infrawrench-sdk 1.74.0 → 1.75.0

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.74.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.75.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.74.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.75.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -28,9 +28,9 @@ module Infrawrench
     # WebSocket gateway, chat, MCP tools). Two rules are enforced here and
     # cannot be bypassed: you cannot decide your own request (403
     # `self_approval`), and you cannot grant a permission you do not hold
-    # yourself (403 `exceeds_approver`) — denying something aimed higher than
-    # you is allowed. Deciding a request that has already been decided or has
-    # timed out is a 409. Audit-logged.
+    # yourself (403 `exceeds_approver`): denying something aimed higher than you
+    # is allowed. Deciding a request that has already been decided or has timed
+    # out is a 409. Audit-logged.
     #
     # _Requires permission: `access:approve`._
     #
@@ -91,7 +91,7 @@ module Infrawrench
     #
     # Ask for specific permissions, for a specific number of minutes, with a
     # reason. Rejected with 400 when the caller's role already grants every
-    # permission asked for — that is almost always a wrong permission string
+    # permission asked for; that is almost always a wrong permission string
     # rather than a real request. Fans out to push, Slack (with Approve/Deny
     # buttons) and Microsoft Teams under the Pages opt-in. Audit-logged.
     #
@@ -121,7 +121,7 @@ module Infrawrench
     #
     # Records the refusal. Two rules are enforced here and cannot be bypassed:
     # you cannot decide your own request (403 `self_approval`), and you cannot
-    # grant a permission you do not hold yourself (403 `exceeds_approver`) —
+    # grant a permission you do not hold yourself (403 `exceeds_approver`):
     # denying something aimed higher than you is allowed. Deciding a request
     # that has already been decided or has timed out is a 409. Audit-logged.
     #
@@ -190,7 +190,7 @@ module Infrawrench
 
     # End a live elevation early
     #
-    # Allowed for anyone with `access:approve` and for the holder — giving back
+    # Allowed for anyone with `access:approve` and for the holder; giving back
     # an elevation you no longer need must never require finding an approver.
     # Applies from the next permission resolution; nothing is cached.
     # Audit-logged.
@@ -256,7 +256,7 @@ module Infrawrench
 
     # Dismiss an access review finding
     #
-    # Accept a finding — that break-glass role really is meant to be admin, that
+    # Accept a finding; that break-glass role really is meant to be admin, that
     # shared key really is rotated out of band. The finding leaves `findings`
     # and stops feeding the security alerts, but the rule keeps being evaluated
     # and the finding is reported back under `dismissed` for as long as it still
@@ -379,7 +379,7 @@ module Infrawrench
     # budget their plugin declares, carrying no recorded owner, or signing in
     # without a second factor.
     #
-    # This is about principals in **your** clouds — it is neither your
+    # This is about principals in **your** clouds; it is neither your
     # Infrawrench team's roles (`/team`) nor the credentials Infrawrench stores
     # for you (`/credential-hygiene`).
     #
@@ -423,7 +423,7 @@ module Infrawrench
 
     # Fetch the decrypted credentials for an account
     #
-    # Returns the credentials map as it was originally submitted. Sensitive —
+    # Returns the credentials map as it was originally submitted. Sensitive:
     # gate access carefully.
     #
     # _Requires permission: `secrets:read`._
@@ -554,7 +554,7 @@ module Infrawrench
     # Probe credentials before creating an account
     #
     # Runs the plugin's per-capability permission checks against the submitted
-    # credentials. Nothing is stored — use it from the add-account flow before
+    # credentials. Nothing is stored; use it from the add-account flow before
     # committing.
     #
     # _Requires permission: `accounts:write`._
@@ -675,7 +675,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -995,7 +995,7 @@ module Infrawrench
 
     # Open an anonymous registration and a 24-hour trial workspace
     #
-    # Requires no authentication — this is how a client with no credentials gets
+    # Requires no authentication; this is how a client with no credentials gets
     # one. Rate limited per source address. The workspace it opens is deleted 24
     # hours later unless a person completes the claim ceremony.
     #
@@ -1073,7 +1073,7 @@ module Infrawrench
     #
     # Raises on 401: Unauthenticated
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -1112,7 +1112,7 @@ module Infrawrench
     #
     # Raises on 401: Unauthenticated
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -2034,10 +2034,10 @@ module Infrawrench
 
     # Replace the organization's alert routing rules
     #
-    # Whole-list replacement in one transaction. Order is part of the meaning —
-    # a rule is only correct relative to the ones above it — so a reorder
-    # applied as several requests would leave a window in which alerts route
-    # somewhere nobody asked for. Positions are re-derived from array order.
+    # Whole-list replacement in one transaction. Order is part of the meaning (a
+    # rule is only correct relative to the ones above it) so a reorder applied
+    # as several requests would leave a window in which alerts route somewhere
+    # nobody asked for. Positions are re-derived from array order.
     #
     # PUT /api/org/{orgId}/alert-rules
     #
@@ -2162,7 +2162,7 @@ module Infrawrench
     #
     # Runs a read-only shell probe over SSH and reports what the host is
     # missing, plus the packages and commands that would fix it. A POST because
-    # it opens a connection to the named host and must never be cached — its
+    # it opens a connection to the named host and must never be cached; its
     # whole value is saying what the host is now.
     #
     # POST /api/org/{orgId}/apps/check
@@ -2195,7 +2195,7 @@ module Infrawrench
     #
     # Installs the named requirements using the host's own package manager, then
     # re-probes and reports what the host now is. Takes requirement ids, never
-    # commands — the commands are derived server-side from a fresh probe. Needs
+    # commands; the commands are derived server-side from a fresh probe. Needs
     # root or passwordless sudo on the host, respects change freezes, and is
     # audited as `linux_app.host_setup`.
     #
@@ -2438,7 +2438,7 @@ module Infrawrench
     # Record a restore drill
     #
     # A `verified` drill **must** carry the measured time: an RPO comes from the
-    # backup, and an RTO can only come from somebody with a stopwatch — that
+    # backup, and an RTO can only come from somebody with a stopwatch; that
     # number is the entire point of the exercise. A `blocked` drill must not
     # carry one, because it never started.
     #
@@ -2468,7 +2468,7 @@ module Infrawrench
 
     # Delete a recorded drill
     #
-    # For one recorded against the wrong resource or the wrong date. Audited —
+    # For one recorded against the wrong resource or the wrong date. Audited:
     # deleting evidence that a restore failed is exactly the edit a reviewer
     # would want to know about.
     #
@@ -2495,7 +2495,7 @@ module Infrawrench
     # Where every protected resource stands on restore
     #
     # Backup coverage answers 'is there a backup'. This answers 'does it
-    # restore, and how long does it take' — a different question, and the one
+    # restore, and how long does it take'; a different question, and the one
     # routinely answered wrongly on the day.
     #
     # A drill is a **record that somebody tried**, not an automated restore:
@@ -2556,8 +2556,8 @@ module Infrawrench
 
     # Create a backup policy
     #
-    # A policy must demand at least one of `maxRpoHours` and `minRetentionDays`
-    # — one that demands nothing could never produce a finding and would read as
+    # A policy must demand at least one of `maxRpoHours` and `minRetentionDays`:
+    # one that demands nothing could never produce a finding and would read as
     # protection while providing none. An empty `resourceTypeIds` selects every
     # stateful resource type.
     #
@@ -2681,7 +2681,7 @@ module Infrawrench
     # What protects the organization's stateful resources, what does not, and
     # which backups protect nothing. Derived from already-synced inventory using
     # the `backupRole` and `backupPolicy` declarations plugins carry on their
-    # resource types — no provider API calls are made and results reflect the
+    # resource types; no provider API calls are made and results reflect the
     # last sync. Findings are recomputed on every read rather than stored.
     # Orphaned backups carry a trailing-30-day spend quote when billing data is
     # available.
@@ -2737,7 +2737,7 @@ module Infrawrench
       )
     end
 
-    # Revoke a bastion — accounts referencing it have their bastion binding
+    # Revoke a bastion; accounts referencing it have their bastion binding
     # cleared
     #
     # _Requires permission: `bastions:write`._
@@ -2796,7 +2796,7 @@ module Infrawrench
     # A capacity slot is one seat bought outright for a fixed term instead of
     # rented monthly, and it grants paid-plan access on its own. This is a
     # one-time payment, so the seats are granted by the
-    # `checkout.session.completed` webhook once Stripe confirms the payment — a
+    # `checkout.session.completed` webhook once Stripe confirms the payment; a
     # 200 here only means the buyer was sent to a payment page. Rejected with
     # 400 for complimentary organizations, and 503 when the deployment has no
     # one-time capacity price configured.
@@ -2840,7 +2840,7 @@ module Infrawrench
 
     # Start a Stripe Checkout session
     #
-    # Rejected with 400 for complimentary organizations — they are never billed.
+    # Rejected with 400 for complimentary organizations; they are never billed.
     #
     # _Requires permission: `billing:write`._
     #
@@ -2997,8 +2997,8 @@ module Infrawrench
 
     # List billing rules in evaluation order
     #
-    # Billing rules are the organisation's own adjustments to collected spend —
-    # a markup that recovers shared overhead, a discount negotiated outside the
+    # Billing rules are the organisation's own adjustments to collected spend; a
+    # markup that recovers shared overhead, a discount negotiated outside the
     # provider's pricing, a shared cluster reallocated onto the teams that use
     # it.
     #
@@ -3090,7 +3090,7 @@ module Infrawrench
 
     # Update a billing rule
     #
-    # A full replace, `enabled` included — switching a markup off is an edit of
+    # A full replace, `enabled` included; switching a markup off is an edit of
     # the rule, so there is one audited action for “this rule changed” rather
     # than two.
     #
@@ -3579,7 +3579,7 @@ module Infrawrench
     # accumulating**, which is what makes a nightly job safe to retry. Nothing
     # lands unless the whole batch validates, so a bad row is a 400 rather than
     # half a month restated. The same guarantees back
-    # `infra.businessMetrics.write(...)` in a workflow — both go through one
+    # `infra.businessMetrics.write(...)` in a workflow; both go through one
     # validator.
     #
     # _Requires permission: `costs:write`._
@@ -3657,7 +3657,7 @@ module Infrawrench
 
     # Create a business metric
     #
-    # Keys must be unique per organization among live metrics — they are how
+    # Keys must be unique per organization among live metrics; they are how
     # workflows and the CLI address the metric. A key collision is a 409.
     #
     # _Requires permission: `costs:write`._
@@ -3829,7 +3829,7 @@ module Infrawrench
     # answer are worth knowing before reading it:
     #
     # - **The ratio is computed at the requested bucket**, from a summed
-    # numerator and a summed denominator — never a mean of daily ratios, which
+    # numerator and a summed denominator: never a mean of daily ratios, which
     # weights a quiet day as heavily as a peak one. The same holds for
     # `overallValue`.
     # - **A missing or non-positive denominator is a gap** (`value: null` with a
@@ -3871,8 +3871,8 @@ module Infrawrench
 
     # Update a business metric
     #
-    # Replaces the whole definition. Changing `key` never orphans history —
-    # values are keyed on the metric's id — but it does break a workflow still
+    # Replaces the whole definition. Changing `key` never orphans history
+    # (values are keyed on the metric's id) but it does break a workflow still
     # writing to the old key, which is why the key is separate from the display
     # name in the first place.
     #
@@ -3967,7 +3967,7 @@ module Infrawrench
     #
     # Returns the only copy of the feed URL. The token in it is 32 random bytes,
     # stored as a SHA-256 hash, and is the sole credential on a route that runs
-    # outside every auth layer — treat the URL as a secret. The URL deliberately
+    # outside every auth layer; treat the URL as a secret. The URL deliberately
     # contains no organization id.
     #
     # An organization may hold 25 live subscriptions; revoking makes room.
@@ -4020,7 +4020,7 @@ module Infrawrench
 
     # List the organization's iCalendar subscriptions
     #
-    # Feed URLs that have been minted, including revoked ones — a revoked row is
+    # Feed URLs that have been minted, including revoked ones; a revoked row is
     # kept so the audit trail still resolves. The token itself is never
     # returned.
     #
@@ -4059,7 +4059,7 @@ module Infrawrench
     # One time axis over six things the organization already stores: change
     # freezes, sleep/wake schedules, declared deadlines (certificates, domains,
     # keys and resource leases), commitment term ends, cron-triggered workflow
-    # runs, and declared incidents. Nothing here is a new record — the calendar
+    # runs, and declared incidents. Nothing here is a new record; the calendar
     # is recomputed on every read, exactly as posture findings and backup
     # coverage are.
     #
@@ -4324,7 +4324,7 @@ module Infrawrench
     # `cooldownMinutes`, covering every change since the previous one. These
     # settings decide which changes count and how often a message may go out.
     # Who receives it is the `resourceDrift` opt-in on push preferences, Slack
-    # channels and Teams webhooks — off by default on all three.
+    # channels and Teams webhooks; off by default on all three.
     #
     # GET /api/org/{orgId}/changes/alert-settings
     #
@@ -4383,7 +4383,7 @@ module Infrawrench
     # Revert one change event
     #
     # Applies the inverse patch through the plugin's ordinary `updateResource`
-    # path — the same call the Edit form makes — and only for the fields the dry
+    # path (the same call the Edit form makes) and only for the fields the dry
     # run marked `revertible`.
     #
     # The plan is rebuilt against a fresh live read immediately before the
@@ -4409,14 +4409,14 @@ module Infrawrench
     #
     # The claim carries an owner token, and every write that ends a revert is
     # fenced on it. An attempt whose provider call outlives the lease can
-    # therefore neither release nor complete the claim that replaced it — it
-    # gets `409` with `appliedFields` naming what it did write, so the caller
-    # can reconcile rather than assume. Two attempts can overlap in that case,
-    # but they cannot disagree: both invert the same recorded event to the same
+    # therefore neither release nor complete the claim that replaced it; it gets
+    # `409` with `appliedFields` naming what it did write, so the caller can
+    # reconcile rather than assume. Two attempts can overlap in that case, but
+    # they cannot disagree: both invert the same recorded event to the same
     # values, so the second one's patch is a subset of the first's.
     #
     # If a write reaches the provider but recording it fails, the response is
-    # `500` with `appliedFields` — the resource moved and the timeline has not
+    # `500` with `appliedFields`: the resource moved and the timeline has not
     # caught up. The claim is deliberately held in that case, and the next
     # attempt after the lease expires finds every field already back and records
     # the revert without touching the provider again, answering `200` with
@@ -4428,13 +4428,13 @@ module Infrawrench
     # Blocked with `423` while an org change freeze is in effect. Every attempt
     # whose write reached the provider is audit-logged as
     # `resource.change_revert`, including one that lost its claim or could not
-    # record — the entry's `outcome` is `recorded`, `superseded`, `unrecorded`
-    # or `reconciled`, so a contested outcome reads as one mutation rather than
-    # as several reverts. An attempt that neither wrote nor recorded anything
-    # logs nothing. Attribution is best-effort: no transaction spans a
-    # third-party cloud API and Infrawrench's database, so if the audit insert
-    # itself fails the response carries `auditRecorded: false` and the details
-    # go to the server log rather than being silently dropped.
+    # record; the entry's `outcome` is `recorded`, `superseded`, `unrecorded` or
+    # `reconciled`, so a contested outcome reads as one mutation rather than as
+    # several reverts. An attempt that neither wrote nor recorded anything logs
+    # nothing. Attribution is best-effort: no transaction spans a third-party
+    # cloud API and Infrawrench's database, so if the audit insert itself fails
+    # the response carries `auditRecorded: false` and the details go to the
+    # server log rather than being silently dropped.
     #
     # The stored resource snapshot is deliberately left untouched, so the next
     # poll observes the reverted state and records it as an ordinary change
@@ -4482,7 +4482,7 @@ module Infrawrench
     #
     # Inverts the recorded diff and reconciles it against the resource's
     # *current* live fields, which is the whole point: the poller may have
-    # recorded this hours ago and the world may have moved on. Read-only — it
+    # recorded this hours ago and the world may have moved on. Read-only: it
     # reads from the provider and writes nothing.
     #
     # Only `updated` events with a field diff can be reverted. `outputs.*`
@@ -4540,7 +4540,7 @@ module Infrawrench
     # run-rate delta.
     #
     # A POST because it takes a list of ids, not because it writes: nothing is
-    # stored. The answer is recomputed on every call, deliberately — provider
+    # stored. The answer is recomputed on every call, deliberately; provider
     # cost arrives late and is then restated, so a stored number would be a
     # wrong number that never corrects itself.
     #
@@ -4576,7 +4576,7 @@ module Infrawrench
     # Change events recorded by the resource poller: each poll cycle diffs the
     # freshly fetched state against the stored snapshot and records resources
     # that appeared, changed a stored field, or disappeared upstream.
-    # Cross-provider by construction — the diff runs on the generic stored
+    # Cross-provider by construction; the diff runs on the generic stored
     # record, so every plugin's resources show up here.
     #
     # _Requires permission: `resources:read`._
@@ -4796,11 +4796,11 @@ module Infrawrench
 
     # Reservations, savings plans and committed-use discounts
     #
-    # The organization's purchased commitments — reserved instances, savings
-    # plans, committed-use discounts — with three derived readings.
+    # The organization's purchased commitments (reserved instances, savings
+    # plans, committed-use discounts) with three derived readings.
     #
     # **Coverage** is a range, not a number: the broad ratio counts every
-    # uncovered usage dollar in the denominator (a lower bound — egress and
+    # uncovered usage dollar in the denominator (a lower bound; egress and
     # per-request charges can never be committed against), the narrow ratio only
     # uncovered usage in cells where a commitment demonstrably landed (an upper
     # bound). Accounts whose plugin cannot distinguish charge types are excluded
@@ -4808,7 +4808,7 @@ module Infrawrench
     # not 0%.
     #
     # **Utilization** is measured only over days cost data was actually
-    # collected — a collection gap is reported as missing days, never counted as
+    # collected; a collection gap is reported as missing days, never counted as
     # idle commitment. Unit-denominated commitments (GCP) report null with a
     # reason, never 0%. Azure's own reported utilization rides on each holding
     # separately and is never blended with the derived figure.
@@ -4848,7 +4848,7 @@ module Infrawrench
     # Apply a configuration document
     #
     # Applies the document in a single transaction and returns the plan that was
-    # executed — all or nothing, so a failure never leaves the organization
+    # executed; all or nothing, so a failure never leaves the organization
     # halfway between two configurations.
     #
     # Requires the write permission of every section the document carries, so
@@ -4860,7 +4860,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -4891,7 +4891,7 @@ module Infrawrench
     #
     # Credentials, accounts, resources and workflow signing secrets are never
     # included. Ordering is stable, so re-exporting an unchanged organization
-    # produces the same bytes — commit it to git and the diff is the change.
+    # produces the same bytes; commit it to git and the diff is the change.
     #
     # Requires the read permission of every section exported; it refuses rather
     # than silently omitting one, because a partial document applied in
@@ -5224,7 +5224,7 @@ module Infrawrench
     #
     # Writes the finding as a cost annotation, so the step in the run rate is
     # explained on the graph where it shows. Re-posting the same subject
-    # **rewords the existing note** rather than adding a second — which is what
+    # **rewords the existing note** rather than adding a second; which is what
     # makes it safe to pin a finding again once the provider has finished
     # restating. The note's date and report scope are never rewritten: they may
     # have been edited deliberately.
@@ -5311,8 +5311,8 @@ module Infrawrench
     #
     # Dated notes drawn over cost charts. With `reportId`, the set a chart for
     # that report draws: the org-wide notes plus that report's own. Without it,
-    # every annotation in the org. Annotations are an overlay — they never
-    # appear in a series, a total, or an axis.
+    # every annotation in the org. Annotations are an overlay; they never appear
+    # in a series, a total, or an axis.
     #
     # _Requires permission: `costs:read`._
     #
@@ -6172,7 +6172,7 @@ module Infrawrench
     # Runs the export immediately against the same code path the poller uses,
     # writing every period in the restatement window. Answers 200 with `status:
     # "failed"` and a message rather than an error status when the destination
-    # rejects the write — the caller wants the reason, and the same failure is
+    # rejects the write; the caller wants the reason, and the same failure is
     # recorded on the export.
     #
     # _Requires permission: `org:settings:write`._
@@ -6326,6 +6326,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CostReportFolderInput`.
@@ -6371,7 +6373,7 @@ module Infrawrench
 
     # List cost-report folders
     #
-    # The org's report folders as a flat list — build the tree from
+    # The org's report folders as a flat list; build the tree from
     # `parentFolderId`. Folders organize the Reports list and nothing else; a
     # report's id, URL and dashboard cards are unchanged by where it is filed.
     #
@@ -6396,7 +6398,7 @@ module Infrawrench
 
     # Update a cost-report folder
     #
-    # Rename and/or reparent. Filing a *report* is not here — that is `PUT
+    # Rename and/or reparent. Filing a *report* is not here; that is `PUT
     # /cost-reports/{id}` with a different `folderId`. Reparenting past the
     # 3-level depth limit, or under the folder's own subtree, is a 400.
     #
@@ -6406,6 +6408,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -6436,8 +6440,8 @@ module Infrawrench
 
     # List every delivery schedule in the organization
     #
-    # All reports' schedules in one call — what the CLI's schedules column
-    # reads. Schedules of deleted reports are excluded.
+    # All reports' schedules in one call; what the CLI's schedules column reads.
+    # Schedules of deleted reports are excluded.
     #
     # _Requires permission: `costs:read`._
     #
@@ -6470,7 +6474,7 @@ module Infrawrench
     # Create a delivery schedule
     #
     # On its cadence the server runs the report and sends a composed text
-    # summary — period total (converted to the org's display currency where
+    # summary; period total (converted to the org's display currency where
     # configured, with the conversion caveat), change vs the previous period,
     # top groups, and a deep link. No chart images. An empty result still sends,
     # saying so.
@@ -6554,7 +6558,7 @@ module Infrawrench
     # Runs the report and delivers it to this schedule's destinations
     # immediately, ignoring the schedule and its enabled flag. Fails with a 400
     # naming the reason when nothing could be delivered. A successful manual
-    # send clears a parked failure — it is the documented recovery for a partial
+    # send clears a parked failure; it is the documented recovery for a partial
     # delivery.
     #
     # _Requires permission: `org:settings:write`._
@@ -6591,7 +6595,7 @@ module Infrawrench
     # List the destinations a schedule can deliver to
     #
     # The org's live Slack channels and Teams webhooks, and whether this
-    # deployment can send mail. Destinations are picked from here — a schedule
+    # deployment can send mail. Destinations are picked from here; a schedule
     # can only point at surfaces the org already connected.
     #
     # _Requires permission: `org:settings:write`._
@@ -6698,6 +6702,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CostReportInput`.
@@ -6717,7 +6723,7 @@ module Infrawrench
     # Delete a cost report
     #
     # Soft delete. Every dashboard card pointing at the report is removed with
-    # it — a card whose report is gone could only ever render as an unavailable
+    # it; a card whose report is gone could only ever render as an unavailable
     # tile.
     #
     # _Requires permission: `costs:write`._
@@ -6854,7 +6860,7 @@ module Infrawrench
     # Update a cost report
     #
     # Replaces the report's name, description, config and folder. Every
-    # dashboard showing the report picks up the new config — that is what
+    # dashboard showing the report picks up the new config; that is what
     # referencing a report by id buys.
     #
     # _Requires permission: `costs:write`._
@@ -6863,6 +6869,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -6894,7 +6902,7 @@ module Infrawrench
     # List scenario models
     #
     # Named, reusable sets of adjustments an organization overlays on a cost
-    # forecast — the **known future cost a trend fit cannot see**. Pass an id as
+    # forecast; the **known future cost a trend fit cannot see**. Pass an id as
     # `POST /costs/query`'s `scenarioModelId` (alongside `forecast: true`) to
     # get the adjusted projection back *beside* the unadjusted one, never
     # instead of it.
@@ -6955,7 +6963,7 @@ module Infrawrench
 
     # Create a scenario model
     #
-    # Names must be unique per organization (case-insensitively) — the name is
+    # Names must be unique per organization (case-insensitively); the name is
     # what a chart prints under its scenario line and what the CLI's `--scenario
     # <name>` addresses, so two models sharing one would make both meaningless.
     # A model needs at least one adjustment: an empty model changes nothing,
@@ -6987,7 +6995,7 @@ module Infrawrench
 
     # Delete a scenario model
     #
-    # Soft delete — **refused with a 409 while anything references the model**,
+    # Soft delete: **refused with a 409 while anything references the model**,
     # with the referents in the body. For a chart, deleting would silently drop
     # the assumptions from a projection somebody is reading; for a budget it
     # would move the forecast thresholds back to the bare trend, changing when
@@ -7000,7 +7008,7 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Still referenced — the body lists every referent.
+    # Raises on 409: Still referenced: the body lists every referent.
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -7019,9 +7027,9 @@ module Infrawrench
 
     # List a scenario model's referents
     #
-    # Every budget, cost report and dashboard cost graph referencing this model
-    # — what an edit will change, and what a delete would be refused over.
-    # Budgets come first: they are the referents that page people.
+    # Every budget, cost report and dashboard cost graph referencing this model;
+    # what an edit will change, and what a delete would be refused over. Budgets
+    # come first: they are the referents that page people.
     #
     # _Requires permission: `costs:read`._
     #
@@ -7048,7 +7056,7 @@ module Infrawrench
     #
     # Replaces the whole model. This is the high-leverage write: every chart
     # drawing it, and **every budget whose forecast thresholds are measured
-    # against it**, uses the new numbers on its next evaluation — which for a
+    # against it**, uses the new numbers on its next evaluation; which for a
     # budget can change which alerts fire. `GET /{id}/referents` names what a
     # change will touch.
     #
@@ -7272,7 +7280,7 @@ module Infrawrench
     # Explain a detected cost anomaly
     #
     # Record what a finding actually was, and publish that sentence as a cost
-    # annotation on **every** chart covering the anomalous day — the point being
+    # annotation on **every** chart covering the anomalous day; the point being
     # that 'we migrated the fleet' is not a fact about whichever report somebody
     # happened to open. The note's date (the anomalous day) and its org-wide
     # scope are derived from the anomaly and are not the caller's to choose.
@@ -7319,7 +7327,7 @@ module Infrawrench
     # trailing 28-day baseline by a statistical threshold (mean + N·stddev, with
     # an absolute floor to ignore penny-scale noise), and a `new_source`, where
     # a provider or service with no spend at all across that window suddenly
-    # billed a material amount. Thresholds are per organization — see GET
+    # billed a material amount. Thresholds are per organization: see GET
     # /costs/anomaly-settings. Newest day first, capped at 200 rows.
     #
     # _Requires permission: `costs:read`._
@@ -7356,8 +7364,8 @@ module Infrawrench
     # Get the organization's anomaly detection thresholds
     #
     # The tunable part of cost anomaly detection. Everything else about the
-    # model — the 28-day baseline, the 7-day notification cooldown, the minimum
-    # history a baseline needs — is fixed. An organization that has never
+    # model (the 28-day baseline, the 7-day notification cooldown, the minimum
+    # history a baseline needs ) is fixed. An organization that has never
     # changed a threshold reads back the defaults. The response also carries the
     # derived, read-only `smsConfigured`.
     #
@@ -7384,11 +7392,11 @@ module Infrawrench
     #
     # Takes effect on the next detection pass (which runs after each cost
     # collection). Anomalies already stored are not re-judged. The four
-    # threshold fields are required — this is a PUT of the whole settings
-    # object, not a patch — and `smsAlerts` deliberately has no server-side
-    # default, so a client that omits it is rejected rather than silently
-    # switching an organization's SMS paging back off. `smsConfigured` is
-    # derived and is not accepted here.
+    # threshold fields are required (this is a PUT of the whole settings object,
+    # not a patch) and `smsAlerts` deliberately has no server-side default, so a
+    # client that omits it is rejected rather than silently switching an
+    # organization's SMS paging back off. `smsConfigured` is derived and is not
+    # accepted here.
     #
     # _Requires permission: `costs:write`._
     #
@@ -7601,7 +7609,7 @@ module Infrawrench
     #
     # Takes effect on the next evaluation pass (which runs after each cost
     # collection). Already-fired alerts are not re-judged, and horizons that
-    # have already fired for a commitment's current term do not fire again —
+    # have already fired for a commitment's current term do not fire again;
     # widening the horizon list warns about future crossings, not past ones. A
     # PUT of the whole object, not a patch.
     #
@@ -7746,10 +7754,10 @@ module Infrawrench
     #
     # The three slow-lane cost alerts in one feed, newest first: commitments
     # about to lapse, commitments that are not being used, and business metrics
-    # whose cost per unit rose. Unlike budgets, anomalies and change alerts —
-    # all of which compare a spend total against another spend total — these
-    # read the commitment calendar and the volume the spend bought, so they see
-    # the two surprises the other three structurally cannot.
+    # whose cost per unit rose. Unlike budgets, anomalies and change alerts (all
+    # of which compare a spend total against another spend total) these read the
+    # commitment calendar and the volume the spend bought, so they see the two
+    # surprises the other three structurally cannot.
     #
     # _Requires permission: `costs:read`._
     #
@@ -7860,8 +7868,8 @@ module Infrawrench
 
     # Push cost rows from your own systems
     #
-    # Reports spend Infrawrench has no provider plugin for — a parsed SaaS
-    # invoice, an internal chargeback, a colo bill — into the same store the
+    # Reports spend Infrawrench has no provider plugin for (a parsed SaaS
+    # invoice, an internal chargeback, a colo bill) into the same store the
     # provider collectors write to, so it appears in cost graphs, dimension
     # filters, and budgets alongside everything else.
     #
@@ -7904,7 +7912,7 @@ module Infrawrench
     #
     # Cost centres nest, so the list is a depth-first tree. Each entry carries
     # `totals` (spend allocated directly to it) and `subtreeTotals` (its own
-    # plus every descendant's) — "Engineering, of which Platform" needs both.
+    # plus every descendant's). "Engineering, of which Platform" needs both.
     # Rules still evaluate first-match-wins by ascending priority against a flat
     # list, so a row is allocated exactly once even when a rule targets a parent
     # and another targets its child; at equal priority the more deeply nested
@@ -7927,7 +7935,7 @@ module Infrawrench
     #   amount.
     # @param adjusted [String, nil] Apply the organization's billing rules (see /billing-rules):
     #   markups multiply, and a reallocation moves a centre's spend onto another centre. Off by
-    #   default — a chargeback report that silently showed marked-up numbers is one the receiving
+    #   default; a chargeback report that silently showed marked-up numbers is one the receiving
     #   team could not reconcile. On, the response carries `adjustment` with the collected totals
     #   beside the adjusted ones. Fixed-amount rules are booked onto the cost centre they name (or
     #   "Unallocated" when they name none), pro-rated across the period.
@@ -7971,7 +7979,7 @@ module Infrawrench
     #
     # Spend on cost rows missing at least one of the org's required tag keys,
     # overall and per key, plus the largest untagged (account, service) buckets.
-    # Empty when no tag policy is configured — untagged is only meaningful
+    # Empty when no tag policy is configured: untagged is only meaningful
     # against a policy.
     #
     # _Requires permission: `costs:read`._
@@ -8015,7 +8023,7 @@ module Infrawrench
     # Credential hygiene report
     #
     # API keys nobody uses, SSH keys nothing references, and members holding
-    # write permissions they have never exercised — derived entirely from data
+    # write permissions they have never exercised; derived entirely from data
     # the server already holds. No provider call and nothing to enable.
     #
     # **The audit log only witnesses writes.** Reading a resource list or a cost
@@ -8023,7 +8031,7 @@ module Infrawrench
     # about read permissions: an absence of evidence about them proves nothing.
     # `permissionFindingsWithheld` is set when the organization does not yet
     # have enough audit history for the unused-permission finding to be
-    # meaningful. Both are load-bearing — a governance report that overclaims is
+    # meaningful. Both are load-bearing; a governance report that overclaims is
     # worse than none.
     #
     # Gated on `audit:read` rather than a permission of its own: every fact here
@@ -8065,7 +8073,7 @@ module Infrawrench
     #
     # Every prepaid pot the organization holds, most urgent first. A provider
     # that bills in arrears sends an invoice you can argue with; a prepaid pot
-    # that empties simply stops answering — so this is an availability number as
+    # that empties simply stops answering: so this is an availability number as
     # much as a finance one.
     #
     # The burn rate is measured from the server's own series of readings rather
@@ -8619,7 +8627,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -8713,7 +8721,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 404: Not found
@@ -8765,7 +8773,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 404: Not found
@@ -9569,8 +9577,8 @@ module Infrawrench
     #   (the default) is what the provider charged on the day it charged it; `amortized` spreads a
     #   commitment's up-front fee across the term it buys; `blended` also spreads each
     #   commitment's discount evenly over the usage it could cover. It is echoed on every response
-    #   because a delta whose basis is unstated is unreadable — an amortized 'after' against a
-    #   cash 'before' looks exactly like a saving.
+    #   because a delta whose basis is unstated is unreadable: an amortized 'after' against a cash
+    #   'before' looks exactly like a saving.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `DeploymentCostImpact` — see
     #   `sig/infrawrench/sdk.rbs`.
@@ -9674,11 +9682,11 @@ module Infrawrench
     # Roll back to a previous deployment
     #
     # Re-runs that run's `deploy()` with the image and plan it recorded,
-    # building nothing — the exact artifact that was known good ships again. The
+    # building nothing; the exact artifact that was known good ships again. The
     # Infrafile is read at the commit that run deployed, not at the branch head.
     # Only a successful run that produced an image can be rolled back to. With
     # `deleteCreated`, resources that runs after the target created through
-    # `infra.accounts` are deleted once the rollback has succeeded — undoing the
+    # `infra.accounts` are deleted once the rollback has succeeded; undoing the
     # provisioning, not just the shipping. Deletions are best-effort and
     # reported in the result's notes.
     #
@@ -9690,7 +9698,7 @@ module Infrawrench
     #
     # Raises on 401: Unauthenticated
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -9731,10 +9739,10 @@ module Infrawrench
 
     # Deploy an environment whenever a branch moves
     #
-    # Arming a trigger records the branch's current commit WITHOUT deploying it
-    # — the trigger fires on the next push, not on the state at the moment it
-    # was created. The environment is validated against the Infrafile at that
-    # branch head, so a typo fails here rather than silently never firing.
+    # Arming a trigger records the branch's current commit WITHOUT deploying it;
+    # the trigger fires on the next push, not on the state at the moment it was
+    # created. The environment is validated against the Infrafile at that branch
+    # head, so a typo fails here rather than silently never firing.
     #
     # _Requires permission: `deployments:write`._
     #
@@ -10013,8 +10021,8 @@ module Infrawrench
     #
     # Email is a digest-only transport, so its destinations are an
     # organization-level address list rather than a per-channel trigger.
-    # Addresses need not belong to Infrawrench users — a finance alias is a
-    # valid recipient.
+    # Addresses need not belong to Infrawrench users; a finance alias is a valid
+    # recipient.
     #
     # GET /api/org/{orgId}/digest/recipients
     #
@@ -10073,7 +10081,7 @@ module Infrawrench
 
     # Compose and send last week's digest now
     #
-    # Ignores the schedule and the enabled flag — composes the digest for the
+    # Ignores the schedule and the enabled flag; composes the digest for the
     # last complete week and sends it to every opted-in channel and email
     # recipient. This is also the manual recovery for a partial delivery, which
     # is never retried automatically. Fails when nothing is routed to receive
@@ -10100,7 +10108,7 @@ module Infrawrench
     # Update the weekly digest settings
     #
     # Every field is optional. Enabling schedules the first digest for the next
-    # configured send time rather than sending immediately — use POST
+    # configured send time rather than sending immediately; use POST
     # /digest/send for an immediate one. The week boundary follows `timezone`,
     # so the reported window is always the organization's own local
     # Monday-to-Sunday week. Changing the schedule clears any parked failure
@@ -10140,7 +10148,7 @@ module Infrawrench
     # One view over every zone and record across the connected DNS providers
     # (Cloudflare, Route 53, Cloud DNS, DigitalOcean, Netlify, Azure DNS,
     # Vercel), with each record target classified against the rest of the
-    # workspace. No provider API calls are made and no DNS is resolved — results
+    # workspace. No provider API calls are made and no DNS is resolved: results
     # reflect the last sync.
     #
     # A `dangling` target is a subdomain-takeover candidate: the record points
@@ -10215,8 +10223,8 @@ module Infrawrench
 
     # Compare two accounts' resource inventories
     #
-    # Compares two accounts of the same provider — typically staging against
-    # production — over already-synced state: which resource types exist in one
+    # Compares two accounts of the same provider (typically staging against
+    # production) over already-synced state: which resource types exist in one
     # and not the other, the per-type count deltas, and the fields on which two
     # corresponding resources disagree (instance class, engine version, feature
     # flags).
@@ -10224,8 +10232,8 @@ module Infrawrench
     # Resources are paired by resource type plus name with environment words
     # removed, so `api-staging` lines up with `api-prod` without any naming
     # convention to configure. By default the comparison hides divergences that
-    # are artefacts of being two different resources — ids, links, network
-    # addresses and timestamps — because every resource has different ones; pass
+    # are artefacts of being two different resources (ids, links, network
+    # addresses and timestamps) because every resource has different ones; pass
     # `includeIdentityFields=true` to see them.
     #
     # Read-only and cheap: no provider API calls are made, so results reflect
@@ -10241,7 +10249,7 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param a [String] Baseline account id — by convention the environment that works.
+    # @param a [String] Baseline account id; by convention the environment that works.
     # @param b [String] Compared account id. Must differ from `a` and use the same provider.
     # @param resource_type_id [String, nil] Compare one resource type only.
     # @param include_identity_fields [String, nil] Compare identity and timestamp fields too,
@@ -10283,7 +10291,7 @@ module Infrawrench
 
     # Forget a torn-down environment
     #
-    # Removes the record. Refuses while the instance still owns resources — the
+    # Removes the record. Refuses while the instance still owns resources; the
     # row is the only thing that knows they exist. Audit-logged.
     #
     # _Requires permission: `resources:write`._
@@ -10292,7 +10300,7 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: The environment is still live — tear it down first
+    # Raises on 409: The environment is still live; tear it down first
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -10433,8 +10441,8 @@ module Infrawrench
 
     # Set the organization's environment TTL rails
     #
-    # `org:settings:write`, not `resources:write` — this is a governance
-    # decision about how long the organization is willing to pay for a throwaway
+    # `org:settings:write`, not `resources:write`: this is a governance decision
+    # about how long the organization is willing to pay for a throwaway
     # environment. Clamped to a 720-hour ceiling; the default is clamped to the
     # maximum. Audit-logged.
     #
@@ -10472,7 +10480,7 @@ module Infrawrench
     #
     # Save a capture draft as a template. Member keys must be unique, every
     # parameter and member reference must resolve, and the members must be
-    # orderable — a dependency cycle is rejected here rather than half-way
+    # orderable; a dependency cycle is rejected here rather than half-way
     # through an apply. Audit-logged.
     #
     # _Requires permission: `resources:write`._
@@ -10502,7 +10510,7 @@ module Infrawrench
 
     # Delete an environment template
     #
-    # Live instances keep running and keep their TTL — they own real resources,
+    # Live instances keep running and keep their TTL; they own real resources,
     # and the template is only where they came from. Their `templateId` becomes
     # null; the denormalized `templateName` is what the surface reads.
     # Audit-logged.
@@ -10533,7 +10541,7 @@ module Infrawrench
     #
     # Runs each member's create fields through the plugin's own `estimateCost`.
     # A member the plugin cannot price is counted in `unpricedCount` and makes
-    # the total `partial` — `null` is never rounded to zero.
+    # the total `partial`: `null` is never rounded to zero.
     #
     # _Requires permission: `resources:read`._
     #
@@ -10707,7 +10715,7 @@ module Infrawrench
     # Preview a template capture
     #
     # Turn a selection of live resources into a draft template. **Persists
-    # nothing** — the editor shows the draft so the user can choose which fields
+    # nothing**: the editor shows the draft so the user can choose which fields
     # to vary before saving. The shape of every member comes from the plugin's
     # own `getCreateConfig`: a captured value with no matching create field is
     # dropped, and a resource type the plugin cannot create is reported in
@@ -11335,7 +11343,7 @@ module Infrawrench
     # List uploaded Terraform state documents
     #
     # Every state document the organization has uploaded, newest first. The
-    # documents themselves are never stored — only the parsed, redacted
+    # documents themselves are never stored; only the parsed, redacted
     # projection.
     #
     # GET /api/org/{orgId}/iac/states
@@ -11432,7 +11440,7 @@ module Infrawrench
     #
     # The managed/unmanaged badge for a resource detail page, computed against
     # the newest state document. `status` is null when the organization has
-    # uploaded none — absence of a state is not evidence of ClickOps. A query
+    # uploaded none; absence of a state is not evidence of ClickOps. A query
     # parameter rather than a path segment because composite resource ids
     # contain slashes.
     #
@@ -11469,7 +11477,7 @@ module Infrawrench
     # List declared incidents
     #
     # Every incident the organization has declared, newest first, each with the
-    # artefacts its declaration created — including the ones that failed.
+    # artefacts its declaration created: including the ones that failed.
     #
     # _Requires permission: `incidents:read`._
     #
@@ -11630,7 +11638,7 @@ module Infrawrench
     # Delete an incident
     #
     # Removes the incident, its notes and its artefact records. It does not lift
-    # a freeze or close a status-page update — resolve for that; deleting is for
+    # a freeze or close a status-page update, resolve for that; deleting is for
     # a mis-declaration. Audit-logged.
     #
     # _Requires permission: `incidents:write`._
@@ -11658,8 +11666,8 @@ module Infrawrench
     # Export a pre-filled postmortem
     #
     # Markdown with the timeline, the affected resources, the duration, the time
-    # to mitigate and the notes already filled in. The analysis headings —
-    # impact, root cause, action items — are deliberately left blank: a
+    # to mitigate and the notes already filled in. The analysis headings
+    # (impact, root cause, action items) are deliberately left blank: a
     # generated document that guesses at a root cause is worse than one that
     # leaves a heading.
     #
@@ -11689,9 +11697,9 @@ module Infrawrench
     #
     # Re-runs only the side effects whose artefact is in a failure state,
     # replacing each failure rather than queueing a second attempt beside it. A
-    # `failed` artefact is **re-created**; a `close_failed` one is **re-closed**
-    # — re-creating the latter would open a second change freeze or post a
-    # duplicate public notice. A status-page retry reuses the components
+    # `failed` artefact is **re-created**; a `close_failed` one is
+    # **re-closed**; re-creating the latter would open a second change freeze or
+    # post a duplicate public notice. A status-page retry reuses the components
     # recorded on the artefact's `request`, so the announcement keeps its
     # original scope. Its own endpoint rather than a flag on PATCH, because it
     # writes into three external systems. Audit-logged.
@@ -11724,8 +11732,8 @@ module Infrawrench
     # provider status incidents, audit entries, change freezes and workflow runs
     # (all via the same union the Moment screen uses), plus probe state
     # transitions, metric-alert firings, the incident's own life events, its
-    # artefacts and its operator notes. Nothing is copied — a correction
-    # upstream shows up here on the next read.
+    # artefacts and its operator notes. Nothing is copied; a correction upstream
+    # shows up here on the next read.
     #
     # Probe transitions are an approximation: `synthetic_probes` keeps only a
     # single `lastStateChangeAt`, so a probe that flapped twice inside the
@@ -11755,7 +11763,7 @@ module Infrawrench
     # Edit or transition an incident
     #
     # Omitted fields keep their value. Setting `status` stamps the matching
-    # timestamp, and resolving undoes exactly what this incident created — the
+    # timestamp, and resolving undoes exactly what this incident created; the
     # freeze whose id is on its own artefact, not whatever freeze happens to be
     # in effect. Resolving an incident that was never marked mitigated
     # back-fills `mitigatedAt` from `resolvedAt`. Audit-logged.
@@ -11857,7 +11865,7 @@ module Infrawrench
       @transport = transport
     end
 
-    # Approve an invoice — freeze its figures
+    # Approve an invoice; freeze its figures
     #
     # Computes the figures one last time and writes them onto the invoice
     # together with the exchange rates, the day they were read, the billing
@@ -11872,7 +11880,7 @@ module Infrawrench
     # customer's currency.
     #
     # Refused with 409, too, when the draft or its customer changed while the
-    # figures were being computed — a different period, scope, currency, cost
+    # figures were being computed: a different period, scope, currency, cost
     # basis or billing-rules setting. Nothing is approved in that case: freezing
     # figures that describe a different question would be worse than making the
     # caller look again.
@@ -11963,9 +11971,9 @@ module Infrawrench
     # Download an invoice as CSV
     #
     # The derivation, not a rendered document: what was collected, what the
-    # rules added, the rate and the day it was read, and the final figure —
-    # every column an accounts-payable clerk needs to check the arithmetic. Same
-    # RFC 4180 quoting as the scheduled cost exports.
+    # rules added, the rate and the day it was read, and the final figure; every
+    # column an accounts-payable clerk needs to check the arithmetic. Same RFC
+    # 4180 quoting as the scheduled cost exports.
     #
     # _Requires permission: `invoices:read`._
     #
@@ -12019,7 +12027,7 @@ module Infrawrench
     # List invoices
     #
     # Summaries, newest period first. A draft's `totals` is null here rather
-    # than recomputed — recomputing every draft would make opening the list one
+    # than recomputed; recomputing every draft would make opening the list one
     # cost-data scan per draft, and zero would be a lie the reader cannot
     # detect.
     #
@@ -12049,7 +12057,7 @@ module Infrawrench
 
     # Send an invoice to its customer
     #
-    # Changes no figure — the document was frozen at approval. It records the
+    # Changes no figure; the document was frozen at approval. It records the
     # **release** (this may go to the customer, and this person said so), then
     # emails the invoice to the customer's contact addresses with the CSV
     # attached.
@@ -12060,8 +12068,8 @@ module Infrawrench
     # delivery is visible, and re-sending retries it.
     #
     # Sending again needs `resend: true` only when the last attempt reached
-    # somebody — see `InvoiceSendRequest`. The body may be omitted entirely for
-    # a first send.
+    # somebody, see `InvoiceSendRequest`. The body may be omitted entirely for a
+    # first send.
     #
     # _Requires permission: `invoices:issue`._
     #
@@ -12093,7 +12101,7 @@ module Infrawrench
     # Edit a draft invoice
     #
     # Draft only. An approved, sent or void invoice is refused with 409 by the
-    # service, not merely hidden by the UI — an issued invoice that silently
+    # service, not merely hidden by the UI; an issued invoice that silently
     # changed after the customer received it is the worst outcome this feature
     # could produce.
     #
@@ -12127,7 +12135,7 @@ module Infrawrench
     # Void an issued invoice
     #
     # The only correction there is. The original keeps every figure it was sent
-    # with — “we billed you this, it was wrong, here is the corrected one” is a
+    # with: “we billed you this, it was wrong, here is the corrected one” is a
     # story a customer can follow, and “we changed the invoice” is not.
     #
     # With `supersede`, the void, the corrective draft and both directions of
@@ -12328,7 +12336,7 @@ module Infrawrench
     #   constructed with.
     # @param source_kind [String, nil]
     # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
-    #   return every link of the kind — this is the batch lookup a list view makes once instead of
+    #   return every link of the kind; this is the batch lookup a list view makes once instead of
     #   one request per row.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraIssueLink>` — see
@@ -12445,7 +12453,7 @@ module Infrawrench
 
     # Cancel a lease
     #
-    # Stop the countdown — the resource stays, the lease goes `canceled` and
+    # Stop the countdown; the resource stays, the lease goes `canceled` and
     # leaves the expiry radar. Audit-logged.
     #
     # _Requires permission: `resources:write`._
@@ -12473,9 +12481,9 @@ module Infrawrench
 
     # Create a resource lease
     #
-    # Attach an expiry to a resource — 'give me a test cluster for 3 days'. One
+    # Attach an expiry to a resource; 'give me a test cluster for 3 days'. One
     # lease per resource (an active lease conflicts; a terminal one is
-    # replaced). `autoDelete: true` opts into deletion at expiry — the poller
+    # replaced). `autoDelete: true` opts into deletion at expiry; the poller
     # announces it twice first, defers during change freezes, and requires the
     # caller to hold `resources:delete`. Audit-logged.
     #
@@ -12713,7 +12721,7 @@ module Infrawrench
     #   constructed with.
     # @param source_kind [String, nil]
     # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
-    #   return every link of the kind — this is the batch lookup a list view makes once instead of
+    #   return every link of the kind; this is the batch lookup a list view makes once instead of
     #   one request per row.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearIssueLink>` — see
@@ -12731,7 +12739,7 @@ module Infrawrench
 
     # List Linear teams
     #
-    # Backs the team picker, so nobody has to know a team id by hand —
+    # Backs the team picker, so nobody has to know a team id by hand;
     # issueCreate requires one, and every issue belongs to exactly one team.
     #
     # _Requires permission: `linear:read`._
@@ -12909,8 +12917,8 @@ module Infrawrench
 
     # List log-capable resources
     #
-    # Synced resources whose rendered detail declares the logs capability — the
-    # candidates a log workspace can tail — plus sidecar streams reached through
+    # Synced resources whose rendered detail declares the logs capability (the
+    # candidates a log workspace can tail) plus sidecar streams reached through
     # a peer integration (pods and workloads inside a managed cluster, listed
     # live from the provider and marked with `parentResourceId`). Discovered
     # from the plugin contract (never a hardcoded provider list), capped at 500
@@ -13012,8 +13020,8 @@ module Infrawrench
     #
     # A soft delete: an issued invoice names its customer, and an invoice whose
     # customer stopped resolving is exactly the unreconcilable document this
-    # feature exists to prevent. Draft invoices are removed with it — a draft
-    # was never issued.
+    # feature exists to prevent. Draft invoices are removed with it; a draft was
+    # never issued.
     #
     # _Requires permission: `invoices:write`._
     #
@@ -13244,7 +13252,7 @@ module Infrawrench
     # List metric series that actually exist
     #
     # The series labels resources reported in the last 7 days, optionally
-    # narrowed to one plugin and resource type — what the rule builder's metric
+    # narrowed to one plugin and resource type; what the rule builder's metric
     # picker is fed from.
     #
     # GET /api/org/{orgId}/metric-alerts/metric-keys
@@ -13360,7 +13368,7 @@ module Infrawrench
 
     # Everything that happened around a timestamp
     #
-    # "What changed around 03:14?" — one merged, chronological narrative of
+    # "What changed around 03:14?"; one merged, chronological narrative of
     # everything the platform knows happened in a window: resource changes
     # (including sleep/wake schedule attribution), provider status incidents
     # that started/resolved in or overlap the window, cost anomalies, workflow
@@ -13406,7 +13414,7 @@ module Infrawrench
     # Connect a Teams channel as an alert destination
     #
     # Adds a channel by webhook URL, or updates the one already holding that
-    # URL. Which alerts reach it is decided by /alert-rules — connecting a
+    # URL. Which alerts reach it is decided by /alert-rules; connecting a
     # channel routes nothing to it on its own. Responds 400 when the URL is not
     # https or its host is not Microsoft-operated.
     #
@@ -13453,7 +13461,7 @@ module Infrawrench
 
     # Rename a Teams channel
     #
-    # The webhook URL is immutable — remove the channel and re-add it to change
+    # The webhook URL is immutable; remove the channel and re-add it to change
     # it.
     #
     # PATCH /api/org/{orgId}/msteams/webhooks/{id}
@@ -13515,7 +13523,7 @@ module Infrawrench
 
     # Post a test card to every configured Teams channel
     #
-    # Ignores routing rules — every channel gets the test. Fails with the error
+    # Ignores routing rules; every channel gets the test. Fails with the error
     # Microsoft returned when nothing could be delivered (HTTP 404 usually means
     # the Workflow was deleted or turned off).
     #
@@ -13688,7 +13696,7 @@ module Infrawrench
     # Turn network flow collection on or off
     #
     # Collection is **off by default**. Enabling it authorizes Infrawrench to
-    # run daily queries against the provider's log store — and on AWS those
+    # run daily queries against the provider's log store; and on AWS those
     # queries are billed to your own cloud account per GB of log data scanned,
     # every day, until you turn them off. That is why the write is governed by
     # `org:settings:write` rather than `costs:write`, and why it is
@@ -13750,7 +13758,7 @@ module Infrawrench
     # line.
     #
     # Accounts whose provider has no readable flow source appear in `accounts`
-    # with `supportsFlows: false` and contribute nothing to the totals — never
+    # with `supportsFlows: false` and contribute nothing to the totals; never
     # zero bytes.
     #
     # _Requires permission: `costs:read`._
@@ -13893,7 +13901,7 @@ module Infrawrench
     # Shift boundaries are calendar-day arithmetic in the rotation's own zone,
     # not 24-hour arithmetic: a rotation stepped in fixed milliseconds drifts an
     # hour at each daylight-saving change until the 09:00 Monday handover
-    # happens at 08:00 — or until two people each think the other is on call.
+    # happens at 08:00; or until two people each think the other is on call.
     #
     # Writing takes `org:settings:write`: a rotation decides who gets woken up.
     #
@@ -13995,7 +14003,7 @@ module Infrawrench
     # Edit an on-call rotation
     #
     # Omitted fields are left alone, and the result is validated after merging.
-    # Sending `participantUserIds` replaces the list wholesale — position is
+    # Sending `participantUserIds` replaces the list wholesale; position is
     # rotation order, so reordering re-plans the future.
     #
     # PATCH /api/org/{orgId}/on-call/schedules/{scheduleId}
@@ -14042,7 +14050,7 @@ module Infrawrench
     # Who is on call right now
     #
     # One entry per rotation: the shift in effect, and the next person in the
-    # rotation. Takes `team:read` — knowing who is on call is something every
+    # rotation. Takes `team:read`: knowing who is on call is something every
     # member needs and nobody should have to ask an admin for.
     #
     # GET /api/org/{orgId}/on-call/now
@@ -14105,8 +14113,8 @@ module Infrawrench
     # List likely-orphaned and idle resources
     #
     # Scans the organization's already-synced resources against each plugin's
-    # declarative orphan heuristics — unattached volumes, unassigned
-    # floating/elastic IPs, reserved-but-unused static IPs — and returns the
+    # declarative orphan heuristics (unattached volumes, unassigned
+    # floating/elastic IPs, reserved-but-unused static IPs) and returns the
     # matches grouped by account, each with the plugin's reason. Purely a read
     # over stored state: no provider API calls are made, so results reflect the
     # last sync. Where the org's collected cost data has per-resource rows,
@@ -14171,9 +14179,9 @@ module Infrawrench
 
     # List resource ownership records
     #
-    # Every ownership record in the organization — owner, purpose and
-    # authorizing ticket, per resource. Only resources somebody has recorded
-    # something about appear; an absent record means the resource is unowned.
+    # Every ownership record in the organization; owner, purpose and authorizing
+    # ticket, per resource. Only resources somebody has recorded something about
+    # appear; an absent record means the resource is unowned.
     #
     # _Requires permission: `resources:read`._
     #
@@ -14249,7 +14257,7 @@ module Infrawrench
 
     # Set a resource's ownership
     #
-    # Upsert keyed by `resourceId` — ownership is a property of the resource, so
+    # Upsert keyed by `resourceId`: ownership is a property of the resource, so
     # there is no separate create and update. Omitted fields keep their value
     # and `null` clears one. Clearing every field removes the record entirely
     # and the response is `null`, which is the new truth rather than an empty
@@ -14292,9 +14300,9 @@ module Infrawrench
 
     # Raise an alert to the organization's on-call transports
     #
-    # Fans an alert out over whatever the org has configured — Twilio SMS (and
+    # Fans an alert out over whatever the org has configured (Twilio SMS (and
     # voice on request), mobile push, Slack channels, and Microsoft Teams
-    # webhooks — honouring each recipient's opt-ins. This is the same alert a
+    # webhooks) honouring each recipient's opt-ins. This is the same alert a
     # workflow raises with `infra.page(...)`, for code that runs somewhere
     # Infrawrench does not: a health check, a deploy script, a cron on a box.
     #
@@ -14332,7 +14340,7 @@ module Infrawrench
     # Clear a page key's cooldown
     #
     # Drops the cooldown for one `(source, key)` so the next page under it
-    # delivers immediately. Call it when the condition you alerted on recovers —
+    # delivers immediately. Call it when the condition you alerted on recovers;
     # the workflow equivalent is `infra.page.clear(key)`. Clearing a key that
     # was never paged is not an error.
     #
@@ -14345,7 +14353,7 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param source [String] Stable name for the system raising the page: letters, digits, `.`,
-    #   `_` and `-`. It is the notification's sender, and it scopes the cooldown — two services
+    #   `_` and `-`. It is the notification's sender, and it scopes the cooldown; two services
     #   paging under the same key never throttle each other.
     # @param key [String, nil] Defaults to `default`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -14372,7 +14380,7 @@ module Infrawrench
 
     # Dismiss a posture finding
     #
-    # Accept a finding — the bucket really is meant to be public, the key really
+    # Accept a finding; the bucket really is meant to be public, the key really
     # is rotated out of band. The finding leaves `findings` and stops feeding
     # the daily posture alerts, but the rule keeps being evaluated and the
     # finding is reported back under `dismissed` for as long as it still
@@ -14564,7 +14572,7 @@ module Infrawrench
     #
     # Raises on 401: Unauthenticated
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -14644,7 +14652,7 @@ module Infrawrench
     #
     # Raises on 401: Unauthenticated
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -14689,7 +14697,7 @@ module Infrawrench
     #
     # Raises on 401: Unauthenticated
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: Forbidden
@@ -14915,7 +14923,7 @@ module Infrawrench
     #
     # Endpoint candidates mined from the organization's synced resource outputs
     # and fields (keys like url, endpoint, host, domain, publicIp). A cheap read
-    # over stored state — no provider API calls. Deduplicated by URL.
+    # over stored state; no provider API calls. Deduplicated by URL.
     #
     # _Requires permission: `resources:read`._
     #
@@ -14938,7 +14946,7 @@ module Infrawrench
     # Update or disable a probe
     #
     # Edit settings and/or toggle `enabled`. Changing the URL or method resets
-    # the probe's state to `unknown` — the history belongs to the old endpoint.
+    # the probe's state to `unknown`: the history belongs to the old endpoint.
     # Audit-logged.
     #
     # _Requires permission: `resources:write`._
@@ -15110,7 +15118,7 @@ module Infrawrench
 
     # List enrolled authentication factors
     #
-    # Includes factors whose enrolment was never confirmed — WorkOS does not
+    # Includes factors whose enrolment was never confirmed; WorkOS does not
     # expose a verified flag.
     #
     # GET /api/profile/mfa
@@ -15165,7 +15173,7 @@ module Infrawrench
 
     # Revoke one session
     #
-    # Refuses the session making the request — use sign-out for that.
+    # Refuses the session making the request, use sign-out for that.
     #
     # DELETE /api/profile/sessions/{sessionId}
     #
@@ -15318,7 +15326,7 @@ module Infrawrench
 
     # Mint a password reset link for the signed-in user
     #
-    # Returns a one-time AuthKit-hosted reset URL rather than emailing it — the
+    # Returns a one-time AuthKit-hosted reset URL rather than emailing it; the
     # caller already holds a valid session for the account. Also the way to set
     # a first password on an SSO or OAuth-only account.
     #
@@ -15504,11 +15512,11 @@ module Infrawrench
     # List what a monitor can run against
     #
     # The editor's target picker: each account with a SQL driver of its own,
-    # plus the SQL-capable resources inside it — a database that is a *resource*
+    # plus the SQL-capable resources inside it; a database that is a *resource*
     # (a ClickHouse service, a D1 or Turso database, a Databricks SQL warehouse,
     # a BigQuery dataset) rather than the account's own connection. Accounts
     # with neither are omitted; a monitor pointed at one could only ever fail.
-    # Pass a resource's `id` (and optionally its `resourceTypeId` — the server
+    # Pass a resource's `id` (and optionally its `resourceTypeId`: the server
     # fills it from the synced resource either way) when creating a monitor to
     # scope the query to that resource.
     #
@@ -15532,8 +15540,8 @@ module Infrawrench
     # Run a query once without saving it
     #
     # The editor's 'try it' button. Goes through the same read-only guard as a
-    # scheduled run — a query that could not be saved as a monitor must not be
-    # runnable through the monitor's own preview — and applies the threshold, so
+    # scheduled run; a query that could not be saved as a monitor must not be
+    # runnable through the monitor's own preview: and applies the threshold, so
     # the answer says whether it *would* be breaching rather than leaving the
     # reader to compare two numbers.
     #
@@ -15671,13 +15679,13 @@ module Infrawrench
     #
     # How close each account is to the limits its provider enforces, with the
     # trend fitted over the last 14 days of collected readings. Both halves of
-    # every row — the used figure and the limit — come from the provider;
-    # nothing is filled in from published defaults, so an account with an
-    # approved increase reads as having the headroom it has. This is a read over
+    # every row (the used figure and the limit) come from the provider; nothing
+    # is filled in from published defaults, so an account with an approved
+    # increase reads as having the headroom it has. This is a read over
     # already-collected snapshots: no provider API calls are made here, and the
     # readings are as fresh as the last collection pass (roughly six hours). A
     # plugin that declares no quota capability contributes nothing rather than
-    # zero — see `unsupportedPluginIds`.
+    # zero, see `unsupportedPluginIds`.
     #
     # _Requires permission: `resources:read`._
     #
@@ -16039,10 +16047,10 @@ module Infrawrench
     # Calls the plugin's `estimateCost` and returns a monthly total with the
     # line items behind it. Price a proposed resource by passing `fields`, an
     # existing one by passing `resourceId`, or a proposed change to an existing
-    # one by passing both — `fields` is merged over the resource's stored
-    # fields, so the caller only sends what changed. `estimate` is null when the
-    # plugin cannot price the configuration; that is not the same as an estimate
-    # of zero, and it should not be rendered as one.
+    # one by passing both; `fields` is merged over the resource's stored fields,
+    # so the caller only sends what changed. `estimate` is null when the plugin
+    # cannot price the configuration; that is not the same as an estimate of
+    # zero, and it should not be rendered as one.
     #
     # _Requires permission: `resources:read`._
     #
@@ -16101,7 +16109,7 @@ module Infrawrench
     # Get the dynamic create form for a resource type
     #
     # Calls the plugin's `getCreateConfig`. The returned `CreateResourceConfig`
-    # is plugin-shaped — see `JsonObject`.
+    # is plugin-shaped, see `JsonObject`.
     #
     # _Requires permission: `resources:write`._
     #
@@ -16607,7 +16615,7 @@ module Infrawrench
     # create form's size options, live-priced). Each recommendation names the
     # cheapest smaller size that still clears a headroom margin and quotes the
     # monthly saving. Apply one by submitting `sizeFieldKey` with the
-    # recommended size id through the resource-update endpoint — which enforces
+    # recommended size id through the resource-update endpoint; which enforces
     # change freezes and writes the audit trail. Results are cached for a few
     # minutes; pass `refresh=true` to recompute.
     #
@@ -16742,8 +16750,8 @@ module Infrawrench
     # Close a run out
     #
     # Closing does **not** settle outstanding steps. A run completed with three
-    # steps still pending is a true and useful record — it says the incident
-    # ended before the checklist did — and quietly marking them done would erase
+    # steps still pending is a true and useful record (it says the incident
+    # ended before the checklist did) and quietly marking them done would erase
     # the one thing a postmortem wants to know.
     #
     # POST /api/org/{orgId}/runbooks/runs/{runId}/close
@@ -16779,7 +16787,7 @@ module Infrawrench
     # Takes `resources:read`, like ticking a step: performing a checklist is not
     # an act of configuration, and requiring an admin mid-incident is how a team
     # stops using it. Deliberately not deduplicated against a run already in
-    # progress — performing the failover twice in one incident is a real thing,
+    # progress; performing the failover twice in one incident is a real thing,
     # and refusing the second would mean it goes unrecorded rather than not
     # happening.
     #
@@ -16871,7 +16879,7 @@ module Infrawrench
 
     # Write a runbook
     #
-    # Editing takes `org:settings:write` — a procedure is an org-wide statement
+    # Editing takes `org:settings:write`: a procedure is an org-wide statement
     # about how something is done, and it is read by strangers under pressure.
     # Names are unique within an organization: two runbooks called "Failover" is
     # how the wrong one gets run.
@@ -16966,7 +16974,7 @@ module Infrawrench
 
     # Create a saved cost filter
     #
-    # Names must be unique per organization (case-insensitively) — they are how
+    # Names must be unique per organization (case-insensitively); they are how
     # the CLI's `--filter <name>` and humans address the filter. A name
     # collision is a 409.
     #
@@ -16996,7 +17004,7 @@ module Infrawrench
 
     # Delete a saved cost filter
     #
-    # Soft delete — **refused with a 409 while anything references the filter**,
+    # Soft delete: **refused with a 409 while anything references the filter**,
     # with the referents in the body. Deleting a referenced filter would
     # silently widen every referent's scope to all spend; for a budget that can
     # fire or suppress alerts, so detaching the referents is a deliberate step,
@@ -17008,7 +17016,7 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Still referenced — the body lists every referent.
+    # Raises on 409: Still referenced: the body lists every referent.
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -17052,7 +17060,7 @@ module Infrawrench
     #
     # Named, reusable cost filter sets. Graphs, reports and budgets reference
     # one **by id** (`savedFilterId` in their configs and in `POST
-    # /costs/query`), and the server resolves the reference at query time — so
+    # /costs/query`), and the server resolves the reference at query time; so
     # editing a saved filter changes every referent at once, and nothing ever
     # holds a copy.
     #
@@ -17077,8 +17085,9 @@ module Infrawrench
 
     # List a saved filter's referents
     #
-    # Every budget, cost report and dashboard cost graph referencing this filter
-    # — what an edit will re-scope, and what a delete would be refused over.
+    # Every budget, cost report and dashboard cost graph referencing this
+    # filter; what an edit will re-scope, and what a delete would be refused
+    # over.
     #
     # _Requires permission: `costs:read`._
     #
@@ -17105,7 +17114,7 @@ module Infrawrench
     #
     # Replaces the filter's name, description and terms. This is the
     # high-leverage write: every graph, report and budget referencing the filter
-    # runs the new terms on its next query — re-scoping a referenced budget can
+    # runs the new terms on its next query: re-scoping a referenced budget can
     # change which alerts fire. `GET /{id}/referents` names what a change will
     # touch.
     #
@@ -17591,7 +17600,7 @@ module Infrawrench
 
     # Update the recording policy
     #
-    # Partial update — omitted fields keep their current value. Recording is
+    # Partial update: omitted fields keep their current value. Recording is
     # opt-in and off by default. Audit-logged with the before/after policy.
     #
     # _Requires permission: `session-recordings:write`._
@@ -17635,7 +17644,7 @@ module Infrawrench
     # The session as an [asciicast
     # v2](https://docs.asciinema.org/manual/asciicast/v2/) document: a JSON
     # header line followed by one `[time, code, data]` event per line.
-    # Deliberately somebody else's format — the same bytes play in `asciinema
+    # Deliberately somebody else's format; the same bytes play in `asciinema
     # play` and in the reference web player, so a recording is useful to an
     # auditor who has never seen this product. `?download=1` returns it as an
     # attachment. **Every fetch is audit-logged**, including this one: an
@@ -17716,7 +17725,7 @@ module Infrawrench
     # List recorded SSH sessions
     #
     # Recorded sessions, newest first. Only SSH opened through the cloud is
-    # recorded — those sessions are already proxied by the server, so recording
+    # recorded; those sessions are already proxied by the server, so recording
     # tees a stream it holds rather than requiring an agent on the host. A
     # desktop session that dials a host directly never reaches the server and
     # cannot appear here.
@@ -17730,7 +17739,7 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param status [String, nil] `recording` (live), `complete` (closed cleanly), `truncated`
-    #   (hit the per-session capture ceiling — the tape is a genuine partial and says so), or
+    #   (hit the per-session capture ceiling: the tape is a genuine partial and says so), or
     #   `abandoned` (the server handling the session went away before it could close the row).
     # @param user_id [String, nil]
     # @param resource_id [String, nil]
@@ -18006,7 +18015,7 @@ module Infrawrench
     #
     # What the join screen shows before anyone commits: which host, whose
     # session, and whether you may join it. Reachable with a valid token by a
-    # signed-in member who already holds `resources:execute` — the token says
+    # signed-in member who already holds `resources:execute`: the token says
     # *which* session, never *whether*. Returns nothing from the session itself.
     #
     # _Requires permission: `resources:execute`._
@@ -18045,7 +18054,7 @@ module Infrawrench
     # Their socket is closed immediately on the replica holding the pty, and
     # within one two-second sweep on any other. They are marked `removed` rather
     # than `left`, so they cannot resume without a fresh invite. The sharer
-    # cannot be removed — revoke the share.
+    # cannot be removed, revoke the share.
     #
     # DELETE
     # /api/org/{orgId}/shared-consoles/{consoleId}/participants/{participantId}
@@ -18099,12 +18108,12 @@ module Infrawrench
     # invite. You become the driver.
     #
     # Returns 409 `console_not_here` when the pty is held by a different server
-    # replica than the one answering this call — reopen the terminal and share
+    # replica than the one answering this call; reopen the terminal and share
     # again. Writing the share anyway would produce a link that authorises
     # correctly and then finds nothing to attach to.
     #
-    # Requires `resources:execute` — the same permission as opening the
-    # terminal. Closed to API keys: sharing a shell is an act a person performs.
+    # Requires `resources:execute`: the same permission as opening the terminal.
+    # Closed to API keys: sharing a shell is an act a person performs.
     #
     # _Requires permission: `resources:execute`._
     #
@@ -18136,7 +18145,7 @@ module Infrawrench
     # Revoke a share
     #
     # Disconnects every guest and stops the fan-out. The sharer's own SSH
-    # session carries on — revoking a share is not killing a terminal.
+    # session carries on : revoking a share is not killing a terminal.
     #
     # The sharer or a holder of `org:settings:write`. Deliberately does **not**
     # require `resources:execute`: ending access must never be gated on still
@@ -18167,7 +18176,7 @@ module Infrawrench
     # Get one shared console
     #
     # Visible to participants and to anyone who could revoke it (the sharer, or
-    # a holder of `org:settings:write`). Others get 404 — that a named colleague
+    # a holder of `org:settings:write`). Others get 404: that a named colleague
     # has a root shell open on a named production host right now is operational
     # information.
     #
@@ -18198,7 +18207,7 @@ module Infrawrench
     # Authorised by the **current driver** (the keyboard is theirs to give) or
     # by the **sharer** (it is their box, and asking permission from somebody
     # who has stopped responding is not a control). An observer cannot promote
-    # themselves — that is `/request-driver`.
+    # themselves; that is `/request-driver`.
     #
     # Two simultaneous grants cannot both win: the database's partial unique
     # index decides the order, and the loser gets 409 `driver-race-lost`.
@@ -18237,7 +18246,7 @@ module Infrawrench
 
     # Redeem an invite and join
     #
-    # Admission needs live org membership **and** `resources:execute` — the
+    # Admission needs live org membership **and** `resources:execute`: the
     # invite is a locator, never a capability, so a leaked link admits nobody
     # who could not have opened the shell themselves.
     #
@@ -18335,8 +18344,8 @@ module Infrawrench
 
     # Ask for the keyboard
     #
-    # Raises a flag the driver and the sharer can see. Grants nothing on its own
-    # — that is the point.
+    # Raises a flag the driver and the sharer can see. Grants nothing on its
+    # own; that is the point.
     #
     # _Requires permission: `resources:execute`._
     #
@@ -18665,7 +18674,7 @@ module Infrawrench
 
     # Post a test message to every configured channel
     #
-    # Ignores routing rules — every channel gets the test. Fails with the Slack
+    # Ignores routing rules; every channel gets the test. Fails with the Slack
     # error when nothing could be delivered (`not_in_channel` means the bot
     # needs inviting to a private channel).
     #
@@ -19065,7 +19074,7 @@ module Infrawrench
     #
     # Signs one publickey-authentication challenge with a server-generated org
     # key whose private half never leaves Infrawrench Cloud. Requires the
-    # `resources:execute` permission — producing an auth signature is the same
+    # `resources:execute` permission: producing an auth signature is the same
     # authority as opening a shell. Imported keys cannot sign (only their public
     # half is stored). Every call is audited.
     #
@@ -19235,7 +19244,7 @@ module Infrawrench
     # Read a public status page
     #
     # **Unauthenticated.** The only endpoint in this API that takes no
-    # credentials — a status page exists for people with no account. The payload
+    # credentials; a status page exists for people with no account. The payload
     # carries labels, states and uptime history only: probe URLs, resource and
     # account ids, the organization id and error detail are never included. An
     # unpublished page and an unknown slug both answer 404, so the endpoint
@@ -19270,7 +19279,7 @@ module Infrawrench
     # Provider incidents overlapping your resources
     #
     # The "is it me or is it them?" feed. The poller watches each provider
-    # plugin's public status feed (declared on its manifest — zero credentials,
+    # plugin's public status feed (declared on its manifest; zero credentials,
     # zero rate-limit risk), caches active incidents, and this endpoint
     # correlates them against the resources the organization holds: an incident
     # matches a resource when it is provider-wide, names the resource's region,
@@ -19311,7 +19320,7 @@ module Infrawrench
     # Create a status page
     #
     # Creates a page with a freshly generated slug. `published` defaults to
-    # false, so creating a page never exposes anything — publish it as a
+    # false, so creating a page never exposes anything; publish it as a
     # separate, deliberate step.
     #
     # _Requires permission: `resources:write`._
@@ -19390,9 +19399,8 @@ module Infrawrench
 
     # Issue a new public link
     #
-    # Replaces the slug, revoking the current public URL immediately — the
-    # reroll for a link that ended up somewhere unintended. The page stays
-    # published.
+    # Replaces the slug, revoking the current public URL immediately; the reroll
+    # for a link that ended up somewhere unintended. The page stays published.
     #
     # _Requires permission: `resources:write`._
     #
@@ -19418,7 +19426,7 @@ module Infrawrench
     # Update a status page
     #
     # Omitted fields keep their value. `components`, when present, replaces the
-    # whole ordered set — which is also how a reorder is expressed.
+    # whole ordered set: which is also how a reorder is expressed.
     #
     # _Requires permission: `resources:write`._
     #
@@ -19788,7 +19796,7 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/team/invitations
     #
-    # Raises on 402: Payment required — the organization's plan does not include
+    # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
     # Raises on 403: The role would grant permissions the caller does not hold,
@@ -20311,13 +20319,13 @@ module Infrawrench
     # A different reading of data the product already holds, built on one rule:
     # a wallboard may only show things that are true **right now** and that
     # somebody would cross a room to look at. There is deliberately no history,
-    # no trend and no breakdown — those belong on the page you open when you do
+    # no trend and no breakdown; those belong on the page you open when you do
     # walk over.
     #
-    # Four sources — declared incidents, synthetic probes, query monitors and
-    # account sync health — each guarded independently, because a television
-    # that goes blank because one query threw is showing nothing to a room that
-    # was relying on it.
+    # Four sources (declared incidents, synthetic probes, query monitors and
+    # account sync health) each guarded independently, because a television that
+    # goes blank because one query threw is showing nothing to a room that was
+    # relying on it.
     #
     # Session-authenticated on purpose: unlike the calendar feed or a public
     # status page, this carries incident titles, probe names and account names,
@@ -20646,7 +20654,7 @@ module Infrawrench
     #
     # Sets the workflow's trigger to cron with the given expression and
     # timezone, validating both, and computes the next fire time. The workflow
-    # fires at the schedule's next occurrence — never immediately on save.
+    # fires at the schedule's next occurrence; never immediately on save.
     #
     # Changing the schedule makes scheduled runs act with the permissions of the
     # caller from then on, the same as editing the workflow's code. When the
@@ -20764,7 +20772,7 @@ module Infrawrench
     # SSH key names, and the workflow's trigger + metrics. Default is the fast
     # static surface (`create` fields are `Record<string, string>`). Pass
     # `enrich=1` for a second pass that hits provider APIs for precise create()
-    # field unions and live sidecar capability flags — the editor loads static
+    # field unions and live sidecar capability flags; the editor loads static
     # first and upgrades when that finishes.
     #
     # _Requires permission: `workflows:read`._