infrawrench-sdk 1.75.0 → 1.77.0

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.75.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.77.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.75.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.77.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -12408,198 +12408,255 @@ module Infrawrench
     end
   end
 
-  # `client.kv`
-  class KvNamespace
+  # `client.jit_access.accounts`
+  class JitAccessAccountsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Run a Redis-style KV command
-    #
-    # _Requires permission: `resources:execute`._
+    # Accounts that can grant just-in-time access
     #
-    # POST /api/org/{orgId}/kv/command
+    # Connected accounts whose provider plugin declares the just-in-time
+    # capability.
     #
-    # Raises on 400: Bad request
+    # _Requires permission: `access:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/jit-access/accounts
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitAccessAccount>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def command(body:, org_id: nil, request_options: nil)
+    def list(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/kv/command",
+        http_method: "GET",
+        path: "/api/org/{orgId}/jit-access/accounts",
         path_params: { "orgId" => org_id },
-        body: body,
         request_options: request_options
       )
     end
-  end
 
-  # `client.leases`
-  class LeasesNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
+    # Grantable roles in a scope (picker)
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # GET /api/org/{orgId}/jit-access/accounts/{accountId}/roles
+    #
+    # Raises on 502: Provider error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param account_id [String]
+    # @param scope_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitPickerOption>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def roles(account_id:, scope_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/jit-access/accounts/{accountId}/roles",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
+        query: { "scopeId" => scope_id },
+        request_options: request_options
+      )
     end
 
-    # Cancel a lease
-    #
-    # Stop the countdown; the resource stays, the lease goes `canceled` and
-    # leaves the expiry radar. Audit-logged.
+    # Scopes on an account (picker)
     #
-    # _Requires permission: `resources:write`._
+    # The places a role can be granted (AWS accounts, GCP projects, namespaces),
+    # read from the provider.
     #
-    # POST /api/org/{orgId}/leases/{leaseId}/cancel
+    # _Requires permission: `org:settings:write`._
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/jit-access/accounts/{accountId}/scopes
     #
-    # Raises on 404: Not found
+    # Raises on 502: Provider error
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param lease_id [String]
+    # @param account_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceLease` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitPickerOption>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def cancel(lease_id:, org_id: nil, request_options: nil)
+    def scopes(account_id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/leases/{leaseId}/cancel",
-        path_params: { "orgId" => org_id, "leaseId" => lease_id },
+        http_method: "GET",
+        path: "/api/org/{orgId}/jit-access/accounts/{accountId}/scopes",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
         request_options: request_options
       )
     end
+  end
 
-    # Create a resource lease
+  # `client.jit_access.policies`
+  class JitAccessPoliciesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a policy
     #
-    # Attach an expiry to a resource; 'give me a test cluster for 3 days'. One
-    # lease per resource (an active lease conflicts; a terminal one is
-    # replaced). `autoDelete: true` opts into deletion at expiry; the poller
-    # announces it twice first, defers during change freezes, and requires the
-    # caller to hold `resources:delete`. Audit-logged.
+    # Audit-logged. At least one approver (member, role or on-call rotation) is
+    # required.
     #
-    # _Requires permission: `resources:write`._
+    # _Requires permission: `org:settings:write`._
     #
-    # POST /api/org/{orgId}/leases
+    # POST /api/org/{orgId}/jit-access/policies
     #
     # Raises on 400: Bad request
     #
-    # Raises on 404: Not found
-    #
-    # Raises on 409: The resource already has an active lease
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `ResourceLeaseCreate`.
+    # @param body [Hash, nil] Request body, shaped as `JitPolicyInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceLease` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitPolicy` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def create(org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/leases",
+        path: "/api/org/{orgId}/jit-access/policies",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Delete a lease row
+    # Delete a policy
     #
-    # Remove the lease record entirely (including terminal rows). The resource
-    # is not touched. Audit-logged.
+    # Grants the policy produced still end on time; its pending requests have no
+    # approvers and time out.
     #
-    # _Requires permission: `resources:write`._
+    # _Requires permission: `org:settings:write`._
     #
-    # DELETE /api/org/{orgId}/leases/{leaseId}
+    # DELETE /api/org/{orgId}/jit-access/policies/{policyId}
     #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param lease_id [String]
+    # @param policy_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [nil] This endpoint returns no content.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(lease_id:, org_id: nil, request_options: nil)
+    def delete(policy_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "DELETE",
-        path: "/api/org/{orgId}/leases/{leaseId}",
-        path_params: { "orgId" => org_id, "leaseId" => lease_id },
-        accept: :empty,
+        path: "/api/org/{orgId}/jit-access/policies/{policyId}",
+        path_params: { "orgId" => org_id, "policyId" => policy_id },
         request_options: request_options
       )
     end
 
-    # List resource leases
+    # Get a policy
     #
-    # Every lease in the organization, soonest deadline first. Active leases
-    # also appear on the expiry radar (`GET /expiring`) as kind `lease` items,
-    # so the owner is nagged through the existing expiry alerts.
+    # _Requires permission: `access:read`._
     #
-    # _Requires permission: `resources:read`._
+    # GET /api/org/{orgId}/jit-access/policies/{policyId}
     #
-    # GET /api/org/{orgId}/leases
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param policy_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceLeaseList` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitPolicy` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def get(policy_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/leases",
+        path: "/api/org/{orgId}/jit-access/policies/{policyId}",
+        path_params: { "orgId" => org_id, "policyId" => policy_id },
+        request_options: request_options
+      )
+    end
+
+    # List just-in-time access policies
+    #
+    # _Requires permission: `access:read`._
+    #
+    # GET /api/org/{orgId}/jit-access/policies
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitPolicy>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/jit-access/policies",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # Get one resource's lease
+    # Resolve the caller's provider principal
     #
-    # The (unique) lease on a resource, whatever its status, or null.
+    # Who the grant would go to, matched by the caller's email in the provider.
     #
-    # _Requires permission: `resources:read`._
+    # _Requires permission: `access:request`._
     #
-    # GET /api/org/{orgId}/leases/resource
+    # GET /api/org/{orgId}/jit-access/policies/{policyId}/principal
     #
-    # Raises on 400: Bad request
+    # Raises on 403: Not a requester
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param resource_id [String]
+    # @param policy_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceLeaseLookup` — see
+    # @return [Hash] Parsed JSON, shaped as `JitPrincipalResolution` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def resource(resource_id:, org_id: nil, request_options: nil)
+    def principal(policy_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/leases/resource",
-        path_params: { "orgId" => org_id },
-        query: { "resourceId" => resource_id },
+        path: "/api/org/{orgId}/jit-access/policies/{policyId}/principal",
+        path_params: { "orgId" => org_id, "policyId" => policy_id },
         request_options: request_options
       )
     end
 
-    # Update a lease
+    # Principals the caller may pick
     #
-    # Edit the deadline, the auto-delete opt-in and/or the note of an active
-    # lease. Changing the deadline or the auto-delete flag re-arms the
-    # two-announcement schedule. Audit-logged.
+    # _Requires permission: `access:request`._
     #
-    # _Requires permission: `resources:write`._
+    # GET /api/org/{orgId}/jit-access/policies/{policyId}/principals
     #
-    # PUT /api/org/{orgId}/leases/{leaseId}
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param policy_id [String]
+    # @param q [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitPrincipalOption & Hash>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def principals(policy_id:, org_id: nil, q: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/jit-access/policies/{policyId}/principals",
+        path_params: { "orgId" => org_id, "policyId" => policy_id },
+        query: { "q" => q },
+        request_options: request_options
+      )
+    end
+
+    # Replace a policy
+    #
+    # Live grants keep their window; pending requests are decided against the
+    # new approver set.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # PUT /api/org/{orgId}/jit-access/policies/{policyId}
     #
     # Raises on 400: Bad request
     #
@@ -12607,212 +12664,327 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param lease_id [String]
-    # @param body [Hash, nil] Request body, shaped as `ResourceLeaseUpdate`.
+    # @param policy_id [String]
+    # @param body [Hash, nil] Request body, shaped as `JitPolicyInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceLease` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitPolicy` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(lease_id:, org_id: nil, body: nil, request_options: nil)
+    def update(policy_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "PUT",
-        path: "/api/org/{orgId}/leases/{leaseId}",
-        path_params: { "orgId" => org_id, "leaseId" => lease_id },
+        path: "/api/org/{orgId}/jit-access/policies/{policyId}",
+        path_params: { "orgId" => org_id, "policyId" => policy_id },
         body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.linear`
-  class LinearNamespace
+  # `client.jit_access.requests`
+  class JitAccessRequestsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Disconnect Linear
+    # Approve a request
     #
-    # Issue links already recorded are kept, so filed findings stay marked as
-    # filed.
+    # The caller must be in the policy's approver set at this moment. On
+    # approval the provider grant is made; the response may still read
+    # `granting` when it completes in the background. Audit-logged. Not
+    # available to API keys.
     #
-    # _Requires permission: `linear:write`._
+    # _Requires permission: `access:read`._
     #
-    # DELETE /api/org/{orgId}/linear
+    # POST /api/org/{orgId}/jit-access/requests/{requestId}/approve
+    #
+    # Raises on 403: Not allowed
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Already decided, timed out, or not in a state for this
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param request_id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(org_id: nil, request_options: nil)
+    def approve(request_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/linear",
-        path_params: { "orgId" => org_id },
+        http_method: "POST",
+        path: "/api/org/{orgId}/jit-access/requests/{requestId}/approve",
+        path_params: { "orgId" => org_id, "requestId" => request_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Get the org's Linear connection
+    # Cancel your pending request
     #
-    # The stored API key is never returned; `keyHint` stands in for it.
+    # Requester only. Audit-logged. Not available to API keys.
     #
-    # _Requires permission: `linear:read`._
+    # _Requires permission: `access:request`._
     #
-    # GET /api/org/{orgId}/linear
+    # POST /api/org/{orgId}/jit-access/requests/{requestId}/cancel
+    #
+    # Raises on 403: Not allowed
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Already decided, timed out, or not in a state for this
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param request_id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def cancel(request_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/linear",
-        path_params: { "orgId" => org_id },
+        http_method: "POST",
+        path: "/api/org/{orgId}/jit-access/requests/{requestId}/cancel",
+        path_params: { "orgId" => org_id, "requestId" => request_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # File a finding as a Linear issue
+    # Request just-in-time access
     #
-    # Creates the issue via the issueCreate mutation, then records the link
-    # between it and the finding. The link is what lets a list view show
-    # "already filed" instead of offering the button again.
+    # Ask for one of a policy's scope and role pairs for a bounded window.
+    # Approvers are notified over push, Slack (with Approve/Deny buttons) and
+    # Microsoft Teams. Not available to API keys.
     #
-    # _Requires permission: `linear:write`._
+    # _Requires permission: `access:request`._
     #
-    # POST /api/org/{orgId}/linear/issues
+    # POST /api/org/{orgId}/jit-access/requests
     #
-    # Raises on 400: Bad request
+    # Raises on 400: Invalid
     #
-    # Raises on 502: Linear refused to create the issue, or was unreachable
+    # Raises on 403: Not a requester under this policy
+    #
+    # Raises on 409: A pending or active request already covers this
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CreateLinearIssueInput`.
+    # @param body [Hash, nil] Request body, shaped as `JitCreateRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CreateLinearIssueResult` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def issues(body:, org_id: nil, request_options: nil)
+    def create(org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/linear/issues",
+        path: "/api/org/{orgId}/jit-access/requests",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Look up filed issues for a set of findings
+    # Deny a request
     #
-    # _Requires permission: `linear:read`._
+    # The caller must be in the policy's approver set. Audit-logged. Not
+    # available to API keys.
     #
-    # GET /api/org/{orgId}/linear/links
+    # _Requires permission: `access:read`._
     #
-    # Raises on 400: Bad request
+    # POST /api/org/{orgId}/jit-access/requests/{requestId}/deny
+    #
+    # Raises on 403: Not allowed
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Already decided, timed out, or not in a state for this
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param source_kind [String, nil]
-    # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
-    #   return every link of the kind; this is the batch lookup a list view makes once instead of
-    #   one request per row.
+    # @param request_id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearIssueLink>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def links(org_id: nil, source_kind: nil, source_id: nil, request_options: nil)
+    def deny(request_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/linear/links",
-        path_params: { "orgId" => org_id },
-        query: { "sourceKind" => source_kind, "sourceId" => source_id },
+        http_method: "POST",
+        path: "/api/org/{orgId}/jit-access/requests/{requestId}/deny",
+        path_params: { "orgId" => org_id, "requestId" => request_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # List Linear teams
+    # Extend an active grant
     #
-    # Backs the team picker, so nobody has to know a team id by hand;
-    # issueCreate requires one, and every issue belongs to exactly one team.
+    # Approvers only, within the policy maximum for the whole window. A
+    # provider-enforced expiry is moved upstream first. Audit-logged. Not
+    # available to API keys.
     #
-    # _Requires permission: `linear:read`._
+    # _Requires permission: `access:read`._
     #
-    # GET /api/org/{orgId}/linear/teams
+    # POST /api/org/{orgId}/jit-access/requests/{requestId}/extend
     #
-    # Raises on 400: Bad request
+    # Raises on 400: Beyond the policy maximum
+    #
+    # Raises on 403: Not an approver
+    #
+    # Raises on 409: Not active
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param request_id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearTeam>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def teams(org_id: nil, request_options: nil)
+    def post_org_org_id_jit_access_requests_request_id_extend(
+      request_id:,
+      org_id: nil,
+      body: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/jit-access/requests/{requestId}/extend",
+        path_params: { "orgId" => org_id, "requestId" => request_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Get a request
+    #
+    # _Requires permission: `access:read`._
+    #
+    # GET /api/org/{orgId}/jit-access/requests/{requestId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(request_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/linear/teams",
-        path_params: { "orgId" => org_id },
+        path: "/api/org/{orgId}/jit-access/requests/{requestId}",
+        path_params: { "orgId" => org_id, "requestId" => request_id },
         request_options: request_options
       )
     end
 
-    # Connect Linear, or update the connection
+    # List just-in-time access requests
     #
-    # _Requires permission: `linear:write`._
+    # Newest first, with caller-relative action flags.
     #
-    # PUT /api/org/{orgId}/linear
+    # _Requires permission: `access:read`._
+    #
+    # GET /api/org/{orgId}/jit-access/requests
     #
     # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `LinearIntegrationInput`.
+    # @param status [String, nil]
+    # @param mine [String, nil]
+    # @param holding [String, nil] Only rows that may be holding access upstream.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LinearIntegration & Hash` — see
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitAccessRequest>` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(body:, org_id: nil, request_options: nil)
+    def list(org_id: nil, status: nil, mine: nil, holding: nil, request_options: nil)
       @transport.request(
-        http_method: "PUT",
-        path: "/api/org/{orgId}/linear",
+        http_method: "GET",
+        path: "/api/org/{orgId}/jit-access/requests",
         path_params: { "orgId" => org_id },
-        body: body,
+        query: { "status" => status, "mine" => mine, "holding" => holding },
         request_options: request_options
       )
     end
 
-    # Check Linear credentials
+    # End a grant early
     #
-    # Runs the `viewer` query against the Linear GraphQL API, so a mistyped or
-    # revoked key is reported on the settings form rather than on the first
-    # attempt to file an issue.
+    # Allowed for the holder, an approver, or a member with org:settings:write.
+    # Audit-logged. Not available to API keys.
     #
-    # _Requires permission: `linear:write`._
+    # POST /api/org/{orgId}/jit-access/requests/{requestId}/revoke
     #
-    # POST /api/org/{orgId}/linear/verify
+    # Raises on 403: Not allowed
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Already decided, timed out, or not in a state for this
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `JitAccessRequest` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def revoke(request_id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/jit-access/requests/{requestId}/revoke",
+        path_params: { "orgId" => org_id, "requestId" => request_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.jit_access`
+  class JitAccessNamespace
+    # @return [JitAccessAccountsNamespace] `client.jit_access.accounts`
+    attr_reader :accounts
+    # @return [JitAccessPoliciesNamespace] `client.jit_access.policies`
+    attr_reader :policies
+    # @return [JitAccessRequestsNamespace] `client.jit_access.requests`
+    attr_reader :requests
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @accounts = JitAccessAccountsNamespace.new(@transport)
+      @policies = JitAccessPoliciesNamespace.new(@transport)
+      @requests = JitAccessRequestsNamespace.new(@transport)
+    end
+  end
+
+  # `client.kv`
+  class KvNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run a Redis-style KV command
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/kv/command
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Linear rejected the key or was unreachable
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `LinearVerifyInput`.
+    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LinearVerifyResult` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def verify(org_id: nil, body: nil, request_options: nil)
+    def command(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/linear/verify",
+        path: "/api/org/{orgId}/kv/command",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
@@ -12820,627 +12992,732 @@ module Infrawrench
     end
   end
 
-  # `client.log_workspaces`
-  class LogWorkspacesNamespace
+  # `client.leases`
+  class LeasesNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Save a log workspace query
+    # Cancel a lease
     #
-    # Save a named multi-resource tail: up to 8 log streams plus a search
-    # expression, so the workspace can be reopened. With `alertEnabled` the
-    # poller evaluates the query every few minutes over a bounded tail window
-    # and notifies (push/Slack/Teams, `logMatchAlerts` trigger) when a line
-    # matches, with a cooldown between alerts. Alerting requires a non-empty
-    # search expression. Audit-logged.
+    # Stop the countdown; the resource stays, the lease goes `canceled` and
+    # leaves the expiry radar. Audit-logged.
     #
     # _Requires permission: `resources:write`._
     #
-    # POST /api/org/{orgId}/log-workspaces
+    # POST /api/org/{orgId}/leases/{leaseId}/cancel
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: A saved query with this name already exists
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param lease_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceLease` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def cancel(lease_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/leases/{leaseId}/cancel",
+        path_params: { "orgId" => org_id, "leaseId" => lease_id },
+        request_options: request_options
+      )
+    end
+
+    # Create a resource lease
+    #
+    # Attach an expiry to a resource; 'give me a test cluster for 3 days'. One
+    # lease per resource (an active lease conflicts; a terminal one is
+    # replaced). `autoDelete: true` opts into deletion at expiry; the poller
+    # announces it twice first, defers during change freezes, and requires the
+    # caller to hold `resources:delete`. Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/leases
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: The resource already has an active lease
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `LogWorkspaceQueryCreate`.
+    # @param body [Hash, nil] Request body, shaped as `ResourceLeaseCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQuery` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceLease` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(body:, org_id: nil, request_options: nil)
+    def create(org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/log-workspaces",
+        path: "/api/org/{orgId}/leases",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Delete a saved log query
+    # Delete a lease row
     #
-    # Remove the saved query and stop any alerting it carried. Audit-logged.
+    # Remove the lease record entirely (including terminal rows). The resource
+    # is not touched. Audit-logged.
     #
     # _Requires permission: `resources:write`._
     #
-    # DELETE /api/org/{orgId}/log-workspaces/{queryId}
+    # DELETE /api/org/{orgId}/leases/{leaseId}
     #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param query_id [String]
+    # @param lease_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(query_id:, org_id: nil, request_options: nil)
+    def delete(lease_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "DELETE",
-        path: "/api/org/{orgId}/log-workspaces/{queryId}",
-        path_params: { "orgId" => org_id, "queryId" => query_id },
+        path: "/api/org/{orgId}/leases/{leaseId}",
+        path_params: { "orgId" => org_id, "leaseId" => lease_id },
         accept: :empty,
         request_options: request_options
       )
     end
 
-    # List saved log queries
+    # List resource leases
     #
-    # Every saved log-workspace query in the organization: its name, the set of
-    # log streams it tails, the search expression, the alert flag and the alert
-    # pass's last evaluation state. Log text itself is fetched per resource via
-    # `POST /api/org/{orgId}/resources/{pluginId}/{typeId}/logs`.
+    # Every lease in the organization, soonest deadline first. Active leases
+    # also appear on the expiry radar (`GET /expiring`) as kind `lease` items,
+    # so the owner is nagged through the existing expiry alerts.
     #
     # _Requires permission: `resources:read`._
     #
-    # GET /api/org/{orgId}/log-workspaces
+    # GET /api/org/{orgId}/leases
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQueryList` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceLeaseList` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def get(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/log-workspaces",
+        path: "/api/org/{orgId}/leases",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # List log-capable resources
+    # Get one resource's lease
     #
-    # Synced resources whose rendered detail declares the logs capability (the
-    # candidates a log workspace can tail) plus sidecar streams reached through
-    # a peer integration (pods and workloads inside a managed cluster, listed
-    # live from the provider and marked with `parentResourceId`). Discovered
-    # from the plugin contract (never a hardcoded provider list), capped at 500
-    # results.
+    # The (unique) lease on a resource, whatever its status, or null.
     #
     # _Requires permission: `resources:read`._
     #
-    # GET /api/org/{orgId}/log-workspaces/resources
+    # GET /api/org/{orgId}/leases/resource
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param resource_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LogCapableResourceList` — see
+    # @return [Hash] Parsed JSON, shaped as `ResourceLeaseLookup` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def resources(org_id: nil, request_options: nil)
+    def resource(resource_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/log-workspaces/resources",
+        path: "/api/org/{orgId}/leases/resource",
         path_params: { "orgId" => org_id },
+        query: { "resourceId" => resource_id },
         request_options: request_options
       )
     end
 
-    # Update a saved log query
+    # Update a lease
     #
-    # Edit the name, resource set, search expression and/or the alert toggle.
-    # Changing the search or the resources resets the alert pass's evaluation
-    # state; turning the alert on makes the query due for evaluation
-    # immediately. Audit-logged.
+    # Edit the deadline, the auto-delete opt-in and/or the note of an active
+    # lease. Changing the deadline or the auto-delete flag re-arms the
+    # two-announcement schedule. Audit-logged.
     #
     # _Requires permission: `resources:write`._
     #
-    # PUT /api/org/{orgId}/log-workspaces/{queryId}
+    # PUT /api/org/{orgId}/leases/{leaseId}
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: A saved query with this name already exists
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param query_id [String]
-    # @param body [Hash] Request body, shaped as `LogWorkspaceQueryUpdate`.
+    # @param lease_id [String]
+    # @param body [Hash, nil] Request body, shaped as `ResourceLeaseUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQuery` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceLease` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(query_id:, body:, org_id: nil, request_options: nil)
+    def update(lease_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "PUT",
-        path: "/api/org/{orgId}/log-workspaces/{queryId}",
-        path_params: { "orgId" => org_id, "queryId" => query_id },
+        path: "/api/org/{orgId}/leases/{leaseId}",
+        path_params: { "orgId" => org_id, "leaseId" => lease_id },
         body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.managed_accounts`
-  class ManagedAccountsNamespace
+  # `client.linear`
+  class LinearNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Create a managed account
+    # Disconnect Linear
     #
-    # Refused with 409 when a cost centre or account named here is already
-    # billed to another customer. The error names the other customer, because
-    # “it conflicts” without saying with whom sends the caller hunting.
+    # Issue links already recorded are kept, so filed findings stay marked as
+    # filed.
     #
-    # _Requires permission: `invoices:write`._
+    # _Requires permission: `linear:write`._
     #
-    # POST /api/org/{orgId}/managed-accounts
+    # DELETE /api/org/{orgId}/linear
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/linear",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get the org's Linear connection
+    #
+    # The stored API key is never returned; `keyHint` stands in for it.
+    #
+    # _Requires permission: `linear:read`._
+    #
+    # GET /api/org/{orgId}/linear
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/linear",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # File a finding as a Linear issue
+    #
+    # Creates the issue via the issueCreate mutation, then records the link
+    # between it and the finding. The link is what lets a list view show
+    # "already filed" instead of offering the button again.
+    #
+    # _Requires permission: `linear:write`._
+    #
+    # POST /api/org/{orgId}/linear/issues
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: Conflict
+    # Raises on 502: Linear refused to create the issue, or was unreachable
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `ManagedAccountInput`.
+    # @param body [Hash] Request body, shaped as `CreateLinearIssueInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ManagedAccount` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `CreateLinearIssueResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(body:, org_id: nil, request_options: nil)
+    def issues(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/managed-accounts",
+        path: "/api/org/{orgId}/linear/issues",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Retire a managed account
-    #
-    # A soft delete: an issued invoice names its customer, and an invoice whose
-    # customer stopped resolving is exactly the unreconcilable document this
-    # feature exists to prevent. Draft invoices are removed with it; a draft was
-    # never issued.
+    # Look up filed issues for a set of findings
     #
-    # _Requires permission: `invoices:write`._
+    # _Requires permission: `linear:read`._
     #
-    # DELETE /api/org/{orgId}/managed-accounts/{id}
+    # GET /api/org/{orgId}/linear/links
     #
-    # Raises on 404: Not found
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
+    # @param source_kind [String, nil]
+    # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
+    #   return every link of the kind; this is the batch lookup a list view makes once instead of
+    #   one request per row.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearIssueLink>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(id:, org_id: nil, request_options: nil)
+    def links(org_id: nil, source_kind: nil, source_id: nil, request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/managed-accounts/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        http_method: "GET",
+        path: "/api/org/{orgId}/linear/links",
+        path_params: { "orgId" => org_id },
+        query: { "sourceKind" => source_kind, "sourceId" => source_id },
         request_options: request_options
       )
     end
 
-    # Get a managed account
+    # List Linear teams
     #
-    # _Requires permission: `invoices:read`._
+    # Backs the team picker, so nobody has to know a team id by hand;
+    # issueCreate requires one, and every issue belongs to exactly one team.
     #
-    # GET /api/org/{orgId}/managed-accounts/{id}
+    # _Requires permission: `linear:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/linear/teams
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ManagedAccount` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearTeam>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(id:, org_id: nil, request_options: nil)
+    def teams(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/managed-accounts/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/linear/teams",
+        path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # List managed accounts
+    # Connect Linear, or update the connection
     #
-    # The customers a managed service provider bills. A managed account
-    # references existing cost centres rather than defining its own matching
-    # rules, so the spend on an invoice is the same spend the showback report
-    # attributes to those centres.
+    # _Requires permission: `linear:write`._
     #
-    # _Requires permission: `invoices:read`._
+    # PUT /api/org/{orgId}/linear
     #
-    # GET /api/org/{orgId}/managed-accounts
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param body [Hash] Request body, shaped as `LinearIntegrationInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<ManagedAccount>` — see
+    # @return [Hash] Parsed JSON, shaped as `LinearIntegration & Hash` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def list(org_id: nil, request_options: nil)
+    def update(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/managed-accounts",
+        http_method: "PUT",
+        path: "/api/org/{orgId}/linear",
         path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Update a managed account
+    # Check Linear credentials
     #
-    # A full replace. Editing the scope changes what **future** drafts are drawn
-    # over and nothing else: every approved invoice holds its own copy of the
-    # scope, so moving a cost centre between customers cannot re-bill a period
-    # that has already been invoiced.
+    # Runs the `viewer` query against the Linear GraphQL API, so a mistyped or
+    # revoked key is reported on the settings form rather than on the first
+    # attempt to file an issue.
     #
-    # _Requires permission: `invoices:write`._
+    # _Requires permission: `linear:write`._
     #
-    # PUT /api/org/{orgId}/managed-accounts/{id}
+    # POST /api/org/{orgId}/linear/verify
     #
     # Raises on 400: Bad request
     #
-    # Raises on 404: Not found
-    #
-    # Raises on 409: Conflict
+    # Raises on 502: Linear rejected the key or was unreachable
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
-    # @param body [Hash] Request body, shaped as `ManagedAccountInput`.
+    # @param body [Hash, nil] Request body, shaped as `LinearVerifyInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ManagedAccount` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LinearVerifyResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(id:, body:, org_id: nil, request_options: nil)
+    def verify(org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "PUT",
-        path: "/api/org/{orgId}/managed-accounts/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        http_method: "POST",
+        path: "/api/org/{orgId}/linear/verify",
+        path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.metric_alerts`
-  class MetricAlertsNamespace
+  # `client.log_workspaces`
+  class LogWorkspacesNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Create a metric alert rule
+    # Save a log workspace query
     #
-    # Rules select resources by query (plugin + resource type + tag), never by
-    # id list, so a rule automatically covers resources created after it was
-    # written. The poller evaluates enabled rules about once a minute and alerts
-    # when the condition held for the whole trailing window.
+    # Save a named multi-resource tail: up to 8 log streams plus a search
+    # expression, so the workspace can be reopened. With `alertEnabled` the
+    # poller evaluates the query every few minutes over a bounded tail window
+    # and notifies (push/Slack/Teams, `logMatchAlerts` trigger) when a line
+    # matches, with a cooldown between alerts. Alerting requires a non-empty
+    # search expression. Audit-logged.
     #
-    # POST /api/org/{orgId}/metric-alerts
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/log-workspaces
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: A saved query with this name already exists
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `MetricAlertRuleInput`.
+    # @param body [Hash] Request body, shaped as `LogWorkspaceQueryCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQuery` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/metric-alerts",
+        path: "/api/org/{orgId}/log-workspaces",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Delete a metric alert rule
+    # Delete a saved log query
     #
-    # Soft delete. The rule's firing history stays readable via
-    # /metric-alerts/events.
+    # Remove the saved query and stop any alerting it carried. Audit-logged.
     #
-    # DELETE /api/org/{orgId}/metric-alerts/{id}
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/log-workspaces/{queryId}
     #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
+    # @param query_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(id:, org_id: nil, request_options: nil)
+    def delete(query_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "DELETE",
-        path: "/api/org/{orgId}/metric-alerts/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/log-workspaces/{queryId}",
+        path_params: { "orgId" => org_id, "queryId" => query_id },
+        accept: :empty,
         request_options: request_options
       )
     end
 
-    # Recent metric alert firings
+    # List saved log queries
     #
-    # GET /api/org/{orgId}/metric-alerts/events
+    # Every saved log-workspace query in the organization: its name, the set of
+    # log streams it tails, the search expression, the alert flag and the alert
+    # pass's last evaluation state. Log text itself is fetched per resource via
+    # `POST /api/org/{orgId}/resources/{pluginId}/{typeId}/logs`.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/log-workspaces
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param rule_id [String, nil]
-    # @param limit [Integer, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricAlertEvent>` — see
+    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQueryList` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def events(org_id: nil, rule_id: nil, limit: nil, request_options: nil)
+    def get(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/metric-alerts/events",
+        path: "/api/org/{orgId}/log-workspaces",
         path_params: { "orgId" => org_id },
-        query: { "ruleId" => rule_id, "limit" => limit },
         request_options: request_options
       )
     end
 
-    # Get a metric alert rule
+    # List log-capable resources
     #
-    # GET /api/org/{orgId}/metric-alerts/{id}
+    # Synced resources whose rendered detail declares the logs capability (the
+    # candidates a log workspace can tail) plus sidecar streams reached through
+    # a peer integration (pods and workloads inside a managed cluster, listed
+    # live from the provider and marked with `parentResourceId`). Discovered
+    # from the plugin contract (never a hardcoded provider list), capped at 500
+    # results.
     #
-    # Raises on 404: Not found
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/log-workspaces/resources
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LogCapableResourceList` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(id:, org_id: nil, request_options: nil)
+    def resources(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/metric-alerts/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
+        path: "/api/org/{orgId}/log-workspaces/resources",
+        path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # List metric alert rules with live firing status
+    # Update a saved log query
     #
-    # GET /api/org/{orgId}/metric-alerts
+    # Edit the name, resource set, search expression and/or the alert toggle.
+    # Changing the search or the resources resets the alert pass's evaluation
+    # state; turning the alert on makes the query due for evaluation
+    # immediately. Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # PUT /api/org/{orgId}/log-workspaces/{queryId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: A saved query with this name already exists
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param query_id [String]
+    # @param body [Hash] Request body, shaped as `LogWorkspaceQueryUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricAlertRuleWithStatus>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LogWorkspaceQuery` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def list(org_id: nil, request_options: nil)
+    def update(query_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/metric-alerts",
-        path_params: { "orgId" => org_id },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/log-workspaces/{queryId}",
+        path_params: { "orgId" => org_id, "queryId" => query_id },
+        body: body,
         request_options: request_options
       )
     end
+  end
 
-    # List metric series that actually exist
+  # `client.managed_accounts`
+  class ManagedAccountsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a managed account
     #
-    # The series labels resources reported in the last 7 days, optionally
-    # narrowed to one plugin and resource type; what the rule builder's metric
-    # picker is fed from.
+    # Refused with 409 when a cost centre or account named here is already
+    # billed to another customer. The error names the other customer, because
+    # “it conflicts” without saying with whom sends the caller hunting.
     #
-    # GET /api/org/{orgId}/metric-alerts/metric-keys
+    # _Requires permission: `invoices:write`._
+    #
+    # POST /api/org/{orgId}/managed-accounts
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param plugin_id [String, nil]
-    # @param resource_type_id [String, nil]
+    # @param body [Hash] Request body, shaped as `ManagedAccountInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricSeriesKey>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ManagedAccount` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def metric_keys(org_id: nil, plugin_id: nil, resource_type_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/metric-alerts/metric-keys",
+        http_method: "POST",
+        path: "/api/org/{orgId}/managed-accounts",
         path_params: { "orgId" => org_id },
-        query: { "pluginId" => plugin_id, "resourceTypeId" => resource_type_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # List what the organization's resources offer to select on
+    # Retire a managed account
     #
-    # GET /api/org/{orgId}/metric-alerts/selector-options
+    # A soft delete: an issued invoice names its customer, and an invoice whose
+    # customer stopped resolving is exactly the unreconcilable document this
+    # feature exists to prevent. Draft invoices are removed with it; a draft was
+    # never issued.
+    #
+    # _Requires permission: `invoices:write`._
+    #
+    # DELETE /api/org/{orgId}/managed-accounts/{id}
+    #
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MetricAlertSelectorOptions` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def selector_options(org_id: nil, request_options: nil)
+    def delete(id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/metric-alerts/selector-options",
-        path_params: { "orgId" => org_id },
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/managed-accounts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
 
-    # Preview which resources a selector matches right now
+    # Get a managed account
     #
-    # GET /api/org/{orgId}/metric-alerts/selector-preview
+    # _Requires permission: `invoices:read`._
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/managed-accounts/{id}
+    #
+    # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param plugin_id [String, nil]
-    # @param resource_type_id [String, nil]
-    # @param tag_key [String, nil]
-    # @param tag_value [String, nil]
+    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MetricAlertSelectorPreview` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ManagedAccount` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def selector_preview(
-      org_id: nil,
-      plugin_id: nil,
-      resource_type_id: nil,
-      tag_key: nil,
-      tag_value: nil,
-      request_options: nil
-    )
+    def get(id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/metric-alerts/selector-preview",
-        path_params: { "orgId" => org_id },
-        query: {
-          "pluginId" => plugin_id,
-          "resourceTypeId" => resource_type_id,
-          "tagKey" => tag_key,
-          "tagValue" => tag_value
-        },
+        path: "/api/org/{orgId}/managed-accounts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
 
-    # Update a metric alert rule
+    # List managed accounts
     #
-    # PUT /api/org/{orgId}/metric-alerts/{id}
+    # The customers a managed service provider bills. A managed account
+    # references existing cost centres rather than defining its own matching
+    # rules, so the spend on an invoice is the same spend the showback report
+    # attributes to those centres.
     #
-    # Raises on 400: Bad request
+    # _Requires permission: `invoices:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/managed-accounts
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
-    # @param body [Hash] Request body, shaped as `MetricAlertRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<ManagedAccount>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(id:, body:, org_id: nil, request_options: nil)
+    def list(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "PUT",
-        path: "/api/org/{orgId}/metric-alerts/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
-        body: body,
+        http_method: "GET",
+        path: "/api/org/{orgId}/managed-accounts",
+        path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
-  end
-
-  # `client.moment`
-  class MomentNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-    end
 
-    # Everything that happened around a timestamp
+    # Update a managed account
     #
-    # "What changed around 03:14?"; one merged, chronological narrative of
-    # everything the platform knows happened in a window: resource changes
-    # (including sleep/wake schedule attribution), provider status incidents
-    # that started/resolved in or overlap the window, cost anomalies, workflow
-    # runs, deployments, audit-log entries, change freezes, and the drift/expiry
-    # alert deliveries. Each feed is gated on the same permission its own
-    # endpoint requires; feeds the caller cannot read are reported as `omitted`,
-    # and a feed whose query fails is reported as `error` without blanking the
-    # rest of the response.
+    # A full replace. Editing the scope changes what **future** drafts are drawn
+    # over and nothing else: every approved invoice holds its own copy of the
+    # scope, so moving a cost centre between customers cannot re-bill a period
+    # that has already been invoiced.
     #
-    # _Requires permission: `resources:read`._
+    # _Requires permission: `invoices:write`._
     #
-    # GET /api/org/{orgId}/moment
+    # PUT /api/org/{orgId}/managed-accounts/{id}
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param at [String, nil] Centre of the window. Defaults to now.
-    # @param window [Integer, nil] Half-window in minutes (the ± around `at`). Default 60, max
-    #   4320 (±3 days).
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `ManagedAccountInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MomentResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ManagedAccount` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, at: nil, window: nil, request_options: nil)
+    def update(id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/moment",
-        path_params: { "orgId" => org_id },
-        query: { "at" => at, "window" => window },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/managed-accounts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.msteams.webhooks`
-  class MsteamsWebhooksNamespace
+  # `client.metric_alerts`
+  class MetricAlertsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Connect a Teams channel as an alert destination
+    # Create a metric alert rule
     #
-    # Adds a channel by webhook URL, or updates the one already holding that
-    # URL. Which alerts reach it is decided by /alert-rules; connecting a
-    # channel routes nothing to it on its own. Responds 400 when the URL is not
-    # https or its host is not Microsoft-operated.
+    # Rules select resources by query (plugin + resource type + tag), never by
+    # id list, so a rule automatically covers resources created after it was
+    # written. The poller evaluates enabled rules about once a minute and alerts
+    # when the condition held for the whole trailing window.
     #
-    # POST /api/org/{orgId}/msteams/webhooks
+    # POST /api/org/{orgId}/metric-alerts
     #
     # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `MsTeamsWebhookCreate`.
+    # @param body [Hash] Request body, shaped as `MetricAlertRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MsTeamsWebhook` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/msteams/webhooks",
+        path: "/api/org/{orgId}/metric-alerts",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Disconnect a Teams channel
+    # Delete a metric alert rule
     #
-    # DELETE /api/org/{orgId}/msteams/webhooks/{id}
+    # Soft delete. The rule's firing history stays readable via
+    # /metric-alerts/events.
+    #
+    # DELETE /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 404: Not found
     #
@@ -13453,247 +13730,519 @@ module Infrawrench
     def delete(id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "DELETE",
-        path: "/api/org/{orgId}/msteams/webhooks/{id}",
+        path: "/api/org/{orgId}/metric-alerts/{id}",
         path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
 
-    # Rename a Teams channel
-    #
-    # The webhook URL is immutable; remove the channel and re-add it to change
-    # it.
-    #
-    # PATCH /api/org/{orgId}/msteams/webhooks/{id}
-    #
-    # Raises on 400: Bad request
+    # Recent metric alert firings
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/metric-alerts/events
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param id [String]
-    # @param body [Hash, nil] Request body, shaped as `MsTeamsWebhookUpdate`.
+    # @param rule_id [String, nil]
+    # @param limit [Integer, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MsTeamsWebhook` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricAlertEvent>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(id:, org_id: nil, body: nil, request_options: nil)
+    def events(org_id: nil, rule_id: nil, limit: nil, request_options: nil)
       @transport.request(
-        http_method: "PATCH",
-        path: "/api/org/{orgId}/msteams/webhooks/{id}",
-        path_params: { "orgId" => org_id, "id" => id },
-        body: body,
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts/events",
+        path_params: { "orgId" => org_id },
+        query: { "ruleId" => rule_id, "limit" => limit },
         request_options: request_options
       )
     end
-  end
 
-  # `client.msteams`
-  class MsteamsNamespace
-    # @return [MsteamsWebhooksNamespace] `client.msteams.webhooks`
-    attr_reader :webhooks
-
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-      @webhooks = MsteamsWebhooksNamespace.new(@transport)
+    # Get a metric alert rule
+    #
+    # GET /api/org/{orgId}/metric-alerts/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
     end
 
-    # List the organization's Teams channels
-    #
-    # Returns the Teams channels alerts can be routed to. Which alerts reach
-    # each one is decided by /alert-rules. Webhook URLs are never included.
+    # List metric alert rules with live firing status
     #
-    # GET /api/org/{orgId}/msteams/status
+    # GET /api/org/{orgId}/metric-alerts
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `MsTeamsStatus` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricAlertRuleWithStatus>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def status(org_id: nil, request_options: nil)
+    def list(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/msteams/status",
+        path: "/api/org/{orgId}/metric-alerts",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # Post a test card to every configured Teams channel
-    #
-    # Ignores routing rules; every channel gets the test. Fails with the error
-    # Microsoft returned when nothing could be delivered (HTTP 404 usually means
-    # the Workflow was deleted or turned off).
+    # List metric series that actually exist
     #
-    # POST /api/org/{orgId}/msteams/test
+    # The series labels resources reported in the last 7 days, optionally
+    # narrowed to one plugin and resource type; what the rule builder's metric
+    # picker is fed from.
     #
-    # Raises on 400: Bad request
+    # GET /api/org/{orgId}/metric-alerts/metric-keys
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param plugin_id [String, nil]
+    # @param resource_type_id [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<MetricSeriesKey>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def test(org_id: nil, request_options: nil)
+    def metric_keys(org_id: nil, plugin_id: nil, resource_type_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/msteams/test",
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts/metric-keys",
         path_params: { "orgId" => org_id },
+        query: { "pluginId" => plugin_id, "resourceTypeId" => resource_type_id },
         request_options: request_options
       )
     end
-  end
 
-  # `client.network_flows.kubernetes.settings`
-  class NetworkFlowsKubernetesSettingsNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
+    # List what the organization's resources offer to select on
+    #
+    # GET /api/org/{orgId}/metric-alerts/selector-options
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertSelectorOptions` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def selector_options(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/metric-alerts/selector-options",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
     end
 
-    # Read a cluster's network cost settings
-    #
-    # _Requires permission: `costs:read`._
+    # Preview which resources a selector matches right now
     #
-    # GET /api/org/{orgId}/network-flows/kubernetes/{accountId}/settings
+    # GET /api/org/{orgId}/metric-alerts/selector-preview
     #
-    # Raises on 404: Not found
+    # Raises on 400: Bad request
     #
-    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
-    # @param account_id [String]
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String, nil]
+    # @param resource_type_id [String, nil]
+    # @param tag_key [String, nil]
+    # @param tag_value [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `KubernetesNetworkSettings` — see
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertSelectorPreview` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(account_id:, org_id: nil, request_options: nil)
+    def selector_preview(
+      org_id: nil,
+      plugin_id: nil,
+      resource_type_id: nil,
+      tag_key: nil,
+      tag_value: nil,
+      request_options: nil
+    )
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/network-flows/kubernetes/{accountId}/settings",
-        path_params: { "orgId" => org_id, "accountId" => account_id },
+        path: "/api/org/{orgId}/metric-alerts/selector-preview",
+        path_params: { "orgId" => org_id },
+        query: {
+          "pluginId" => plugin_id,
+          "resourceTypeId" => resource_type_id,
+          "tagKey" => tag_key,
+          "tagValue" => tag_value
+        },
         request_options: request_options
       )
     end
 
-    # Set the billed data-transfer source for a cluster
-    #
-    # Say which billed cost rows are this cluster's data transfer, in the cost
-    # query language. An empty or null query clears it. A query that narrows
-    # nothing is refused: it would apportion the whole bill across one cluster.
-    #
-    # _Requires permission: `costs:write`._
+    # Update a metric alert rule
     #
-    # PUT /api/org/{orgId}/network-flows/kubernetes/{accountId}/settings
+    # PUT /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 400: Bad request
     #
-    # Raises on 403: Forbidden
-    #
     # Raises on 404: Not found
     #
-    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
-    # @param account_id [String]
-    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `MetricAlertRuleInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `KubernetesNetworkSettings` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MetricAlertRule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(account_id:, body:, org_id: nil, request_options: nil)
+    def update(id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PUT",
-        path: "/api/org/{orgId}/network-flows/kubernetes/{accountId}/settings",
-        path_params: { "orgId" => org_id, "accountId" => account_id },
+        path: "/api/org/{orgId}/metric-alerts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
         body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.network_flows.kubernetes`
-  class NetworkFlowsKubernetesNamespace
-    # @return [NetworkFlowsKubernetesSettingsNamespace] `client.network_flows.kubernetes.settings`
-    attr_reader :settings
-
+  # `client.moment`
+  class MomentNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
-      @settings = NetworkFlowsKubernetesSettingsNamespace.new(@transport)
     end
 
-    # Kubernetes network costs for one cluster
-    #
-    # Pod-level network attribution for a Kubernetes account: bytes by
-    # namespace, workload and boundary (same zone, cross-zone, cross-region,
-    # internet), the largest workload → peer pairs, and which sources the
-    # figures came from.
+    # Everything that happened around a timestamp
     #
-    # `estimatedCost` is bytes at the published rate of the cloud the nodes run
-    # on, with any per-cluster overrides from the account's rates field. When a
-    # billed source is configured (`PUT .../settings`), `allocatedCost`
-    # apportions that real billed spend across the rows day by day, never
-    # handing out more than was billed; the rest is `unallocatedCost`.
+    # "What changed around 03:14?"; one merged, chronological narrative of
+    # everything the platform knows happened in a window: resource changes
+    # (including sleep/wake schedule attribution), provider status incidents
+    # that started/resolved in or overlap the window, cost anomalies, workflow
+    # runs, deployments, audit-log entries, change freezes, and the drift/expiry
+    # alert deliveries. Each feed is gated on the same permission its own
+    # endpoint requires; feeds the caller cannot read are reported as `omitted`,
+    # and a feed whose query fails is reported as `error` without blanking the
+    # rest of the response.
     #
-    # _Requires permission: `costs:read`._
+    # _Requires permission: `resources:read`._
     #
-    # GET /api/org/{orgId}/network-flows/kubernetes/{accountId}
+    # GET /api/org/{orgId}/moment
     #
     # Raises on 400: Bad request
     #
-    # Raises on 404: Not found
-    #
-    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
-    # @param account_id [String]
-    # @param from [String, nil] Inclusive start day. Defaults to 13 days ago.
-    # @param to [String, nil] Inclusive end day. Defaults to today.
-    # @param limit [Integer, nil] Pairs to return in `topTalkers`. Defaults to 25.
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param at [String, nil] Centre of the window. Defaults to now.
+    # @param window [Integer, nil] Half-window in minutes (the ± around `at`). Default 60, max
+    #   4320 (±3 days).
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `KubernetesNetworkReport` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MomentResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(account_id:, org_id: nil, from: nil, to: nil, limit: nil, request_options: nil)
+    def get(org_id: nil, at: nil, window: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/network-flows/kubernetes/{accountId}",
-        path_params: { "orgId" => org_id, "accountId" => account_id },
-        query: { "from" => from, "to" => to, "limit" => limit },
+        path: "/api/org/{orgId}/moment",
+        path_params: { "orgId" => org_id },
+        query: { "at" => at, "window" => window },
         request_options: request_options
       )
     end
   end
 
-  # `client.network_flows.settings`
-  class NetworkFlowsSettingsNamespace
+  # `client.msteams.webhooks`
+  class MsteamsWebhooksNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Read the network flow collection switch
+    # Connect a Teams channel as an alert destination
     #
-    # _Requires permission: `costs:read`._
+    # Adds a channel by webhook URL, or updates the one already holding that
+    # URL. Which alerts reach it is decided by /alert-rules; connecting a
+    # channel routes nothing to it on its own. Responds 400 when the URL is not
+    # https or its host is not Microsoft-operated.
     #
-    # GET /api/org/{orgId}/network-flows/settings
+    # POST /api/org/{orgId}/msteams/webhooks
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `MsTeamsWebhookCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `MsTeamsWebhook` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def create(org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/network-flows/settings",
+        http_method: "POST",
+        path: "/api/org/{orgId}/msteams/webhooks",
         path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Turn network flow collection on or off
+    # Disconnect a Teams channel
+    #
+    # DELETE /api/org/{orgId}/msteams/webhooks/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/msteams/webhooks/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Rename a Teams channel
+    #
+    # The webhook URL is immutable; remove the channel and re-add it to change
+    # it.
+    #
+    # PATCH /api/org/{orgId}/msteams/webhooks/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash, nil] Request body, shaped as `MsTeamsWebhookUpdate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `MsTeamsWebhook` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/msteams/webhooks/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.msteams`
+  class MsteamsNamespace
+    # @return [MsteamsWebhooksNamespace] `client.msteams.webhooks`
+    attr_reader :webhooks
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @webhooks = MsteamsWebhooksNamespace.new(@transport)
+    end
+
+    # List the organization's Teams channels
+    #
+    # Returns the Teams channels alerts can be routed to. Which alerts reach
+    # each one is decided by /alert-rules. Webhook URLs are never included.
+    #
+    # GET /api/org/{orgId}/msteams/status
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `MsTeamsStatus` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def status(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/msteams/status",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Post a test card to every configured Teams channel
+    #
+    # Ignores routing rules; every channel gets the test. Fails with the error
+    # Microsoft returned when nothing could be delivered (HTTP 404 usually means
+    # the Workflow was deleted or turned off).
+    #
+    # POST /api/org/{orgId}/msteams/test
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def test(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/msteams/test",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.network_flows.kubernetes.settings`
+  class NetworkFlowsKubernetesSettingsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Read a cluster's network cost settings
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/kubernetes/{accountId}/settings
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param account_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesNetworkSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(account_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/kubernetes/{accountId}/settings",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
+        request_options: request_options
+      )
+    end
+
+    # Set the billed data-transfer source for a cluster
+    #
+    # Say which billed cost rows are this cluster's data transfer, in the cost
+    # query language. An empty or null query clears it. A query that narrows
+    # nothing is refused: it would apportion the whole bill across one cluster.
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # PUT /api/org/{orgId}/network-flows/kubernetes/{accountId}/settings
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param account_id [String]
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesNetworkSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(account_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/network-flows/kubernetes/{accountId}/settings",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.network_flows.kubernetes`
+  class NetworkFlowsKubernetesNamespace
+    # @return [NetworkFlowsKubernetesSettingsNamespace] `client.network_flows.kubernetes.settings`
+    attr_reader :settings
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @settings = NetworkFlowsKubernetesSettingsNamespace.new(@transport)
+    end
+
+    # Kubernetes network costs for one cluster
+    #
+    # Pod-level network attribution for a Kubernetes account: bytes by
+    # namespace, workload and boundary (same zone, cross-zone, cross-region,
+    # internet), the largest workload → peer pairs, and which sources the
+    # figures came from.
+    #
+    # `estimatedCost` is bytes at the published rate of the cloud the nodes run
+    # on, with any per-cluster overrides from the account's rates field. When a
+    # billed source is configured (`PUT .../settings`), `allocatedCost`
+    # apportions that real billed spend across the rows day by day, never
+    # handing out more than was billed; the rest is `unallocatedCost`.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/kubernetes/{accountId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param account_id [String]
+    # @param from [String, nil] Inclusive start day. Defaults to 13 days ago.
+    # @param to [String, nil] Inclusive end day. Defaults to today.
+    # @param limit [Integer, nil] Pairs to return in `topTalkers`. Defaults to 25.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesNetworkReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(account_id:, org_id: nil, from: nil, to: nil, limit: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/kubernetes/{accountId}",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
+        query: { "from" => from, "to" => to, "limit" => limit },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.network_flows.settings`
+  class NetworkFlowsSettingsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Read the network flow collection switch
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/settings
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/settings",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Turn network flow collection on or off
     #
     # Collection is **off by default**. Enabling it authorizes Infrawrench to
     # run daily queries against the provider's log store; and on AWS those
@@ -14130,241 +14679,694 @@ module Infrawrench
     # @return [Hash] Parsed JSON, shaped as `OrphanListResponse` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/orphans",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ownership`
+  class OwnershipNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Clear a resource's ownership
+    #
+    # Removes the ownership record. The resource itself is untouched.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/ownership
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param resource_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [nil] This endpoint returns no content.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(resource_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/ownership",
+        path_params: { "orgId" => org_id },
+        query: { "resourceId" => resource_id },
+        accept: :empty,
+        request_options: request_options
+      )
+    end
+
+    # List resource ownership records
+    #
+    # Every ownership record in the organization; owner, purpose and authorizing
+    # ticket, per resource. Only resources somebody has recorded something about
+    # appear; an absent record means the resource is unowned.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/ownership
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceOwnershipListResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ownership",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # List people an owner can be set to
+    #
+    # Org members, as a minimal id/name/email projection for the owner picker.
+    # Requires only `resources:read`, deliberately not `team:read`: recording
+    # who owns a resource must not be reserved for whoever can also read roles
+    # and membership.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/ownership/members
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `OwnerCandidateListResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def members(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ownership/members",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get one resource's ownership
+    #
+    # The ownership record for a single resource, or null when none is recorded.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/ownership/resource
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param resource_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceOwnershipEnvelope` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def resource(resource_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ownership/resource",
+        path_params: { "orgId" => org_id },
+        query: { "resourceId" => resource_id },
+        request_options: request_options
+      )
+    end
+
+    # Set a resource's ownership
+    #
+    # Upsert keyed by `resourceId`: ownership is a property of the resource, so
+    # there is no separate create and update. Omitted fields keep their value
+    # and `null` clears one. Clearing every field removes the record entirely
+    # and the response is `null`, which is the new truth rather than an empty
+    # record. An `ownerUserId` must be a member of this organization: ownership
+    # that looks routable but reaches nobody is worse than none.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # PUT /api/org/{orgId}/ownership
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `ResourceOwnershipPatch`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceOwnership & Hash | nil` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/ownership",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.pages`
+  class PagesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Raise an alert to the organization's on-call transports
+    #
+    # Fans an alert out over whatever the org has configured (Twilio SMS (and
+    # voice on request), mobile push, Slack channels, and Microsoft Teams
+    # webhooks) honouring each recipient's opt-ins. This is the same alert a
+    # workflow raises with `infra.page(...)`, for code that runs somewhere
+    # Infrawrench does not: a health check, a deploy script, a cron on a box.
+    #
+    # Repeat pages under the same `(source, key)` are **suppressed, not
+    # rejected**: a monitor that fires every minute pages once and then gets
+    # `200` with `suppressed: true` and the `retryAt` at which the key can page
+    # again. A page that reached nobody does not start a cooldown, so the next
+    # call tries again.
+    #
+    # Recipients opt in per channel under the same setting that covers workflow
+    # pages.
+    #
+    # _Requires permission: `pages:write`._
+    #
+    # POST /api/org/{orgId}/pages
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `PageRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PageResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/pages",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Clear a page key's cooldown
+    #
+    # Drops the cooldown for one `(source, key)` so the next page under it
+    # delivers immediately. Call it when the condition you alerted on recovers;
+    # the workflow equivalent is `infra.page.clear(key)`. Clearing a key that
+    # was never paged is not an error.
+    #
+    # _Requires permission: `pages:write`._
+    #
+    # DELETE /api/org/{orgId}/pages
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param source [String] Stable name for the system raising the page: letters, digits, `.`,
+    #   `_` and `-`. It is the notification's sender, and it scopes the cooldown; two services
+    #   paging under the same key never throttle each other.
+    # @param key [String, nil] Defaults to `default`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PageClearResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(source:, org_id: nil, key: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/pages",
+        path_params: { "orgId" => org_id },
+        query: { "source" => source, "key" => key },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.paging_incidents`
+  class PagingIncidentsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Acknowledge a provider incident
+    #
+    # Written to the provider as the acting member where the provider records
+    # who acted (PagerDuty's `From` header), falling back to the account's
+    # default user. The returned state is the provider's answer, not an
+    # assumption.
+    #
+    # POST /api/org/{orgId}/paging-incidents/{id}/acknowledge
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PagerIncident` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def acknowledge(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/paging-incidents/{id}/acknowledge",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List incidents mirrored from paging providers
+    #
+    # Only accounts with inbound mirroring turned on contribute. Open incidents
+    # by default; `status=all` includes resolved ones. These are a provider's
+    # pages, distinct from incidents declared in Infrawrench (`/incidents`).
+    #
+    # GET /api/org/{orgId}/paging-incidents
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param status [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PagerIncidentsResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, status: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/paging-incidents",
+        path_params: { "orgId" => org_id },
+        query: { "status" => status },
+        request_options: request_options
+      )
+    end
+
+    # Resolve a provider incident
+    #
+    # Written to the provider as the acting member where the provider records
+    # who acted (PagerDuty's `From` header), falling back to the account's
+    # default user. The returned state is the provider's answer, not an
+    # assumption.
+    #
+    # POST /api/org/{orgId}/paging-incidents/{id}/resolve
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PagerIncident` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def resolve(id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/orphans",
-        path_params: { "orgId" => org_id },
+        http_method: "POST",
+        path: "/api/org/{orgId}/paging-incidents/{id}/resolve",
+        path_params: { "orgId" => org_id, "id" => id },
         request_options: request_options
       )
     end
   end
 
-  # `client.ownership`
-  class OwnershipNamespace
+  # `client.paging_providers.on_call`
+  class PagingProvidersOnCallNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Clear a resource's ownership
-    #
-    # Removes the ownership record. The resource itself is untouched.
+    # Who is on call on a provider schedule or escalation policy
     #
-    # _Requires permission: `resources:write`._
+    # Takes `team:read`, like the rotation preview. Each person is matched to an
+    # organization member by email; `memberUserId` is null for somebody who is
+    # on call upstream but not a member here.
     #
-    # DELETE /api/org/{orgId}/ownership
+    # GET /api/org/{orgId}/paging-providers/{accountId}/on-call/{sourceId}
     #
     # Raises on 400: Bad request
     #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param resource_id [String]
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param account_id [String] A connected account whose plugin can page
+    # @param source_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [nil] This endpoint returns no content.
+    # @return [Hash] Parsed JSON, shaped as `PagingOnCallNowResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(resource_id:, org_id: nil, request_options: nil)
+    def get(account_id:, source_id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/ownership",
-        path_params: { "orgId" => org_id },
-        query: { "resourceId" => resource_id },
-        accept: :empty,
+        http_method: "GET",
+        path: "/api/org/{orgId}/paging-providers/{accountId}/on-call/{sourceId}",
+        path_params: { "orgId" => org_id, "accountId" => account_id, "sourceId" => source_id },
         request_options: request_options
       )
     end
+  end
 
-    # List resource ownership records
+  # `client.paging_providers`
+  class PagingProvidersNamespace
+    # @return [PagingProvidersOnCallNamespace] `client.paging_providers.on_call`
+    attr_reader :on_call
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @on_call = PagingProvidersOnCallNamespace.new(@transport)
+    end
+
+    # List the targets and on-call sources a routing rule can name
     #
-    # Every ownership record in the organization; owner, purpose and authorizing
-    # ticket, per resource. Only resources somebody has recorded something about
-    # appear; an absent record means the resource is unowned.
+    # Listed live from each provider, so a destination is picked by name. A
+    # failure is reported per account in `error` rather than failing the
+    # response.
     #
-    # _Requires permission: `resources:read`._
+    # GET /api/org/{orgId}/paging-providers/destinations
     #
-    # GET /api/org/{orgId}/ownership
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceOwnershipListResponse` — see
+    # @return [Hash] Parsed JSON, shaped as `PagingDestinationsResponse` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def destinations(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/ownership",
+        path: "/api/org/{orgId}/paging-providers/destinations",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
 
-    # List people an owner can be set to
+    # List upstream alerts Infrawrench opened
     #
-    # Org members, as a minimal id/name/email projection for the owner picker.
-    # Requires only `resources:read`, deliberately not `team:read`: recording
-    # who owns a resource must not be reserved for whoever can also read roles
-    # and membership.
+    # One row per (account, target, dedup key): a trigger, its acknowledgement
+    # and its resolution are one alert upstream. `pendingAction` is set while a
+    # send is queued or being retried.
     #
-    # _Requires permission: `resources:read`._
+    # GET /api/org/{orgId}/paging-providers/events
     #
-    # GET /api/org/{orgId}/ownership/members
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param limit [Integer, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `OwnerCandidateListResponse` — see
+    # @return [Hash] Parsed JSON, shaped as `PagingEventsResponse` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def members(org_id: nil, request_options: nil)
+    def events(org_id: nil, limit: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/ownership/members",
+        path: "/api/org/{orgId}/paging-providers/events",
         path_params: { "orgId" => org_id },
+        query: { "limit" => limit },
         request_options: request_options
       )
     end
 
-    # Get one resource's ownership
+    # List paging provider accounts and their settings
     #
-    # The ownership record for a single resource, or null when none is recorded.
+    # GET /api/org/{orgId}/paging-providers
     #
-    # _Requires permission: `resources:read`._
+    # Raises on 400: Bad request
     #
-    # GET /api/org/{orgId}/ownership/resource
+    # Raises on 401: Unauthenticated
     #
-    # Raises on 400: Bad request
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param resource_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceOwnershipEnvelope` — see
+    # @return [Hash] Parsed JSON, shaped as `PagingProvidersResponse` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def resource(resource_id:, org_id: nil, request_options: nil)
+    def get(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/ownership/resource",
+        path: "/api/org/{orgId}/paging-providers",
         path_params: { "orgId" => org_id },
-        query: { "resourceId" => resource_id },
         request_options: request_options
       )
     end
 
-    # Set a resource's ownership
-    #
-    # Upsert keyed by `resourceId`: ownership is a property of the resource, so
-    # there is no separate create and update. Omitted fields keep their value
-    # and `null` clears one. Clearing every field removes the record entirely
-    # and the response is `null`, which is the new truth rather than an empty
-    # record. An `ownerUserId` must be a member of this organization: ownership
-    # that looks routable but reaches nobody is worse than none.
+    # Configure incident mirroring for a paging provider account
     #
-    # _Requires permission: `resources:write`._
+    # Turning inbound on with a `managed` webhook subscribes one through the
+    # provider's API; turning it off removes the subscription and forgets the
+    # mirrored incidents. A webhook that cannot be subscribed is reported in
+    # `warning` and mirroring falls back to reconciling on a timer.
     #
-    # PUT /api/org/{orgId}/ownership
+    # PUT /api/org/{orgId}/paging-providers/{accountId}/settings
     #
     # Raises on 400: Bad request
     #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `ResourceOwnershipPatch`.
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param account_id [String] A connected account whose plugin can page
+    # @param body [Hash, nil] Request body, shaped as `PagingProviderSettingsInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceOwnership & Hash | nil` — see
+    # @return [Hash] Parsed JSON, shaped as `PagingProviderSettingsResult` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(org_id: nil, body: nil, request_options: nil)
+    def settings(account_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
         http_method: "PUT",
-        path: "/api/org/{orgId}/ownership",
-        path_params: { "orgId" => org_id },
+        path: "/api/org/{orgId}/paging-providers/{accountId}/settings",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
         body: body,
         request_options: request_options
       )
     end
-  end
-
-  # `client.pages`
-  class PagesNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-    end
 
-    # Raise an alert to the organization's on-call transports
+    # Reconcile an account's incidents now
     #
-    # Fans an alert out over whatever the org has configured (Twilio SMS (and
-    # voice on request), mobile push, Slack channels, and Microsoft Teams
-    # webhooks) honouring each recipient's opt-ins. This is the same alert a
-    # workflow raises with `infra.page(...)`, for code that runs somewhere
-    # Infrawrench does not: a health check, a deploy script, a cron on a box.
+    # POST /api/org/{orgId}/paging-providers/{accountId}/sync
     #
-    # Repeat pages under the same `(source, key)` are **suppressed, not
-    # rejected**: a monitor that fires every minute pages once and then gets
-    # `200` with `suppressed: true` and the `retryAt` at which the key can page
-    # again. A page that reached nobody does not start a cooldown, so the next
-    # call tries again.
+    # Raises on 400: Bad request
     #
-    # Recipients opt in per channel under the same setting that covers workflow
-    # pages.
+    # Raises on 401: Unauthenticated
     #
-    # _Requires permission: `pages:write`._
+    # Raises on 402: Payment required: the organization's plan does not include
+    # this
     #
-    # POST /api/org/{orgId}/pages
+    # Raises on 403: Forbidden
     #
-    # Raises on 400: Bad request
+    # Raises on 404: Not found
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param body [Hash] Request body, shaped as `PageRequest`.
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # Raises on 503: A backing service this endpoint depends on is not available
+    #
+    # Raises on reauth: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param account_id [String] A connected account whose plugin can page
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `PageResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `PagingSyncResult` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(body:, org_id: nil, request_options: nil)
+    def sync(account_id:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/pages",
-        path_params: { "orgId" => org_id },
-        body: body,
+        path: "/api/org/{orgId}/paging-providers/{accountId}/sync",
+        path_params: { "orgId" => org_id, "accountId" => account_id },
         request_options: request_options
       )
     end
+  end
 
-    # Clear a page key's cooldown
+  # `client.paging_webhooks`
+  class PagingWebhooksNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Inbound paging provider webhook
     #
-    # Drops the cooldown for one `(source, key)` so the next page under it
-    # delivers immediately. Call it when the condition you alerted on recovers;
-    # the workflow equivalent is `infra.page.clear(key)`. Clearing a key that
-    # was never paged is not an error.
+    # Called by the provider, not by clients. The token in the path picks the
+    # account; the provider's signature, verified with the stored secret,
+    # authenticates the delivery. The payload is treated as a nudge: each
+    # incident it names is re-read from the provider's API.
     #
-    # _Requires permission: `pages:write`._
+    # POST /api/paging-webhooks/{token}
     #
-    # DELETE /api/org/{orgId}/pages
+    # Raises on 401: The signature did not verify
     #
-    # Raises on 400: Bad request
+    # Raises on 404: Unknown token
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param source [String] Stable name for the system raising the page: letters, digits, `.`,
-    #   `_` and `-`. It is the notification's sender, and it scopes the cooldown; two services
-    #   paging under the same key never throttle each other.
-    # @param key [String, nil] Defaults to `default`.
+    # @param token [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `PageClearResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(source:, org_id: nil, key: nil, request_options: nil)
+    def create(token:, request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/pages",
-        path_params: { "orgId" => org_id },
-        query: { "source" => source, "key" => key },
+        http_method: "POST",
+        path: "/api/paging-webhooks/{token}",
+        path_params: { "token" => token },
+        accept: :empty,
         request_options: request_options
       )
     end
@@ -20939,6 +21941,8 @@ module Infrawrench
     attr_reader :invoices
     # @return [JiraNamespace] `client.jira`
     attr_reader :jira
+    # @return [JitAccessNamespace] `client.jit_access`
+    attr_reader :jit_access
     # @return [KvNamespace] `client.kv`
     attr_reader :kv
     # @return [LeasesNamespace] `client.leases`
@@ -20967,6 +21971,12 @@ module Infrawrench
     attr_reader :ownership
     # @return [PagesNamespace] `client.pages`
     attr_reader :pages
+    # @return [PagingIncidentsNamespace] `client.paging_incidents`
+    attr_reader :paging_incidents
+    # @return [PagingProvidersNamespace] `client.paging_providers`
+    attr_reader :paging_providers
+    # @return [PagingWebhooksNamespace] `client.paging_webhooks`
+    attr_reader :paging_webhooks
     # @return [PostureNamespace] `client.posture`
     attr_reader :posture
     # @return [PriceCatalogNamespace] `client.price_catalog`
@@ -21104,6 +22114,7 @@ module Infrawrench
       @invitations = InvitationsNamespace.new(@transport)
       @invoices = InvoicesNamespace.new(@transport)
       @jira = JiraNamespace.new(@transport)
+      @jit_access = JitAccessNamespace.new(@transport)
       @kv = KvNamespace.new(@transport)
       @leases = LeasesNamespace.new(@transport)
       @linear = LinearNamespace.new(@transport)
@@ -21118,6 +22129,9 @@ module Infrawrench
       @orphans = OrphansNamespace.new(@transport)
       @ownership = OwnershipNamespace.new(@transport)
       @pages = PagesNamespace.new(@transport)
+      @paging_incidents = PagingIncidentsNamespace.new(@transport)
+      @paging_providers = PagingProvidersNamespace.new(@transport)
+      @paging_webhooks = PagingWebhooksNamespace.new(@transport)
       @posture = PostureNamespace.new(@transport)
       @price_catalog = PriceCatalogNamespace.new(@transport)
       @probes = ProbesNamespace.new(@transport)