+    # /digest/send for an immediate one. The week boundary follows `timezone`,
+    # so the reported window is always the organization's own local
+    # Monday-to-Sunday week. Changing the schedule clears any parked failure
+    # state but never replays a week that already went out.
+    #
+    # PUT /api/org/{orgId}/digest
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `DigestSettingsUpdate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DigestSettings` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/digest",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.docker`
+  class DockerNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run a Docker daemon operation
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/docker/command
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `DockerCommandRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DockerCommandResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def command(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/docker/command",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.expiring.settings`
+  class ExpiringSettingsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Get the organization's expiry alert settings
+    #
+    # The lead time feeds both the feed's `upcoming` bucket and the poller's
+    # daily alert scan. An organization that never saved reads the shipped
+    # defaults (enabled, 60 days).
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # GET /api/org/{orgId}/expiring/settings
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ExpiryAlertSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/expiring/settings",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Update the expiry alert settings
+    #
+    # Every field is optional so a single toggle can be saved on its own.
+    # `leadDays` must be a whole number from 1 to 365. Saving never resets the
+    # alert cooldown.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # PUT /api/org/{orgId}/expiring/settings
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `ExpiryAlertSettingsUpdate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ExpiryAlertSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/expiring/settings",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.expiring`
+  class ExpiringNamespace
+    # @return [ExpiringSettingsNamespace] `client.expiring.settings`
+    attr_reader :settings
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @settings = ExpiringSettingsNamespace.new(@transport)
+    end
+
+    # List approaching deadlines on synced resources
+    #
+    # One cross-provider countdown of everything with a clock on it: TLS
+    # certificate expiries, domain registrations, API token expirations, access
+    # keys past their rotation budget, Kubernetes/SSH credential ages. Plugins
+    # declare which synced fields carry deadlines; the feed is computed over
+    # already-stored state, so no provider API calls are made and results
+    # reflect the last sync. Items are sorted soonest first and bucketed by
+    # severity against the organization's lead time.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/expiring
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ExpiryListResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/expiring",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.invitations.by_token`
+  class InvitationsByTokenNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Get invitation details by token
+    #
+    # GET /api/invitations/by-token/{token}
+    #
+    # Raises on 404: Not found
+    #
+    # @param token [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `InvitationDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(token:, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/invitations/by-token/{token}",
+        path_params: { "token" => token },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.invitations`
+  class InvitationsNamespace
+    # @return [InvitationsByTokenNamespace] `client.invitations.by_token`
+    attr_reader :by_token
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @by_token = InvitationsByTokenNamespace.new(@transport)
+    end
+
+    # Accept an invitation
+    #
+    # POST /api/invitations/accept
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # @param body [Hash] Request body, shaped as `AcceptInvitationRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AcceptInvitationResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def accept(body:, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/invitations/accept",
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.kv`
+  class KvNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run a Redis-style KV command
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/kv/command
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def rollback(id:, org_id: nil, body: nil, request_options: nil)
+    def command(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/deployments/runs/{id}/rollback",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/kv/command",
+        path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.deployments.triggers`
-  class DeploymentsTriggersNamespace
+  # `client.log_workspaces`
+  class LogWorkspacesNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Deploy an environment whenever a branch moves
+    # Save a log workspace query
     #
-    # Arming a trigger records the branch's current commit WITHOUT deploying it
-    # — the trigger fires on the next push, not on the state at the moment it
-    # was created. The environment is validated against the Infrafile at that
-    # branch head, so a typo fails here rather than silently never firing.
+    # Save a named multi-resource tail: up to 8 log streams plus a search
+    # expression, so the workspace can be reopened. With `alertEnabled` the
+    # poller evaluates the query every few minutes over a bounded tail window
+    # and notifies (push/Slack/Teams, `logMatchAlerts` trigger) when a line
+    # matches, with a cooldown between alerts. Alerting requires a non-empty
+    # search expression. Audit-logged.
     #
-    # _Requires permission: `deployments:write`._
+    # _Requires permission: `resources:write`._
     #
-    # POST /api/org/{orgId}/deployments/triggers
+    # POST /api/org/{orgId}/log-workspaces
     #
     # Raises on 400: Bad request
     #
-    # Raises on 401: Unauthenticated
-    #
-    # Raises on 403: Forbidden
-    #
     # Raises on 404: Not found
     #
+    # Raises on 409: A saved query with this name already exists
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `DeployTriggerInput`.
+    # @param body [Hash] Request body, shaped as `LogWorkspaceQueryCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DeployTrigger` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQuery` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/deployments/triggers",
+        path: "/api/org/{orgId}/log-workspaces",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Delete a deploy trigger
+    # Delete a saved log query
     #
-    # _Requires permission: `deployments:write`._
+    # Remove the saved query and stop any alerting it carried. Audit-logged.
     #
-    # DELETE /api/org/{orgId}/deployments/triggers/{id}
+    # _Requires permission: `resources:write`._
     #
-    # Raises on 401: Unauthenticated
+    # DELETE /api/org/{orgId}/log-workspaces/{queryId}
     #
-    # Raises on 403: Forbidden
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
+    # @param query_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(id:, org_id: nil, request_options: nil)
+    def delete(query_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "DELETE",
-        path: "/api/org/{orgId}/deployments/triggers/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/log-workspaces/{queryId}",
+        path_params: { "orgId" => org_id, "queryId" => query_id },
+        accept: :empty,
         request_options: request_options
       )
     end
 
-    # List deploy-on-push triggers
-    #
-    # _Requires permission: `deployments:read`._
+    # List saved log queries
     #
-    # GET /api/org/{orgId}/deployments/triggers
+    # Every saved log-workspace query in the organization: its name, the set of
+    # log streams it tails, the search expression, the alert flag and the alert
+    # pass's last evaluation state. Log text itself is fetched per resource via
+    # `POST /api/org/{orgId}/resources/{pluginId}/{typeId}/logs`.
     #
-    # Raises on 401: Unauthenticated
+    # _Requires permission: `resources:read`._
     #
-    # Raises on 403: Forbidden
+    # GET /api/org/{orgId}/log-workspaces
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<DeployTrigger>` — see
+    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQueryList` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def list(org_id: nil, request_options: nil)
+    def get(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/deployments/triggers",
+        path: "/api/org/{orgId}/log-workspaces",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # Enable or disable a deploy trigger
-    #
-    # _Requires permission: `deployments:write`._
-    #
-    # PATCH /api/org/{orgId}/deployments/triggers/{id}
-    #
-    # Raises on 401: Unauthenticated
-    #
-    # Raises on 403: Forbidden
-    #
-    # Raises on 404: Not found
-    #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param id [String]
-    # @param body [Hash, nil] Request body, shaped as `Hash`.
-    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DeployTrigger` — see `sig/infrawrench/sdk.rbs`.
-    # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(id:, org_id: nil, body: nil, request_options: nil)
-      @transport.request(
-        http_method: "PATCH",
-        path: "/api/org/{orgId}/deployments/triggers/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
-        body: body,
-        request_options: request_options
-      )
-    end
-  end
-
-  # `client.deployments`
-  class DeploymentsNamespace
-    # @return [DeploymentsRunsNamespace] `client.deployments.runs`
-    attr_reader :runs
-    # @return [DeploymentsTriggersNamespace] `client.deployments.triggers`
-    attr_reader :triggers
-
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-      @runs = DeploymentsRunsNamespace.new(@transport)
-      @triggers = DeploymentsTriggersNamespace.new(@transport)
-    end
-
-    # List the environments a repository's Infrafile declares
-    #
-    # Reads `Infrafile` at the branch head and returns its declared
-    # environments. The file is parsed, not executed.
-    #
-    # _Requires permission: `deployments:read`._
-    #
-    # POST /api/org/{orgId}/deployments/envs
+    # List log-capable resources
     #
-    # Raises on 400: Bad request
-    #
-    # Raises on 401: Unauthenticated
+    # Synced resources whose rendered detail declares the logs capability — the
+    # candidates a log workspace can tail. Discovered from the plugin contract
+    # (never a hardcoded provider list), capped at 500 results.
     #
-    # Raises on 403: Forbidden
+    # _Requires permission: `resources:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/log-workspaces/resources
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `DeployEnvsInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DeployEnvs` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LogCapableResourceList` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def envs(org_id: nil, body: nil, request_options: nil)
+    def resources(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/deployments/envs",
+        http_method: "GET",
+        path: "/api/org/{orgId}/log-workspaces/resources",
         path_params: { "orgId" => org_id },
-        body: body,
         request_options: request_options
       )
     end
 
-    # Preview a deploy without building
+    # Update a saved log query
     #
-    # Runs the Infrafile's `plan()` and renders its Dockerfile, then stops.
-    # Nothing is built or deployed.
+    # Edit the name, resource set, search expression and/or the alert toggle.
+    # Changing the search or the resources resets the alert pass's evaluation
+    # state; turning the alert on makes the query due for evaluation
+    # immediately. Audit-logged.
     #
-    # _Requires permission: `deployments:plan`._
+    # _Requires permission: `resources:write`._
     #
-    # POST /api/org/{orgId}/deployments/plan
+    # PUT /api/org/{orgId}/log-workspaces/{queryId}
     #
     # Raises on 400: Bad request
     #
-    # Raises on 401: Unauthenticated
-    #
-    # Raises on 403: Forbidden
-    #
     # Raises on 404: Not found
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `DeployPlanInput`.
-    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DeployPlanResult` — see `sig/infrawrench/sdk.rbs`.
-    # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def plan(org_id: nil, body: nil, request_options: nil)
-      @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/deployments/plan",
-        path_params: { "orgId" => org_id },
-        body: body,
-        request_options: request_options
-      )
-    end
-
-    # List repositories this organization can deploy from
-    #
-    # Repositories visible to the organization's GitHub App installations. Empty
-    # when the app is not configured.
-    #
-    # _Requires permission: `deployments:read`._
-    #
-    # GET /api/org/{orgId}/deployments/repos
-    #
-    # Raises on 401: Unauthenticated
-    #
-    # Raises on 403: Forbidden
+    # Raises on 409: A saved query with this name already exists
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param query_id [String]
+    # @param body [Hash] Request body, shaped as `LogWorkspaceQueryUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<DeployRepo>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQuery` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def repos(org_id: nil, request_options: nil)
+    def update(query_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/deployments/repos",
-        path_params: { "orgId" => org_id },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/log-workspaces/{queryId}",
+        path_params: { "orgId" => org_id, "queryId" => query_id },
+        body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.digest.recipients`
-  class DigestRecipientsNamespace
+  # `client.metric_alerts`
+  class MetricAlertsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Add a digest email recipient
+    # Create a metric alert rule
     #
-    # Adding an address the organization already has is a no-op that returns the
-    # existing entry, so a double submit cannot double-deliver.
+    # Rules select resources by query (plugin + resource type + tag), never by
+    # id list, so a rule automatically covers resources created after it was
+    # written. The poller evaluates enabled rules about once a minute and alerts
+    # when the condition held for the whole trailing window.
     #
-    # POST /api/org/{orgId}/digest/recipients
+    # POST /api/org/{orgId}/metric-alerts
     #
     # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `DigestEmailRecipientCreate`.
+    # @param body [Hash] Request body, shaped as `MetricAlertRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DigestEmailRecipient` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/digest/recipients",
+        path: "/api/org/{orgId}/metric-alerts",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Remove a digest email recipient
+    # Delete a metric alert rule
     #
-    # DELETE /api/org/{orgId}/digest/recipients/{recipientId}
+    # Soft delete. The rule's firing history stays readable via
+    # /metric-alerts/events.
+    #
+    # DELETE /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param recipient_id [String] Recipient id
+    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(recipient_id:, org_id: nil, request_options: nil)
+    def delete(id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "DELETE",
-        path: "/api/org/{orgId}/digest/recipients/{recipientId}",
-        path_params: { "orgId" => org_id, "recipientId" => recipient_id },
+        path: "/api/org/{orgId}/metric-alerts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
 
-    # List the organization's digest email recipients
-    #
-    # Email is a digest-only transport, so its destinations are an
-    # organization-level address list rather than a per-channel trigger.
-    # Addresses need not belong to Infrawrench users — a finance alias is a
-    # valid recipient.
+    # Recent metric alert firings
     #
-    # GET /api/org/{orgId}/digest/recipients
+    # GET /api/org/{orgId}/metric-alerts/events
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param rule_id [String, nil]
+    # @param limit [Integer, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DigestEmailRecipientList` — see
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricAlertEvent>` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def events(org_id: nil, rule_id: nil, limit: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/digest/recipients",
+        path: "/api/org/{orgId}/metric-alerts/events",
         path_params: { "orgId" => org_id },
+        query: { "ruleId" => rule_id, "limit" => limit },
         request_options: request_options
       )
     end
-  end
-
-  # `client.digest`
-  class DigestNamespace
-    # @return [DigestRecipientsNamespace] `client.digest.recipients`
-    attr_reader :recipients
-
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-      @recipients = DigestRecipientsNamespace.new(@transport)
-    end
 
-    # Get the organization's weekly digest settings
+    # Get a metric alert rule
     #
-    # The weekly digest is a summary of the last complete Monday-to-Sunday
-    # week's spend (with week-over-week movers), sync incidents, and resource
-    # churn, delivered to the Slack channels and Teams webhooks opted into the
-    # weeklyDigest trigger and to the organization's digest email recipients.
-    # The response also carries the outcome of the most recent delivery attempt
-    # so a silently failing digest is visible.
+    # GET /api/org/{orgId}/metric-alerts/{id}
     #
-    # GET /api/org/{orgId}/digest
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DigestSettings` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def get(id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/digest",
-        path_params: { "orgId" => org_id },
+        path: "/api/org/{orgId}/metric-alerts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
 
-    # Compose and send last week's digest now
-    #
-    # Ignores the schedule and the enabled flag — composes the digest for the
-    # last complete week and sends it to every opted-in channel and email
-    # recipient. This is also the manual recovery for a partial delivery, which
-    # is never retried automatically. Fails when nothing is routed to receive
-    # the digest, or when every destination rejected it.
-    #
-    # POST /api/org/{orgId}/digest/send
+    # List metric alert rules with live firing status
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/metric-alerts
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DigestSendResult` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricAlertRuleWithStatus>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def post_org_org_id_digest_send(org_id: nil, request_options: nil)
+    def list(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/digest/send",
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts",
         path_params: { "orgId" => org_id },
         request_options: request_options
-      )
-    end
-
-    # Update the weekly digest settings
-    #
-    # Every field is optional. Enabling schedules the first digest for the next
-    # configured send time rather than sending immediately — use POST
-    # /digest/send for an immediate one. The week boundary follows `timezone`,
-    # so the reported window is always the organization's own local
-    # Monday-to-Sunday week. Changing the schedule clears any parked failure
-    # state but never replays a week that already went out.
+      )
+    end
+
+    # List metric series that actually exist
     #
-    # PUT /api/org/{orgId}/digest
+    # The series labels resources reported in the last 7 days, optionally
+    # narrowed to one plugin and resource type — what the rule builder's metric
+    # picker is fed from.
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/metric-alerts/metric-keys
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `DigestSettingsUpdate`.
+    # @param plugin_id [String, nil]
+    # @param resource_type_id [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DigestSettings` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricSeriesKey>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(org_id: nil, body: nil, request_options: nil)
+    def metric_keys(org_id: nil, plugin_id: nil, resource_type_id: nil, request_options: nil)
       @transport.request(
-        http_method: "PUT",
-        path: "/api/org/{orgId}/digest",
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts/metric-keys",
         path_params: { "orgId" => org_id },
-        body: body,
+        query: { "pluginId" => plugin_id, "resourceTypeId" => resource_type_id },
         request_options: request_options
       )
     end
-  end
-
-  # `client.docker`
-  class DockerNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-    end
 
-    # Run a Docker daemon operation
-    #
-    # _Requires permission: `resources:execute`._
-    #
-    # POST /api/org/{orgId}/docker/command
-    #
-    # Raises on 400: Bad request
+    # List what the organization's resources offer to select on
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/metric-alerts/selector-options
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `DockerCommandRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DockerCommandResponse` — see
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertSelectorOptions` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def command(body:, org_id: nil, request_options: nil)
+    def selector_options(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/docker/command",
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts/selector-options",
         path_params: { "orgId" => org_id },
-        body: body,
         request_options: request_options
       )
     end
-  end
-
-  # `client.invitations.by_token`
-  class InvitationsByTokenNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-    end
 
-    # Get invitation details by token
+    # Preview which resources a selector matches right now
     #
-    # GET /api/invitations/by-token/{token}
+    # GET /api/org/{orgId}/metric-alerts/selector-preview
     #
-    # Raises on 404: Not found
+    # Raises on 400: Bad request
     #
-    # @param token [String]
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String, nil]
+    # @param resource_type_id [String, nil]
+    # @param tag_key [String, nil]
+    # @param tag_value [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `InvitationDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertSelectorPreview` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(token:, request_options: nil)
+    def selector_preview(
+      org_id: nil,
+      plugin_id: nil,
+      resource_type_id: nil,
+      tag_key: nil,
+      tag_value: nil,
+      request_options: nil
+    )
       @transport.request(
         http_method: "GET",
-        path: "/api/invitations/by-token/{token}",
-        path_params: { "token" => token },
+        path: "/api/org/{orgId}/metric-alerts/selector-preview",
+        path_params: { "orgId" => org_id },
+        query: {
+          "pluginId" => plugin_id,
+          "resourceTypeId" => resource_type_id,
+          "tagKey" => tag_key,
+          "tagValue" => tag_value
+        },
         request_options: request_options
       )
     end
-  end
-
-  # `client.invitations`
-  class InvitationsNamespace
-    # @return [InvitationsByTokenNamespace] `client.invitations.by_token`
-    attr_reader :by_token
-
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-      @by_token = InvitationsByTokenNamespace.new(@transport)
-    end
 
-    # Accept an invitation
+    # Update a metric alert rule
     #
-    # POST /api/invitations/accept
+    # PUT /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 400: Bad request
     #
-    # Raises on 403: Forbidden
+    # Raises on 404: Not found
     #
-    # @param body [Hash] Request body, shaped as `AcceptInvitationRequest`.
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `MetricAlertRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `AcceptInvitationResponse` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def accept(body:, request_options: nil)
+    def update(id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/invitations/accept",
+        http_method: "PUT",
+        path: "/api/org/{orgId}/metric-alerts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.kv`
-  class KvNamespace
+  # `client.moment`
+  class MomentNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Run a Redis-style KV command
+    # Everything that happened around a timestamp
     #
-    # _Requires permission: `resources:execute`._
+    # "What changed around 03:14?" — one merged, chronological narrative of
+    # everything the platform knows happened in a window: resource changes
+    # (including sleep/wake schedule attribution), provider status incidents
+    # that started/resolved in or overlap the window, cost anomalies, workflow
+    # runs, deployments, audit-log entries, change freezes, and the drift/expiry
+    # alert deliveries. Each feed is gated on the same permission its own
+    # endpoint requires; feeds the caller cannot read are reported as `omitted`,
+    # and a feed whose query fails is reported as `error` without blanking the
+    # rest of the response.
     #
-    # POST /api/org/{orgId}/kv/command
+    # _Requires permission: `resources:read`._
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/moment
     #
-    # Raises on 404: Not found
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
+    # @param at [String, nil] Centre of the window. Defaults to now.
+    # @param window [Integer, nil] Half-window in minutes (the ± around `at`). Default 60, max
+    #   4320 (±3 days).
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MomentResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def command(body:, org_id: nil, request_options: nil)
+    def get(org_id: nil, at: nil, window: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/kv/command",
+        http_method: "GET",
+        path: "/api/org/{orgId}/moment",
         path_params: { "orgId" => org_id },
-        body: body,
+        query: { "at" => at, "window" => window },
         request_options: request_options
       )
     end
@@ -4126,6 +5082,11 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 422: Blocked by the organization's tag policy: the submitted
+    # fields are missing a required tag (or carry a disallowed value). Retry
+    # with the `x-tag-policy-override: true` header if you hold
+    # `tag-policy:override`; both blocks and overrides are audit-logged.
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CreateResourceRequest`.
@@ -4562,44 +5523,249 @@ module Infrawrench
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def peer_panes(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/peer-panes",
-        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
-        body: body,
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/peer-panes",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Fetch options for a `resource-picker` field
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/picker-resources
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `PickerResourcesRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PickerResource>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def picker_resources(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/picker-resources",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Update a resource via its plugin
+    #
+    # Applies the supplied field changes upstream and persists the refreshed
+    # fields/display name to the DB. The body's `fields` map only carries the
+    # keys the caller actually changed. Blocked with `423` while an org change
+    # freeze is in effect (this is also the path that applies right-sizing
+    # recommendations); every applied update is audit-logged.
+    #
+    # POST /api/org/{orgId}/resources/update
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 423: Blocked by an active change freeze. Retry with the
+    # `x-change-freeze-override: true` header if you hold `freezes:override`;
+    # both blocks and overrides are audit-logged.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `UpdateResourceRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `UpdateResourceResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/update",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.rightsizing`
+  class RightsizingNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List oversized resources with resize recommendations
+    #
+    # Computes p95 CPU/memory utilisation over the last 14 days of stored
+    # metrics for every resource whose plugin declares right-sizing support, and
+    # matches under-utilised ones against the plugin's real size catalog (the
+    # create form's size options, live-priced). Each recommendation names the
+    # cheapest smaller size that still clears a headroom margin and quotes the
+    # monthly saving. Apply one by submitting `sizeFieldKey` with the
+    # recommended size id through the resource-update endpoint — which enforces
+    # change freezes and writes the audit trail. Results are cached for a few
+    # minutes; pass `refresh=true` to recompute.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/rightsizing
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param refresh [String, nil] Bypass the short server-side cache and recompute now.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `RightsizingListResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, refresh: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/rightsizing",
+        path_params: { "orgId" => org_id },
+        query: { "refresh" => refresh },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.schedules`
+  class SchedulesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a sleep/wake schedule
+    #
+    # Attach an off-at/on-at weekly window to a resource. The resource's type
+    # must declare lifecycle start/stop actions (see the resource type
+    # metadata); one schedule per resource. Times are wall-clock in the given
+    # IANA timezone and remain correct across DST. Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/schedules
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: The resource already has a schedule
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `SleepScheduleCreate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SleepSchedule` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/schedules",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a schedule
+    #
+    # Remove the schedule. The resource is left in whatever state it is in.
+    # Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/schedules/{scheduleId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param schedule_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [nil] This endpoint returns no content.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(schedule_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/schedules/{scheduleId}",
+        path_params: { "orgId" => org_id, "scheduleId" => schedule_id },
+        accept: :empty,
+        request_options: request_options
+      )
+    end
+
+    # List sleep/wake schedules
+    #
+    # Every schedule in the organization with its next transition, last run
+    # outcome and a projected monthly saving computed from trailing per-resource
+    # spend and the weekly off-hours fraction. Schedules attach to resources
+    # whose plugin declares lifecycle start/stop actions; the poller executes
+    # due transitions server-side.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/schedules
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SleepScheduleList` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/schedules",
+        path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # Fetch options for a `resource-picker` field
+    # Preview a schedule's projected saving
+    #
+    # Quote a timing against a resource before saving: the weekly off-hours
+    # fraction, the resource's trailing spend normalized to a month, the
+    # projected monthly saving, and the next few transitions. Makes no provider
+    # API calls and changes nothing.
     #
     # _Requires permission: `resources:read`._
     #
-    # POST /api/org/{orgId}/resources/picker-resources
+    # POST /api/org/{orgId}/schedules/preview
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `PickerResourcesRequest`.
+    # @param body [Hash, nil] Request body, shaped as `SleepSchedulePreviewRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PickerResource>` — see
+    # @return [Hash] Parsed JSON, shaped as `SleepSchedulePreview` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def picker_resources(body:, org_id: nil, request_options: nil)
+    def preview(org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/resources/picker-resources",
+        path: "/api/org/{orgId}/schedules/preview",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Update a resource via its plugin
+    # Update or pause a schedule
     #
-    # Applies the supplied field changes upstream and persists the refreshed
-    # fields/display name to the DB. The body's `fields` map only carries the
-    # keys the caller actually changed.
+    # Edit the timing and/or toggle `paused`. Any change recomputes the next
+    # transition; pausing clears it. Audit-logged.
     #
-    # POST /api/org/{orgId}/resources/update
+    # _Requires permission: `resources:write`._
+    #
+    # PUT /api/org/{orgId}/schedules/{scheduleId}
     #
     # Raises on 400: Bad request
     #
@@ -4607,16 +5773,16 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `UpdateResourceRequest`.
+    # @param schedule_id [String]
+    # @param body [Hash, nil] Request body, shaped as `SleepScheduleUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `UpdateResourceResponse` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `SleepSchedule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(body:, org_id: nil, request_options: nil)
+    def update(schedule_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/resources/update",
-        path_params: { "orgId" => org_id },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/schedules/{scheduleId}",
+        path_params: { "orgId" => org_id, "scheduleId" => schedule_id },
         body: body,
         request_options: request_options
       )
@@ -5136,6 +6302,187 @@ module Infrawrench
     end
   end
 
+  # `client.ssh_fanout.snippets`
+  class SshFanoutSnippetsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Save a command snippet
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/ssh-fanout/snippets
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SshSnippetInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-fanout/snippets",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a saved command snippet
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # DELETE /api/org/{orgId}/ssh-fanout/snippets/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/ssh-fanout/snippets/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List saved command snippets
+    #
+    # Org-shared saved commands for reuse from the fan-out screen and CLI.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/ssh-fanout/snippets
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ssh-fanout/snippets",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Update a saved command snippet
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # PUT /api/org/{orgId}/ssh-fanout/snippets/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `SshSnippetInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/ssh-fanout/snippets/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ssh_fanout`
+  class SshFanoutNamespace
+    # @return [SshFanoutSnippetsNamespace] `client.ssh_fanout.snippets`
+    attr_reader :snippets
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @snippets = SshFanoutSnippetsNamespace.new(@transport)
+    end
+
+    # Run one command across many SSH hosts
+    #
+    # Executes the command on every selected target under a concurrency cap
+    # (default 8, max 16). Per-host results carry stdout, stderr, and exit code;
+    # transport failures (unreachable, untrusted host key, blocked internal
+    # host) are per-host too. Resource targets need `sshKeyId` (an org SSH key
+    # owned by the caller). Blocked with HTTP 423 while a change freeze is in
+    # effect; audit-logged.
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/ssh-fanout/run
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 423: Blocked by an active change freeze. Retry with the
+    # `x-change-freeze-override: true` header if you hold `freezes:override`;
+    # both blocks and overrides are audit-logged.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SshFanoutRunRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SshFanoutRunResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def run(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-fanout/run",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List SSH-capable fan-out targets
+    #
+    # Every SSH-capable target in the org: `ssh` plugin accounts (native
+    # credentials) plus resources whose type declares an sshEndpoint with a
+    # resolvable host (EC2 instances, droplets, Hetzner servers, …).
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/ssh-fanout/targets
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SshFanoutTargetsResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def targets(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ssh-fanout/targets",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.ssh_keys`
   class SshKeysNamespace
     # @api private
@@ -5365,6 +6712,47 @@ module Infrawrench
     end
   end
 
+  # `client.status_incidents`
+  class StatusIncidentsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Provider incidents overlapping your resources
+    #
+    # The "is it me or is it them?" feed. The poller watches each provider
+    # plugin's public status feed (declared on its manifest — zero credentials,
+    # zero rate-limit risk), caches active incidents, and this endpoint
+    # correlates them against the resources the organization holds: an incident
+    # matches a resource when it is provider-wide, names the resource's region,
+    # or names its resource type. Includes incidents resolved within the last 24
+    # hours so recent drift can still be correlated. Active incidents first,
+    # most severe first.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/status-incidents
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `OrgStatusIncidentsResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/status-incidents",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.storage`
   class StorageNamespace
     # @api private
@@ -5513,6 +6901,89 @@ module Infrawrench
     end
   end
 
+  # `client.tag_policy`
+  class TagPolicyNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Per-account tag compliance scores
+    #
+    # For each account: how many of its resources expose tags and how many of
+    # those carry every required tag with an allowed value. `score` is over the
+    # evaluated (tag-capable) set so untaggable resource types don't drag it.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/tag-policy/compliance
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `TagComplianceReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def compliance(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/tag-policy/compliance",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # The org's required-tag policy
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/tag-policy
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `TagPolicy` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/tag-policy",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Replace the org's tag policy
+    #
+    # Sets the required tag keys (each optionally restricted to allowed values)
+    # and whether resource creation is blocked when they are missing. Keys are
+    # matched case-insensitively against the generic `tags`/`labels` field
+    # convention.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # PUT /api/org/{orgId}/tag-policy
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `TagPolicy`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `TagPolicy` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/tag-policy",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.team.invitations`
   class TeamInvitationsNamespace
     # @api private
@@ -6072,6 +7543,8 @@ module Infrawrench
     attr_reader :changes
     # @return [ConnectNamespace] `client.connect`
     attr_reader :connect
+    # @return [CostCentresNamespace] `client.cost_centres`
+    attr_reader :cost_centres
     # @return [CostsNamespace] `client.costs`
     attr_reader :costs
     # @return [CustomGraphsNamespace] `client.custom_graphs`
@@ -6086,10 +7559,18 @@ module Infrawrench
     attr_reader :digest
     # @return [DockerNamespace] `client.docker`
     attr_reader :docker
+    # @return [ExpiringNamespace] `client.expiring`
+    attr_reader :expiring
     # @return [InvitationsNamespace] `client.invitations`
     attr_reader :invitations
     # @return [KvNamespace] `client.kv`
     attr_reader :kv
+    # @return [LogWorkspacesNamespace] `client.log_workspaces`
+    attr_reader :log_workspaces
+    # @return [MetricAlertsNamespace] `client.metric_alerts`
+    attr_reader :metric_alerts
+    # @return [MomentNamespace] `client.moment`
+    attr_reader :moment
     # @return [MsteamsNamespace] `client.msteams`
     attr_reader :msteams
     # @return [OrgsNamespace] `client.orgs`
@@ -6102,6 +7583,10 @@ module Infrawrench
     attr_reader :profile
     # @return [ResourcesNamespace] `client.resources`
     attr_reader :resources
+    # @return [RightsizingNamespace] `client.rightsizing`
+    attr_reader :rightsizing
+    # @return [SchedulesNamespace] `client.schedules`
+    attr_reader :schedules
     # @return [SearchNamespace] `client.search`
     attr_reader :search
     # @return [SftpNamespace] `client.sftp`
@@ -6110,12 +7595,18 @@ module Infrawrench
     attr_reader :slack
     # @return [SqlNamespace] `client.sql`
     attr_reader :sql
+    # @return [SshFanoutNamespace] `client.ssh_fanout`
+    attr_reader :ssh_fanout
     # @return [SshKeysNamespace] `client.ssh_keys`
     attr_reader :ssh_keys
     # @return [SshTunnelsNamespace] `client.ssh_tunnels`
     attr_reader :ssh_tunnels
+    # @return [StatusIncidentsNamespace] `client.status_incidents`
+    attr_reader :status_incidents
     # @return [StorageNamespace] `client.storage`
     attr_reader :storage
+    # @return [TagPolicyNamespace] `client.tag_policy`
+    attr_reader :tag_policy
     # @return [TeamNamespace] `client.team`
     attr_reader :team
     # @return [WorkflowApprovalsNamespace] `client.workflow_approvals`
@@ -6141,6 +7632,7 @@ module Infrawrench
       @change_freezes = ChangeFreezesNamespace.new(@transport)
       @changes = ChangesNamespace.new(@transport)
       @connect = ConnectNamespace.new(@transport)
+      @cost_centres = CostCentresNamespace.new(@transport)
       @costs = CostsNamespace.new(@transport)
       @custom_graphs = CustomGraphsNamespace.new(@transport)
       @dashboards = DashboardsNamespace.new(@transport)
@@ -6148,21 +7640,30 @@ module Infrawrench
       @deployments = DeploymentsNamespace.new(@transport)
       @digest = DigestNamespace.new(@transport)
       @docker = DockerNamespace.new(@transport)
+      @expiring = ExpiringNamespace.new(@transport)
       @invitations = InvitationsNamespace.new(@transport)
       @kv = KvNamespace.new(@transport)
+      @log_workspaces = LogWorkspacesNamespace.new(@transport)
+      @metric_alerts = MetricAlertsNamespace.new(@transport)
+      @moment = MomentNamespace.new(@transport)
       @msteams = MsteamsNamespace.new(@transport)
       @orgs = OrgsNamespace.new(@transport)
       @orphans = OrphansNamespace.new(@transport)
       @pages = PagesNamespace.new(@transport)
       @profile = ProfileNamespace.new(@transport)
       @resources = ResourcesNamespace.new(@transport)
+      @rightsizing = RightsizingNamespace.new(@transport)
+      @schedules = SchedulesNamespace.new(@transport)
       @search = SearchNamespace.new(@transport)
       @sftp = SftpNamespace.new(@transport)
       @slack = SlackNamespace.new(@transport)
       @sql = SqlNamespace.new(@transport)
+      @ssh_fanout = SshFanoutNamespace.new(@transport)
       @ssh_keys = SshKeysNamespace.new(@transport)
       @ssh_tunnels = SshTunnelsNamespace.new(@transport)
+      @status_incidents = StatusIncidentsNamespace.new(@transport)
       @storage = StorageNamespace.new(@transport)
+      @tag_policy = TagPolicyNamespace.new(@transport)
       @team = TeamNamespace.new(@transport)
       @workflow_approvals = WorkflowApprovalsNamespace.new(@transport)
       @workflows = WorkflowsNamespace.new(@transport)