infrawrench-sdk 1.81.0 → 1.82.0

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.81.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.82.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.81.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.82.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -2914,6 +2914,147 @@ module Infrawrench
     end
   end
 
+  # `client.billing_profiles`
+  class BillingProfilesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a billing profile
+    #
+    # _Requires permission: `invoices:write`._
+    #
+    # POST /api/org/{orgId}/billing-profiles
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `BillingProfileInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BillingProfile` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/billing-profiles",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a billing profile
+    #
+    # Refused with 409, naming them, while live customers are assigned: removing
+    # a profile out from under a customer would change the address, tax and
+    # numbering of its next invoice.
+    #
+    # _Requires permission: `invoices:write`._
+    #
+    # DELETE /api/org/{orgId}/billing-profiles/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/billing-profiles/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a billing profile
+    #
+    # _Requires permission: `invoices:read`._
+    #
+    # GET /api/org/{orgId}/billing-profiles/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BillingProfile` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/billing-profiles/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List billing profiles
+    #
+    # _Requires permission: `invoices:read`._
+    #
+    # GET /api/org/{orgId}/billing-profiles
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<BillingProfile>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/billing-profiles",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Update a billing profile
+    #
+    # A full replace, except `logo`, which is left as saved when absent. Draft
+    # invoices of the assigned customers follow the change; approved invoices
+    # keep the copy frozen onto them.
+    #
+    # _Requires permission: `invoices:write`._
+    #
+    # PUT /api/org/{orgId}/billing-profiles/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `BillingProfileInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BillingProfile` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/billing-profiles/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.billing_rules`
   class BillingRulesNamespace
     # @api private
@@ -3361,6 +3502,106 @@ module Infrawrench
     end
   end
 
+  # `client.business_metrics.forecast_values`
+  class BusinessMetricsForecastValuesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Write forecasted metric values
+    #
+    # Re-sending a day restates it. Values must be non-negative.
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # POST /api/org/{orgId}/business-metrics/{id}/forecast-values
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Metric id or key
+    # @param body [Hash] Request body, shaped as `BusinessMetricForecastValuesInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/business-metrics/{id}/forecast-values",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete forecasted metric values
+    #
+    # Removes planned days in `[from, to]`; omit both to clear every planned
+    # day.
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # DELETE /api/org/{orgId}/business-metrics/{id}/forecast-values
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Metric id or key
+    # @param from [String, nil]
+    # @param to [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, from: nil, to: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/business-metrics/{id}/forecast-values",
+        path_params: { "orgId" => org_id, "id" => id },
+        query: { "from" => from, "to" => to },
+        request_options: request_options
+      )
+    end
+
+    # List a metric's forecasted values
+    #
+    # Planned values, kept apart from the reported actuals: no unit cost,
+    # threshold or coverage figure ever reads them. Day order.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/business-metrics/{id}/forecast-values
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Metric id or key
+    # @param from [String, nil]
+    # @param to [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, from: nil, to: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/business-metrics/{id}/forecast-values",
+        path_params: { "orgId" => org_id, "id" => id },
+        query: { "from" => from, "to" => to },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.business_metrics.get`
   class BusinessMetricsGetNamespace
     # @api private
@@ -3572,26 +3813,37 @@ module Infrawrench
     end
   end
 
-  # `client.business_metrics.values`
-  class BusinessMetricsValuesNamespace
+  # `client.business_metrics.unit_costs`
+  class BusinessMetricsUnitCostsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Report metric values
+    # Query unit costs or margin
     #
-    # Write a batch of days. **Re-reporting a day restates it rather than
-    # accumulating**, which is what makes a nightly job safe to retry. Nothing
-    # lands unless the whole batch validates, so a bad row is a 400 rather than
-    # half a month restated. The same guarantees back
-    # `infra.businessMetrics.write(...)` in a workflow; both go through one
-    # validator.
+    # Divide spend by the metric, bucketed as asked. Three properties of the
+    # answer are worth knowing before reading it:
     #
-    # _Requires permission: `costs:write`._
+    # - **The ratio is computed at the requested bucket**, from a summed
+    # numerator and a summed denominator: never a mean of daily ratios, which
+    # weights a quiet day as heavily as a peak one. The same holds for
+    # `overallValue`.
+    # - **A missing or non-positive denominator is a gap** (`value: null` with a
+    # `gap` reason), never 0 and never infinite.
+    # - **Currencies are never merged.** Spend in a currency with no stated rate
+    # keeps its own series rather than being dropped or added to another.
     #
-    # POST /api/org/{orgId}/business-metrics/{id}/values
+    # There is no spend `groupBy`: a per-group ratio needs a per-group
+    # denominator. Split by a metric label with `groupByLabel` instead; in a
+    # ratio mode the label must be mapped to the cost dimension its values name
+    # (`labelMappings` on the metric), so each label value's spend is divided by
+    # its own volume.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/business-metrics/{id}/unit-costs
     #
     # Raises on 400: Bad request
     #
@@ -3600,27 +3852,38 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String] Metric id or key
-    # @param body [Hash] Request body, shaped as `BusinessMetricValuesInput`.
+    # @param body [Hash] Request body, shaped as `UnitCostQueryRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `UnitCostQueryResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def create(id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/business-metrics/{id}/values",
+        path: "/api/org/{orgId}/business-metrics/{id}/unit-costs",
         path_params: { "orgId" => org_id, "id" => id },
         body: body,
         request_options: request_options
       )
     end
 
-    # List a metric's reported values
+    # Export unit costs or margin as a file
     #
-    # Newest day first.
+    # The query `POST /business-metrics/{id}/unit-costs` answers, as CSV or
+    # NDJSON. One row per bucket per series (and per label value when grouped),
+    # columns in this order: `bucket`, `bucket_days`, `reported_days`,
+    # `partial`, `label_key`, `label_value`, `label_other`, `currency`, `mode`,
+    # `scale`, `metric_key`, `metric_unit`, `usage_unit`, `cost` (summed spend),
+    # `metric_value` (summed denominator, unscaled), `value` (the ratio, already
+    # scaled), `absolute_margin`, `gap`. A gap is an **empty** `value` with its
+    # reason in `gap`, never 0, and `partial` flags a bucket whose denominator
+    # covers only some of its days. Text cells starting with `=`, `+`, `-` or
+    # `@` are prefixed with `'` so a spreadsheet does not run them. NDJSON
+    # carries the same keys, with `null` for empty.
     #
     # _Requires permission: `costs:read`._
     #
-    # GET /api/org/{orgId}/business-metrics/{id}/values
+    # POST /api/org/{orgId}/business-metrics/{id}/unit-costs/export
     #
     # Raises on 400: Bad request
     #
@@ -3629,40 +3892,195 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String] Metric id or key
-    # @param limit [Integer, nil] Default 90.
+    # @param body [Hash] Request body, shaped as `UnitCostExportRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [String] Parsed JSON, shaped as `String` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(id:, org_id: nil, limit: nil, request_options: nil)
+    def export(id:, body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/business-metrics/{id}/values",
+        http_method: "POST",
+        path: "/api/org/{orgId}/business-metrics/{id}/unit-costs/export",
         path_params: { "orgId" => org_id, "id" => id },
-        query: { "limit" => limit },
+        body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.business_metrics`
-  class BusinessMetricsNamespace
-    # @return [BusinessMetricsGetNamespace] `client.business_metrics.get`
-    attr_reader :get
-    # @return [BusinessMetricsImporterNamespace] `client.business_metrics.importer`
-    attr_reader :importer
-    # @return [BusinessMetricsValuesNamespace] `client.business_metrics.values`
-    attr_reader :values
-
+  # `client.business_metrics.usage_unit_costs`
+  class BusinessMetricsUsageUnitCostsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
-      @get = BusinessMetricsGetNamespace.new(@transport)
-      @importer = BusinessMetricsImporterNamespace.new(@transport)
-      @values = BusinessMetricsValuesNamespace.new(@transport)
     end
 
-    # Create a business metric
+    # Query cost per usage unit
+    #
+    # Spend divided by the usage quantity providers report in one `usageUnit`,
+    # with no business metric involved. Both halves come from the same cost rows
+    # (those reported in that unit), so the numerator is exactly the spend that
+    # bought the denominator. A bucket with no usage is a gap (`no_usage`),
+    # never 0. Labels do not apply.
+    #
+    # POST /api/org/{orgId}/business-metrics/usage-unit-costs
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `UnitCostQueryRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `UnitCostQueryResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/business-metrics/usage-unit-costs",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Export cost per usage unit as a file
+    #
+    # The query `POST /business-metrics/usage-unit-costs` answers, as CSV or
+    # NDJSON. One row per bucket per series (and per label value when grouped),
+    # columns in this order: `bucket`, `bucket_days`, `reported_days`,
+    # `partial`, `label_key`, `label_value`, `label_other`, `currency`, `mode`,
+    # `scale`, `metric_key`, `metric_unit`, `usage_unit`, `cost` (summed spend),
+    # `metric_value` (summed denominator, unscaled), `value` (the ratio, already
+    # scaled), `absolute_margin`, `gap`. A gap is an **empty** `value` with its
+    # reason in `gap`, never 0, and `partial` flags a bucket whose denominator
+    # covers only some of its days. Text cells starting with `=`, `+`, `-` or
+    # `@` are prefixed with `'` so a spreadsheet does not run them. NDJSON
+    # carries the same keys, with `null` for empty.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/business-metrics/usage-unit-costs/export
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `UnitCostExportRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Parsed JSON, shaped as `String` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def export(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/business-metrics/usage-unit-costs/export",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.business_metrics.values`
+  class BusinessMetricsValuesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Report metric values
+    #
+    # Write a batch of days. **Re-reporting a day restates it rather than
+    # accumulating**, which is what makes a nightly job safe to retry. Nothing
+    # lands unless the whole batch validates, so a bad row is a 400 rather than
+    # half a month restated. The same guarantees back
+    # `infra.businessMetrics.write(...)` in a workflow; both go through one
+    # validator.
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # POST /api/org/{orgId}/business-metrics/{id}/values
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Metric id or key
+    # @param body [Hash] Request body, shaped as `BusinessMetricValuesInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/business-metrics/{id}/values",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List a metric's reported values
+    #
+    # Newest day first.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/business-metrics/{id}/values
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Metric id or key
+    # @param limit [Integer, nil] Default 90.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, limit: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/business-metrics/{id}/values",
+        path_params: { "orgId" => org_id, "id" => id },
+        query: { "limit" => limit },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.business_metrics`
+  class BusinessMetricsNamespace
+    # @return [BusinessMetricsForecastValuesNamespace] `client.business_metrics.forecast_values`
+    attr_reader :forecast_values
+    # @return [BusinessMetricsGetNamespace] `client.business_metrics.get`
+    attr_reader :get
+    # @return [BusinessMetricsImporterNamespace] `client.business_metrics.importer`
+    attr_reader :importer
+    # @return [BusinessMetricsUnitCostsNamespace] `client.business_metrics.unit_costs`
+    attr_reader :unit_costs
+    # @return [BusinessMetricsUsageUnitCostsNamespace] `client.business_metrics.usage_unit_costs`
+    attr_reader :usage_unit_costs
+    # @return [BusinessMetricsValuesNamespace] `client.business_metrics.values`
+    attr_reader :values
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @forecast_values = BusinessMetricsForecastValuesNamespace.new(@transport)
+      @get = BusinessMetricsGetNamespace.new(@transport)
+      @importer = BusinessMetricsImporterNamespace.new(@transport)
+      @unit_costs = BusinessMetricsUnitCostsNamespace.new(@transport)
+      @usage_unit_costs = BusinessMetricsUsageUnitCostsNamespace.new(@transport)
+      @values = BusinessMetricsValuesNamespace.new(@transport)
+    end
+
+    # Create a business metric
     #
     # Keys must be unique per organization among live metrics; they are how
     # workflows and the CLI address the metric. A key collision is a 409.
@@ -3830,52 +4248,6 @@ module Infrawrench
       )
     end
 
-    # Query unit costs or margin
-    #
-    # Divide spend by the metric, bucketed as asked. Three properties of the
-    # answer are worth knowing before reading it:
-    #
-    # - **The ratio is computed at the requested bucket**, from a summed
-    # numerator and a summed denominator: never a mean of daily ratios, which
-    # weights a quiet day as heavily as a peak one. The same holds for
-    # `overallValue`.
-    # - **A missing or non-positive denominator is a gap** (`value: null` with a
-    # `gap` reason), never 0 and never infinite.
-    # - **Currencies are never merged.** Spend in a currency with no stated rate
-    # keeps its own series rather than being dropped or added to another.
-    #
-    # There is no spend `groupBy`: a per-group ratio needs a per-group
-    # denominator. Split by a metric label with `groupByLabel` instead; in a
-    # ratio mode the label must be mapped to the cost dimension its values name
-    # (`labelMappings` on the metric), so each label value's spend is divided by
-    # its own volume.
-    #
-    # _Requires permission: `costs:read`._
-    #
-    # POST /api/org/{orgId}/business-metrics/{id}/unit-costs
-    #
-    # Raises on 400: Bad request
-    #
-    # Raises on 404: Not found
-    #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param id [String] Metric id or key
-    # @param body [Hash] Request body, shaped as `UnitCostQueryRequest`.
-    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `UnitCostQueryResponse` — see
-    #   `sig/infrawrench/sdk.rbs`.
-    # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def unit_costs(id:, body:, org_id: nil, request_options: nil)
-      @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/business-metrics/{id}/unit-costs",
-        path_params: { "orgId" => org_id, "id" => id },
-        body: body,
-        request_options: request_options
-      )
-    end
-
     # Update a business metric
     #
     # Replaces the whole definition. Changing `key` never orphans history
@@ -3910,35 +4282,6 @@ module Infrawrench
       )
     end
 
-    # Query cost per usage unit
-    #
-    # Spend divided by the usage quantity providers report in one `usageUnit`,
-    # with no business metric involved. Both halves come from the same cost rows
-    # (those reported in that unit), so the numerator is exactly the spend that
-    # bought the denominator. A bucket with no usage is a gap (`no_usage`),
-    # never 0. Labels do not apply.
-    #
-    # POST /api/org/{orgId}/business-metrics/usage-unit-costs
-    #
-    # Raises on 400: Bad request
-    #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param body [Hash] Request body, shaped as `UnitCostQueryRequest`.
-    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `UnitCostQueryResponse` — see
-    #   `sig/infrawrench/sdk.rbs`.
-    # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def usage_unit_costs(body:, org_id: nil, request_options: nil)
-      @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/business-metrics/usage-unit-costs",
-        path_params: { "orgId" => org_id },
-        body: body,
-        request_options: request_options
-      )
-    end
-
     # List usage units
     #
     # The provider usage units the organization's cost rows carry over the last
@@ -5351,7 +5694,7 @@ module Infrawrench
     #   constructed with.
     # @param sections [String, nil] Comma-separated subset of sections to export. Defaults to
     #   all of: budgets, customGraphs, workflows, dashboards, metricAlerts, probes, slos,
-    #   costCentres, tagPolicy, alertSettings.
+    #   costCentres, tagPolicy, alertSettings, savingsViews.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `OrgConfigDocument` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
@@ -6752,6 +7095,38 @@ module Infrawrench
     end
   end
 
+  # `client.cost_report_anomaly_alerts`
+  class CostReportAnomalyAlertsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List report anomaly alerts
+    #
+    # Every report anomaly alert in the organization whose report the caller can
+    # see, in report name order, each with its latest findings.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/cost-report-anomaly-alerts
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/cost-report-anomaly-alerts",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.cost_report_folders`
   class CostReportFoldersNamespace
     # @api private
@@ -6905,42 +7280,295 @@ module Infrawrench
     end
   end
 
-  # `client.cost_reports.notifications`
-  class CostReportsNotificationsNamespace
+  # `client.cost_reports.anomaly_alert`
+  class CostReportsAnomalyAlertNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Create a delivery schedule
+    # Delete a report's anomaly alert
     #
-    # On its cadence the server runs the report and sends a composed text
-    # summary; period total (converted to the org's display currency where
-    # configured, with the conversion caveat), change vs the previous period,
-    # top groups, and a deep link. No chart images. An empty result still sends,
-    # saying so.
+    # Removes the alert and its findings. The report itself is untouched.
     #
     # _Requires permission: `org:settings:write`._
     #
-    # POST /api/org/{orgId}/cost-reports/{id}/notifications
-    #
-    # Raises on 400: Bad request
+    # DELETE /api/org/{orgId}/cost-reports/{id}/anomaly-alert
     #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
-    # @param body [Hash] Request body, shaped as `ReportNotificationInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ReportNotification` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(id:, body:, org_id: nil, request_options: nil)
+    def delete(id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/cost-reports/{id}/notifications",
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/cost-reports/{id}/anomaly-alert",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a report's anomaly alert
+    #
+    # The report's own anomaly alert and its latest findings. The detector
+    # judges the report's filtered daily total (its filters and saved filter,
+    # per currency) against the trailing 28 days after each cost collection,
+    # re-judging the last three days as they fill in, and delivers a day once
+    # (then a 7-day cooldown per currency). 404 when the report has none, or
+    # when the caller cannot see the report.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/cost-reports/{id}/anomaly-alert
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostReportAnomalyAlert` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/cost-reports/{id}/anomaly-alert",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List destinations for a report anomaly alert
+    #
+    # The organization's connected Slack channels, Teams webhooks, live on-call
+    # rotations, members and external-address policy: what the destination
+    # picker offers. Paging provider targets are listed by `GET
+    # /paging-providers/destinations`.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # GET /api/org/{orgId}/cost-reports/{id}/anomaly-alert/targets
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostReportAnomalyAlertTargets` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def targets(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/cost-reports/{id}/anomaly-alert/targets",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Create or replace a report's anomaly alert
+    #
+    # One alert per report, replaced whole. Destinations must belong to this
+    # organization (a live Slack channel, a Teams webhook, a current member, an
+    # address the email policy allows). Requires `org:settings:write`, like
+    # report delivery schedules. The alert reads spend with the writer's cost
+    # visibility when they are cost-scoped.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # PUT /api/org/{orgId}/cost-reports/{id}/anomaly-alert
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `CostReportAnomalyAlertInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostReportAnomalyAlert` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/cost-reports/{id}/anomaly-alert",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.cost_reports.forecasts`
+  class CostReportsForecastsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Add a named forecast to a report
+    #
+    # A forecast combines a baseline (the trend, or a driver metric's forecasted
+    # values times the projected unit cost) with scenario models in priority
+    # order. Needs editor access to the report.
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # POST /api/org/{orgId}/cost-reports/{id}/forecasts
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `CostForecastInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostForecast` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/cost-reports/{id}/forecasts",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a named forecast
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # DELETE /api/org/{orgId}/cost-reports/{id}/forecasts/{forecastId}
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param forecast_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, forecast_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/cost-reports/{id}/forecasts/{forecastId}",
+        path_params: { "orgId" => org_id, "id" => id, "forecastId" => forecast_id },
+        request_options: request_options
+      )
+    end
+
+    # List a report's named forecasts
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/cost-reports/{id}/forecasts
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/cost-reports/{id}/forecasts",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Replace a named forecast
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # PUT /api/org/{orgId}/cost-reports/{id}/forecasts/{forecastId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param forecast_id [String]
+    # @param body [Hash] Request body, shaped as `CostForecastInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostForecast` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, forecast_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/cost-reports/{id}/forecasts/{forecastId}",
+        path_params: { "orgId" => org_id, "id" => id, "forecastId" => forecast_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.cost_reports.notifications`
+  class CostReportsNotificationsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a delivery schedule
+    #
+    # On its cadence the server runs the report and sends a composed text
+    # summary; period total (converted to the org's display currency where
+    # configured, with the conversion caveat), change vs the previous period,
+    # top groups, and a deep link. No chart images. An empty result still sends,
+    # saying so.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # POST /api/org/{orgId}/cost-reports/{id}/notifications
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `ReportNotificationInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ReportNotification` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/cost-reports/{id}/notifications",
         path_params: { "orgId" => org_id, "id" => id },
         body: body,
         request_options: request_options
@@ -7092,6 +7720,10 @@ module Infrawrench
 
   # `client.cost_reports`
   class CostReportsNamespace
+    # @return [CostReportsAnomalyAlertNamespace] `client.cost_reports.anomaly_alert`
+    attr_reader :anomaly_alert
+    # @return [CostReportsForecastsNamespace] `client.cost_reports.forecasts`
+    attr_reader :forecasts
     # @return [CostReportsNotificationsNamespace] `client.cost_reports.notifications`
     attr_reader :notifications
 
@@ -7099,6 +7731,8 @@ module Infrawrench
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
+      @anomaly_alert = CostReportsAnomalyAlertNamespace.new(@transport)
+      @forecasts = CostReportsForecastsNamespace.new(@transport)
       @notifications = CostReportsNotificationsNamespace.new(@transport)
     end
 
@@ -7189,6 +7823,41 @@ module Infrawrench
       )
     end
 
+    # Forecasted costs for a report
+    #
+    # Projected daily spend for the report's scope (its filters, saved filter,
+    # cost basis, charge types and billing rules), optionally narrowed to
+    # providers or services, with a low/expected/high band. Returns the
+    # automatic forecast and the requested one (the report's default when none
+    # is named); `all: true` adds every named forecast. Respects the caller's
+    # cost visibility scope. A read despite the method.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/cost-reports/{id}/forecasted-costs
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash, nil] Request body, shaped as `CostForecastRunRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostForecastResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def forecasted_costs(id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/cost-reports/{id}/forecasted-costs",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
     # Get a cost report
     #
     # _Requires permission: `costs:read`._
@@ -7269,8 +7938,8 @@ module Infrawrench
     # inclusive window a relative preset resolved to. The body is optional: the
     # report *is* the query, so a caller never has to reassemble its config to
     # get the numbers. It may carry one-off display overrides (`measure`,
-    # `usageUnit`, `binning`, `cumulative`) that apply to this run only and are
-    # never saved; switching a run to `usage` or `count` drops the saved
+    # `usageUnit`, `binning`, `cumulative`, `xAxis`) that apply to this run only
+    # and are never saved; switching a run to `usage` or `count` drops the saved
     # forecast, scenario and billing rules, which only apply to money.
     #
     # _Requires permission: `costs:read`._
@@ -8079,44 +8748,212 @@ module Infrawrench
     end
   end
 
-  # `client.costs`
-  class CostsNamespace
-    # @return [CostsAnomaliesNamespace] `client.costs.anomalies`
-    attr_reader :anomalies
-    # @return [CostsAnomalySettingsNamespace] `client.costs.anomaly_settings`
-    attr_reader :anomaly_settings
-    # @return [CostsAnomalySuppressionsNamespace] `client.costs.anomaly_suppressions`
-    attr_reader :anomaly_suppressions
-    # @return [CostsEfficiencyAlertSettingsNamespace] `client.costs.efficiency_alert_settings`
-    attr_reader :efficiency_alert_settings
-
+  # `client.costs.exports.jobs`
+  class CostsExportsJobsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
-      @anomalies = CostsAnomaliesNamespace.new(@transport)
-      @anomaly_settings = CostsAnomalySettingsNamespace.new(@transport)
-      @anomaly_suppressions = CostsAnomalySuppressionsNamespace.new(@transport)
-      @efficiency_alert_settings = CostsEfficiencyAlertSettingsNamespace.new(@transport)
     end
 
-    # Anomaly detection precision over time
+    # Start a background cost export
     #
-    # Per month of the anomalous day: findings detected, suppressed, and marked
-    # expected or unexpected, and precision (the share of reviewed findings that
-    # were real problems).
+    # Queues an export of a saved report (`reportId`) or an ad-hoc scope
+    # (`query`) as CSV, NDJSON or FOCUS CSV, and answers at once with the job.
+    # The file is written on the gateway in the background; poll `GET
+    # /costs/exports/jobs/{jobId}` for `progress` and download from
+    # `downloadUrl` once `status` is `succeeded`. Up to 731 days per job and 256
+    # MB per file; three queued or running jobs per person. Rows are read inside
+    # the caller's cost visibility, and what is exported is fixed when the job
+    # is created, so editing the report afterwards does not change the file.
     #
     # _Requires permission: `costs:read`._
     #
-    # GET /api/org/{orgId}/costs/anomaly-precision
+    # POST /api/org/{orgId}/costs/exports/jobs
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param months [String, nil] Months to cover, 1-24. Defaults to 6.
+    # @param body [Hash] Request body, shaped as `CostExportJobRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostAnomalyPrecisionReport` — see
+    # @return [Hash] Parsed JSON, shaped as `CostExportJob` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/costs/exports/jobs",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Cancel an export job or delete its file
+    #
+    # Cancels a queued or running job (the writer stops at its next chunk), or
+    # deletes a finished file before it expires. Answers with the job's new
+    # state.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # DELETE /api/org/{orgId}/costs/exports/jobs/{jobId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param job_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostExportJob` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(job_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/costs/exports/jobs/{jobId}",
+        path_params: { "orgId" => org_id, "jobId" => job_id },
+        request_options: request_options
+      )
+    end
+
+    # Download an export job's file
+    #
+    # The finished file, streamed. 409 while the job is still queued or running
+    # (or failed); 410 once the file has expired or been deleted.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/exports/jobs/{jobId}/download
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 410: Gone: the file expired or was deleted
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param job_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Parsed JSON, shaped as `String` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def download(job_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/exports/jobs/{jobId}/download",
+        path_params: { "orgId" => org_id, "jobId" => job_id },
+        request_options: request_options
+      )
+    end
+
+    # List your recent export jobs
+    #
+    # The caller's 20 most recent export jobs, newest first. Jobs are private to
+    # their creator.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/exports/jobs
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/exports/jobs",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get an export job's status
+    #
+    # Status, progress, row count, error and, once finished, the download path
+    # and expiry.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/exports/jobs/{jobId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param job_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostExportJob` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get_org_org_id_costs_exports_jobs_job_id(job_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/exports/jobs/{jobId}",
+        path_params: { "orgId" => org_id, "jobId" => job_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.costs.exports`
+  class CostsExportsNamespace
+    # @return [CostsExportsJobsNamespace] `client.costs.exports.jobs`
+    attr_reader :jobs
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @jobs = CostsExportsJobsNamespace.new(@transport)
+    end
+  end
+
+  # `client.costs`
+  class CostsNamespace
+    # @return [CostsAnomaliesNamespace] `client.costs.anomalies`
+    attr_reader :anomalies
+    # @return [CostsAnomalySettingsNamespace] `client.costs.anomaly_settings`
+    attr_reader :anomaly_settings
+    # @return [CostsAnomalySuppressionsNamespace] `client.costs.anomaly_suppressions`
+    attr_reader :anomaly_suppressions
+    # @return [CostsEfficiencyAlertSettingsNamespace] `client.costs.efficiency_alert_settings`
+    attr_reader :efficiency_alert_settings
+    # @return [CostsExportsNamespace] `client.costs.exports`
+    attr_reader :exports
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @anomalies = CostsAnomaliesNamespace.new(@transport)
+      @anomaly_settings = CostsAnomalySettingsNamespace.new(@transport)
+      @anomaly_suppressions = CostsAnomalySuppressionsNamespace.new(@transport)
+      @efficiency_alert_settings = CostsEfficiencyAlertSettingsNamespace.new(@transport)
+      @exports = CostsExportsNamespace.new(@transport)
+    end
+
+    # Anomaly detection precision over time
+    #
+    # Per month of the anomalous day: findings detected, suppressed, and marked
+    # expected or unexpected, and precision (the share of reviewed findings that
+    # were real problems).
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/costs/anomaly-precision
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param months [String, nil] Months to cover, 1-24. Defaults to 6.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostAnomalyPrecisionReport` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def anomaly_precision(org_id: nil, months: nil, request_options: nil)
@@ -8581,6 +9418,67 @@ module Infrawrench
       )
     end
 
+    # Upload many exchange rates from a CSV
+    #
+    # Upserts every row on (`fromCurrency`, `toCurrency`, `effectiveFrom`),
+    # exactly as the single-rate PUT does, in one transaction. Send `dryRun:
+    # true` first to see each row classified (`create`, `update`, `unchanged`,
+    # `error` with the reason); an upload with an invalid row writes nothing
+    # unless `skipInvalid` is set. Uploaded rates are ordinary stated rates:
+    # they win over the automatic feed for the days they cover, and a
+    # `billing_period` row (or an `effective_to`) hands the days after it back
+    # to the next rate or the feed. Requires `org:settings:write`; applied
+    # uploads are audit-logged as `exchange_rate.import`.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # POST /api/org/{orgId}/currency/rates/import
+    #
+    # Raises on 400: A malformed body, or a whole-file problem; the body is then
+    # the result with `fileError` and `error` set.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ExchangeRateImportRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ExchangeRateImportResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def import(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/currency/rates/import",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # CSV template for uploading exchange rates
+    #
+    # The header row `POST /currency/rates/import` reads, plus one example row
+    # per shape: an open-ended rate, a bounded override, and a `billing_period`
+    # row.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/currency/rates/template
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def template(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/currency/rates/template",
+        path_params: { "orgId" => org_id },
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+
     # Create or replace one exchange rate
     #
     # Upserts on (`fromCurrency`, `toCurrency`, `effectiveFrom`): one rate per
@@ -9268,15 +10166,82 @@ module Infrawrench
     end
   end
 
+  # `client.dashboards.default.me`
+  class DashboardsDefaultMeNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Clear my default dashboard
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # DELETE /api/org/{orgId}/dashboards/default/me
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DefaultDashboardResolution` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/dashboards/default/me",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Set my default dashboard
+    #
+    # Overrides the role and organization defaults for the caller in this
+    # organization. The dashboard must be one the caller can open.
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # PUT /api/org/{orgId}/dashboards/default/me
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SetDefaultDashboardRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DefaultDashboardResolution` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/dashboards/default/me",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.dashboards.default`
   class DashboardsDefaultNamespace
+    # @return [DashboardsDefaultMeNamespace] `client.dashboards.default.me`
+    attr_reader :me
+
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
+      @me = DashboardsDefaultMeNamespace.new(@transport)
     end
 
-    # Get-or-create the default dashboard with its pins
+    # Get the caller's default dashboard with its pins
+    #
+    # The dashboard `GET /dashboards/default` resolves to, with its cards. The
+    # organization default is created as `Home` on first read.
     #
     # _Requires permission: `dashboards:read`._
     #
@@ -9295,6 +10260,32 @@ module Infrawrench
         request_options: request_options
       )
     end
+
+    # Which dashboard the caller lands on, and why
+    #
+    # Resolves the caller's default dashboard: their own default, else the
+    # default set for their role, else the organization default (created as
+    # `Home` on first read). A layer whose dashboard is no longer shared with
+    # the caller is skipped and listed in `skipped`.
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/dashboards/default
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DefaultDashboardResolution` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards/default",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
   end
 
   # `client.dashboards.notifications`
@@ -9561,50 +10552,139 @@ module Infrawrench
     end
   end
 
-  # `client.dashboards.widgets`
-  class DashboardsWidgetsNamespace
+  # `client.dashboards.role_defaults`
+  class DashboardsRoleDefaultsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Add a cost-graph or budget widget to a dashboard
+    # Clear a role's default dashboard
     #
-    # POST /api/org/{orgId}/dashboards/widgets
+    # _Requires permission: `org:settings:write`._
     #
-    # Raises on 400: Bad request
+    # DELETE /api/org/{orgId}/dashboards/role-defaults/{roleId}
     #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CreateWidgetRequest`.
+    # @param role_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `DashboardWidgetFull` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(body:, org_id: nil, request_options: nil)
+    def delete(role_id:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/dashboards/widgets",
-        path_params: { "orgId" => org_id },
-        body: body,
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/dashboards/role-defaults/{roleId}",
+        path_params: { "orgId" => org_id, "roleId" => role_id },
         request_options: request_options
       )
     end
 
-    # Remove a widget from a dashboard
+    # List each role's default dashboard
     #
-    # DELETE /api/org/{orgId}/dashboards/widgets/{widgetId}
+    # _Requires permission: `team:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/dashboards/role-defaults
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param widget_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<RoleDefaultDashboard>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards/role-defaults",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Set a role's default dashboard
+    #
+    # Members holding the role land on this dashboard unless they picked their
+    # own. Refused with 422 when the role lacks `dashboards:read` or the
+    # dashboard is not shared with the role (org-wide or by a role grant). Works
+    # for system and custom roles. Needs `org:settings:write` (not
+    # `team:role:write`), so an API key can manage it.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # PUT /api/org/{orgId}/dashboards/role-defaults/{roleId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 422: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param role_id [String]
+    # @param body [Hash] Request body, shaped as `SetDefaultDashboardRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `RoleDefaultDashboard` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(role_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/dashboards/role-defaults/{roleId}",
+        path_params: { "orgId" => org_id, "roleId" => role_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.dashboards.widgets`
+  class DashboardsWidgetsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Add a widget (cost graph, report, budget, KPI, text, ...) to a dashboard
+    #
+    # POST /api/org/{orgId}/dashboards/widgets
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateWidgetRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardWidgetFull` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/widgets",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Remove a widget from a dashboard
+    #
+    # DELETE /api/org/{orgId}/dashboards/widgets/{widgetId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param widget_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def delete(widget_id:, org_id: nil, request_options: nil)
       @transport.request(
@@ -9615,6 +10695,35 @@ module Infrawrench
       )
     end
 
+    # Copy a widget in place
+    #
+    # Inserts a copy with the same kind, config and size directly after the
+    # original, moving every card behind it one slot along. A copy of a budget
+    # or report card is a second view onto the same budget or report.
+    # Audit-logged.
+    #
+    # POST /api/org/{orgId}/dashboards/widgets/{widgetId}/duplicate
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param widget_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardWidgetFull` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def duplicate(widget_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/widgets/{widgetId}/duplicate",
+        path_params: { "orgId" => org_id, "widgetId" => widget_id },
+        request_options: request_options
+      )
+    end
+
     # Update a widget's title, config, or layout
     #
     # PATCH /api/org/{orgId}/dashboards/widgets/{widgetId}
@@ -9650,6 +10759,8 @@ module Infrawrench
     attr_reader :notifications
     # @return [DashboardsPinNamespace] `client.dashboards.pin`
     attr_reader :pin
+    # @return [DashboardsRoleDefaultsNamespace] `client.dashboards.role_defaults`
+    attr_reader :role_defaults
     # @return [DashboardsWidgetsNamespace] `client.dashboards.widgets`
     attr_reader :widgets
 
@@ -9660,6 +10771,7 @@ module Infrawrench
       @default = DashboardsDefaultNamespace.new(@transport)
       @notifications = DashboardsNotificationsNamespace.new(@transport)
       @pin = DashboardsPinNamespace.new(@transport)
+      @role_defaults = DashboardsRoleDefaultsNamespace.new(@transport)
       @widgets = DashboardsWidgetsNamespace.new(@transport)
     end
 
@@ -9735,6 +10847,37 @@ module Infrawrench
       )
     end
 
+    # Evaluate a KPI widget config
+    #
+    # Answers one KPI config: a saved card posts its own, an editor posts one to
+    # preview it. Needs `costs:read`, plus `budgets:read` for a budget source;
+    # figures are measured inside the caller's cost visibility scope.
+    #
+    # POST /api/org/{orgId}/dashboards/kpi
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `DashboardKpiRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardKpiResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def kpi(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/kpi",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
     # List dashboards
     #
     # _Requires permission: `dashboards:read`._
@@ -11965,6 +13108,74 @@ module Infrawrench
     end
   end
 
+  # `client.github_issues.links`
+  class GithubIssuesLinksNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Look up filed GitHub issues for a set of findings
+    #
+    # _Requires permission: `github-issues:read`._
+    #
+    # GET /api/org/{orgId}/github-issues/links
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param source_kind [String, nil]
+    # @param state [String, nil]
+    # @param source_id [Array<String>, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<GithubIssueLink>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, source_kind: nil, state: nil, source_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/github-issues/links",
+        path_params: { "orgId" => org_id },
+        query: { "sourceKind" => source_kind, "state" => state, "sourceId" => source_id },
+        request_options: request_options
+      )
+    end
+
+    # Refresh the status of filed GitHub issues now
+    #
+    # Reads up to 200 of the org's filed issues from GitHub (least recently
+    # checked first) instead of waiting for the App's webhook or the poll. An
+    # issue GitHub no longer has is recorded as deleted.
+    #
+    # _Requires permission: `github-issues:read`._
+    #
+    # POST /api/org/{orgId}/github-issues/links/refresh
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 409: The GitHub App installation needs a permission an owner has
+    # not approved yet
+    #
+    # Raises on 502: GitHub refused the request or was unreachable
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `IssueStatusRefreshResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def refresh(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/github-issues/links/refresh",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.github_issues.pull_requests`
   class GithubIssuesPullRequestsNamespace
     # @api private
@@ -12042,6 +13253,8 @@ module Infrawrench
 
   # `client.github_issues`
   class GithubIssuesNamespace
+    # @return [GithubIssuesLinksNamespace] `client.github_issues.links`
+    attr_reader :links
     # @return [GithubIssuesPullRequestsNamespace] `client.github_issues.pull_requests`
     attr_reader :pull_requests
 
@@ -12049,6 +13262,7 @@ module Infrawrench
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
+      @links = GithubIssuesLinksNamespace.new(@transport)
       @pull_requests = GithubIssuesPullRequestsNamespace.new(@transport)
     end
 
@@ -12206,33 +13420,6 @@ module Infrawrench
       )
     end
 
-    # Look up filed GitHub issues for a set of findings
-    #
-    # _Requires permission: `github-issues:read`._
-    #
-    # GET /api/org/{orgId}/github-issues/links
-    #
-    # Raises on 400: Bad request
-    #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param source_kind [String, nil]
-    # @param state [String, nil]
-    # @param source_id [Array<String>, nil]
-    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<GithubIssueLink>` — see
-    #   `sig/infrawrench/sdk.rbs`.
-    # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def links(org_id: nil, source_kind: nil, state: nil, source_id: nil, request_options: nil)
-      @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/github-issues/links",
-        path_params: { "orgId" => org_id },
-        query: { "sourceKind" => source_kind, "state" => state, "sourceId" => source_id },
-        request_options: request_options
-      )
-    end
-
     # Resolve where a finding would be filed
     #
     # _Requires permission: `github-issues:read`._
@@ -12471,92 +13658,219 @@ module Infrawrench
     end
   end
 
-  # `client.incidents.get`
-  class IncidentsGetNamespace
+  # `client.idle_findings.settings`
+  class IdleFindingsSettingsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # List declared incidents
+    # Get the organization's idle-rule settings
     #
-    # Every incident the organization has declared, newest first, each with the
-    # artefacts its declaration created: including the ones that failed.
+    # An organization that never saved reads the shipped defaults (enabled, 14
+    # days).
     #
-    # _Requires permission: `incidents:read`._
+    # _Requires permission: `org:settings:write`._
     #
-    # GET /api/org/{orgId}/incidents
+    # GET /api/org/{orgId}/idle-findings/settings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param status [String, nil] `open`, `mitigated`, `resolved`, or `all` (the default).
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `IncidentList` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `IdleFindingSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, status: nil, request_options: nil)
+    def get(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/incidents",
+        path: "/api/org/{orgId}/idle-findings/settings",
         path_params: { "orgId" => org_id },
-        query: { "status" => status },
         request_options: request_options
       )
     end
 
-    # Read one incident
+    # Update the idle-rule settings
     #
-    # The incident with its artefacts and its operator notes.
+    # Every field is optional. `lookbackDays` must be a whole number from 7 to
+    # 42; an unknown rule or threshold key, or a threshold outside its declared
+    # range, is rejected rather than clamped. Any change makes every account due
+    # for a fresh collection.
     #
-    # _Requires permission: `incidents:read`._
+    # _Requires permission: `org:settings:write`._
     #
-    # GET /api/org/{orgId}/incidents/{incidentId}
+    # PUT /api/org/{orgId}/idle-findings/settings
     #
-    # Raises on 404: Not found
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param incident_id [String]
+    # @param body [Hash, nil] Request body, shaped as `IdleFindingSettingsUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `IncidentDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `IdleFindingSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get_org_org_id_incidents_incident_id(incident_id:, org_id: nil, request_options: nil)
+    def update(org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/incidents/{incidentId}",
-        path_params: { "orgId" => org_id, "incidentId" => incident_id },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/idle-findings/settings",
+        path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
   end
 
-  # `client.incidents.notes`
-  class IncidentsNotesNamespace
+  # `client.idle_findings`
+  class IdleFindingsNamespace
+    # @return [IdleFindingsSettingsNamespace] `client.idle_findings.settings`
+    attr_reader :settings
+
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
+      @settings = IdleFindingsSettingsNamespace.new(@transport)
     end
 
-    # Add an operator note
-    #
-    # The running commentary no join can reconstruct. `occurredAt` may be
-    # backdated so a note typed at 04:00 lands on the timeline where it belongs.
-    #
-    # _Requires permission: `incidents:write`._
+    # Idle rules, their settings and collection status
     #
-    # POST /api/org/{orgId}/incidents/{incidentId}/notes
+    # Every metric-based idle rule the loaded plugins declare (idle NAT
+    # gateways, load balancers, caches, provisioned tables, clusters, unused
+    # custom metrics), with the organization's effective thresholds, plus each
+    # account's last collection and error. The findings themselves are rows of
+    # `GET /orphans` with `idle` set.
     #
-    # Raises on 400: Bad request
+    # _Requires permission: `resources:read`._
     #
-    # Raises on 404: Not found
+    # GET /api/org/{orgId}/idle-findings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param incident_id [String]
-    # @param body [Hash, nil] Request body, shaped as `IncidentNoteCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `IncidentNote` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `IdleFindingsOverview` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/idle-findings",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Re-scan idle rules now
+    #
+    # Makes every account due for an idle collection on the next poller tick.
+    # The reads are billed to the organization's own cloud accounts (CloudWatch
+    # GetMetricData and the like).
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # POST /api/org/{orgId}/idle-findings/rescan
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def rescan(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/idle-findings/rescan",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.incidents.get`
+  class IncidentsGetNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List declared incidents
+    #
+    # Every incident the organization has declared, newest first, each with the
+    # artefacts its declaration created: including the ones that failed.
+    #
+    # _Requires permission: `incidents:read`._
+    #
+    # GET /api/org/{orgId}/incidents
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param status [String, nil] `open`, `mitigated`, `resolved`, or `all` (the default).
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `IncidentList` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, status: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/incidents",
+        path_params: { "orgId" => org_id },
+        query: { "status" => status },
+        request_options: request_options
+      )
+    end
+
+    # Read one incident
+    #
+    # The incident with its artefacts and its operator notes.
+    #
+    # _Requires permission: `incidents:read`._
+    #
+    # GET /api/org/{orgId}/incidents/{incidentId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param incident_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `IncidentDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get_org_org_id_incidents_incident_id(incident_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/incidents/{incidentId}",
+        path_params: { "orgId" => org_id, "incidentId" => incident_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.incidents.notes`
+  class IncidentsNotesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Add an operator note
+    #
+    # The running commentary no join can reconstruct. `occurredAt` may be
+    # backdated so a note typed at 04:00 lands on the timeline where it belongs.
+    #
+    # _Requires permission: `incidents:write`._
+    #
+    # POST /api/org/{orgId}/incidents/{incidentId}/notes
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param incident_id [String]
+    # @param body [Hash, nil] Request body, shaped as `IncidentNoteCreate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `IncidentNote` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def create(incident_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
@@ -13060,11 +14374,40 @@ module Infrawrench
       )
     end
 
+    # Download an invoice as PDF
+    #
+    # The document a customer files: addressee, lines, tax, total, due date and
+    # remittance details, from the billing block frozen at approval. A draft is
+    # watermarked. The collected-versus-adjusted derivation stays in the CSV.
+    #
+    # _Requires permission: `invoices:read`._
+    #
+    # GET /api/org/{orgId}/invoices/{id}/pdf
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def pdf(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/invoices/{id}/pdf",
+        path_params: { "orgId" => org_id, "id" => id },
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+
     # Send an invoice to its customer
     #
     # Changes no figure; the document was frozen at approval. It records the
     # **release** (this may go to the customer, and this person said so), then
-    # emails the invoice to the customer's contact addresses with the CSV
+    # emails the invoice to the customer's contact addresses and its billing
+    # profile's To and Cc, as frozen at approval, with the PDF and the CSV
     # attached.
     #
     # **200 even when delivery failed.** The release happened and is recorded
@@ -13177,182 +14520,416 @@ module Infrawrench
     end
   end
 
-  # `client.jira.projects`
-  class JiraProjectsNamespace
+  # `client.issue_webhooks.jira`
+  class IssueWebhooksJiraNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # List issue types valid in a project
+    # Inbound Jira webhook for issue status
     #
-    # Reads the project's own create metadata rather than the global issue-type
-    # list, so the picker cannot offer a type the project's scheme would reject.
-    # Subtasks are excluded.
+    # Called by Jira, not by clients. The token in the path picks the
+    # organization; `X-Hub-Signature: sha256=<hex>`, an HMAC of the raw body
+    # with the stored secret, authenticates the delivery. Handles
+    # `jira:issue_updated` and `jira:issue_deleted`.
     #
-    # _Requires permission: `jira:read`._
+    # POST /api/issue-webhooks/jira/{token}
     #
-    # GET /api/org/{orgId}/jira/projects/{key}/issue-types
+    # Raises on 401: The signature did not verify
     #
-    # Raises on 400: Bad request
+    # Raises on 404: Unknown token, or (GitHub) no webhook secret configured on
+    # the server
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param key [String]
+    # Raises on 500: Processing failed; the tracker retries
+    #
+    # @param token [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraIssueType>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def issue_types(key:, org_id: nil, request_options: nil)
+    def create(token:, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/jira/projects/{key}/issue-types",
-        path_params: { "orgId" => org_id, "key" => key },
+        http_method: "POST",
+        path: "/api/issue-webhooks/jira/{token}",
+        path_params: { "token" => token },
+        accept: :empty,
         request_options: request_options
       )
     end
+  end
 
-    # List Jira projects
+  # `client.issue_webhooks.linear`
+  class IssueWebhooksLinearNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Inbound Linear webhook for issue status
     #
-    # Backs the project picker, so nobody has to know a project key by hand.
+    # Called by Linear, not by clients. The token in the path picks the
+    # organization; `Linear-Signature` (hex HMAC-SHA256 of the raw body)
+    # authenticates the delivery, and `webhookTimestamp` must be within a
+    # minute. Handles `Issue` create, update and remove.
     #
-    # _Requires permission: `jira:read`._
+    # POST /api/issue-webhooks/linear/{token}
     #
-    # GET /api/org/{orgId}/jira/projects
+    # Raises on 401: The signature did not verify
     #
-    # Raises on 400: Bad request
+    # Raises on 404: Unknown token, or (GitHub) no webhook secret configured on
+    # the server
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
+    # Raises on 500: Processing failed; the tracker retries
+    #
+    # @param token [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraProject>` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def list(org_id: nil, request_options: nil)
+    def create(token:, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/jira/projects",
-        path_params: { "orgId" => org_id },
+        http_method: "POST",
+        path: "/api/issue-webhooks/linear/{token}",
+        path_params: { "token" => token },
+        accept: :empty,
         request_options: request_options
       )
     end
   end
 
-  # `client.jira`
-  class JiraNamespace
-    # @return [JiraProjectsNamespace] `client.jira.projects`
-    attr_reader :projects
+  # `client.issue_webhooks`
+  class IssueWebhooksNamespace
+    # @return [IssueWebhooksJiraNamespace] `client.issue_webhooks.jira`
+    attr_reader :jira
+    # @return [IssueWebhooksLinearNamespace] `client.issue_webhooks.linear`
+    attr_reader :linear
 
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
-      @projects = JiraProjectsNamespace.new(@transport)
+      @jira = IssueWebhooksJiraNamespace.new(@transport)
+      @linear = IssueWebhooksLinearNamespace.new(@transport)
     end
 
-    # Disconnect Jira
+    # Inbound GitHub App webhook for issue status
     #
-    # Issue links already recorded are kept, so filed findings stay marked as
-    # filed.
+    # The GitHub App's webhook URL. `X-Hub-Signature-256` is verified with the
+    # server's `GITHUB_APP_WEBHOOK_SECRET`; `issues` events update the status of
+    # filed issues and `ping` is acknowledged. Every other event is ignored.
     #
-    # _Requires permission: `jira:write`._
+    # POST /api/issue-webhooks/github
     #
-    # DELETE /api/org/{orgId}/jira
+    # Raises on 401: The signature did not verify
     #
-    # Raises on 404: Not found
+    # Raises on 404: Unknown token, or (GitHub) no webhook secret configured on
+    # the server
+    #
+    # Raises on 500: Processing failed; the tracker retries
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [nil] This endpoint returns no content.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(org_id: nil, request_options: nil)
+    def github(request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/jira",
-        path_params: { "orgId" => org_id },
+        http_method: "POST",
+        path: "/api/issue-webhooks/github",
+        accept: :empty,
         request_options: request_options
       )
     end
+  end
 
-    # Get the org's Jira connection
-    #
-    # The stored API token is never returned; `tokenHint` stands in for it.
+  # `client.jira.links`
+  class JiraLinksNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Look up filed issues for a set of findings
     #
     # _Requires permission: `jira:read`._
     #
-    # GET /api/org/{orgId}/jira
+    # GET /api/org/{orgId}/jira/links
+    #
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param source_kind [String, nil]
+    # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
+    #   return every link of the kind; this is the batch lookup a list view makes once instead of
+    #   one request per row.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraIssueLink>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def list(org_id: nil, source_kind: nil, source_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/jira",
+        path: "/api/org/{orgId}/jira/links",
         path_params: { "orgId" => org_id },
+        query: { "sourceKind" => source_kind, "sourceId" => source_id },
         request_options: request_options
       )
     end
 
-    # File a finding as a Jira issue
+    # Refresh the status of filed Jira issues now
     #
-    # Creates the issue, then records the link between it and the finding. The
-    # link is what lets a list view show "already filed" instead of offering the
-    # button again.
+    # Reads up to 200 of the org's filed issues from Jira (least recently
+    # checked first) instead of waiting for a webhook or the poll.
     #
-    # _Requires permission: `jira:write`._
+    # _Requires permission: `jira:read`._
     #
-    # POST /api/org/{orgId}/jira/issues
+    # POST /api/org/{orgId}/jira/links/refresh
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Jira refused to create the issue, or was unreachable
+    # Raises on 502: Jira refused or was unreachable
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CreateJiraIssueInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CreateJiraIssueResult` — see
+    # @return [Hash] Parsed JSON, shaped as `IssueStatusRefreshResult` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def issues(body:, org_id: nil, request_options: nil)
+    def refresh(org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/jira/issues",
+        path: "/api/org/{orgId}/jira/links/refresh",
         path_params: { "orgId" => org_id },
-        body: body,
         request_options: request_options
       )
     end
+  end
 
-    # Look up filed issues for a set of findings
-    #
+  # `client.jira.projects`
+  class JiraProjectsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List issue types valid in a project
+    #
+    # Reads the project's own create metadata rather than the global issue-type
+    # list, so the picker cannot offer a type the project's scheme would reject.
+    # Subtasks are excluded.
+    #
     # _Requires permission: `jira:read`._
     #
-    # GET /api/org/{orgId}/jira/links
+    # GET /api/org/{orgId}/jira/projects/{key}/issue-types
     #
     # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param source_kind [String, nil]
-    # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
-    #   return every link of the kind; this is the batch lookup a list view makes once instead of
-    #   one request per row.
+    # @param key [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraIssueLink>` — see
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraIssueType>` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def links(org_id: nil, source_kind: nil, source_id: nil, request_options: nil)
+    def issue_types(key:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
-        path: "/api/org/{orgId}/jira/links",
+        path: "/api/org/{orgId}/jira/projects/{key}/issue-types",
+        path_params: { "orgId" => org_id, "key" => key },
+        request_options: request_options
+      )
+    end
+
+    # List Jira projects
+    #
+    # Backs the project picker, so nobody has to know a project key by hand.
+    #
+    # _Requires permission: `jira:read`._
+    #
+    # GET /api/org/{orgId}/jira/projects
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JiraProject>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/jira/projects",
         path_params: { "orgId" => org_id },
-        query: { "sourceKind" => source_kind, "sourceId" => source_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.jira.webhook`
+  class JiraWebhookNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Set up the issue status webhook
+    #
+    # `auto` (the default) registers a webhook in Jira for `jira:issue_updated`
+    # and `jira:issue_deleted` through the stored account, which Jira allows for
+    # administrators only. When Jira refuses, the reply falls back to manual and
+    # carries the URL and a one-time `secret` for an administrator to paste into
+    # Jira's webhook form. `manual` skips the attempt. Replaces any webhook set
+    # up before.
+    #
+    # _Requires permission: `jira:write`._
+    #
+    # POST /api/org/{orgId}/jira/webhook
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 502: Jira refused or was unreachable
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `JiraWebhookInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `IssueWebhookSetupResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/jira/webhook",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Remove the issue status webhook
+    #
+    # Deletes the webhook in Jira when Infrawrench registered it. Statuses keep
+    # refreshing through the poll.
+    #
+    # _Requires permission: `jira:write`._
+    #
+    # DELETE /api/org/{orgId}/jira/webhook
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 502: Jira refused or was unreachable
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/jira/webhook",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.jira`
+  class JiraNamespace
+    # @return [JiraLinksNamespace] `client.jira.links`
+    attr_reader :links
+    # @return [JiraProjectsNamespace] `client.jira.projects`
+    attr_reader :projects
+    # @return [JiraWebhookNamespace] `client.jira.webhook`
+    attr_reader :webhook
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @links = JiraLinksNamespace.new(@transport)
+      @projects = JiraProjectsNamespace.new(@transport)
+      @webhook = JiraWebhookNamespace.new(@transport)
+    end
+
+    # Disconnect Jira
+    #
+    # Issue links already recorded are kept, so filed findings stay marked as
+    # filed.
+    #
+    # _Requires permission: `jira:write`._
+    #
+    # DELETE /api/org/{orgId}/jira
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/jira",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get the org's Jira connection
+    #
+    # The stored API token is never returned; `tokenHint` stands in for it.
+    #
+    # _Requires permission: `jira:read`._
+    #
+    # GET /api/org/{orgId}/jira
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/jira",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # File a finding as a Jira issue
+    #
+    # Creates the issue, then records the link between it and the finding. The
+    # link is what lets a list view show "already filed" instead of offering the
+    # button again.
+    #
+    # _Requires permission: `jira:write`._
+    #
+    # POST /api/org/{orgId}/jira/issues
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 502: Jira refused to create the issue, or was unreachable
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateJiraIssueInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CreateJiraIssueResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def issues(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/jira/issues",
+        path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
@@ -13962,91 +15539,357 @@ module Infrawrench
     end
   end
 
-  # `client.kv`
-  class KvNamespace
+  # `client.k8s_efficiency_reports`
+  class K8sEfficiencyReportsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Run a Redis-style KV command
+    # Create a Kubernetes efficiency report
     #
-    # _Requires permission: `resources:execute`._
+    # _Requires permission: `costs:write`._
     #
-    # POST /api/org/{orgId}/kv/command
+    # POST /api/org/{orgId}/k8s-efficiency-reports
     #
     # Raises on 400: Bad request
     #
-    # Raises on 404: Not found
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
+    # @param body [Hash] Request body, shaped as `KubernetesEfficiencyReportInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesEfficiencyReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def command(body:, org_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/kv/command",
+        path: "/api/org/{orgId}/k8s-efficiency-reports",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
-  end
 
-  # `client.leaked_secrets`
-  class LeakedSecretsNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
+    # Delete a Kubernetes efficiency report
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # DELETE /api/org/{orgId}/k8s-efficiency-reports/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
     end
 
-    # Dismiss a leaked credential
+    # Export a Kubernetes efficiency report
     #
-    # Accept the finding as not a risk. Closes it upstream with the matching
-    # reason unless `resolveUpstream` is false.
+    # One record per row and cost category plus the totals; with `perPeriod`,
+    # each row's figures per period as well. CSV (RFC 4180) or newline-delimited
+    # JSON.
     #
-    # _Requires permission: `secrets:write`._
+    # _Requires permission: `costs:read`._
     #
-    # POST /api/org/{orgId}/leaked-secrets/{id}/dismiss
+    # GET /api/org/{orgId}/k8s-efficiency-reports/{id}/export
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Conflict
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
-    # @param body [Hash, nil] Request body, shaped as `LeakedSecretDismiss`.
+    # @param format [String, nil]
+    # @param per_period [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LeakedSecretResponse` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [String] Parsed JSON, shaped as `String` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def dismiss(id:, org_id: nil, body: nil, request_options: nil)
+    def export(id:, org_id: nil, format: nil, per_period: nil, request_options: nil)
       @transport.request(
-        http_method: "POST",
-        path: "/api/org/{orgId}/leaked-secrets/{id}/dismiss",
+        http_method: "GET",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/{id}/export",
         path_params: { "orgId" => org_id, "id" => id },
-        body: body,
+        query: { "format" => format, "perPeriod" => per_period },
         request_options: request_options
       )
     end
 
-    # List leaked credentials
+    # Get a Kubernetes efficiency report
     #
-    # Secrets a scanner account (GitHub secret scanning, GitLab secret
-    # detection) found committed to code, attributed to the account or stored
-    # secret they belong to. Read from the last scan; no provider call is made.
+    # _Requires permission: `costs:read`._
     #
-    # _Requires permission: `resources:read`._
+    # GET /api/org/{orgId}/k8s-efficiency-reports/{id}
     #
-    # GET /api/org/{orgId}/leaked-secrets
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesEfficiencyReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List Kubernetes efficiency reports
+    #
+    # The reports the caller's sharing lets them open, alphabetically.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/k8s-efficiency-reports
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<KubernetesEfficiencyReport>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/k8s-efficiency-reports",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Picker options for Kubernetes efficiency reports
+    #
+    # Clusters, regions, namespaces, node pools and label keys present on the
+    # org's Kubernetes cost rows, narrowed to the caller's cost visibility
+    # scope.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/k8s-efficiency-reports/options
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesEfficiencyOptions` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def options(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/options",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Run an unsaved Kubernetes efficiency report config
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/k8s-efficiency-reports/query
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesEfficiencyResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def query(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/query",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Run a Kubernetes efficiency report
+    #
+    # Per row and in total: total, used, requested-but-unused, unmeasured, idle
+    # and overhead cost, efficiency on the report's basis, a per-category
+    # breakdown and a per-period series.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/k8s-efficiency-reports/{id}/run
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesEfficiencyRunResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def run(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/{id}/run",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Replace a Kubernetes efficiency report
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # PUT /api/org/{orgId}/k8s-efficiency-reports/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `KubernetesEfficiencyReportInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KubernetesEfficiencyReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Values of one label on Kubernetes cost rows
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/k8s-efficiency-reports/values
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param tag_key [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def values(tag_key:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/k8s-efficiency-reports/values",
+        path_params: { "orgId" => org_id },
+        query: { "tagKey" => tag_key },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.kv`
+  class KvNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run a Redis-style KV command
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/kv/command
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def command(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/kv/command",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.leaked_secrets`
+  class LeakedSecretsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Dismiss a leaked credential
+    #
+    # Accept the finding as not a risk. Closes it upstream with the matching
+    # reason unless `resolveUpstream` is false.
+    #
+    # _Requires permission: `secrets:write`._
+    #
+    # POST /api/org/{orgId}/leaked-secrets/{id}/dismiss
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash, nil] Request body, shaped as `LeakedSecretDismiss`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `LeakedSecretResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def dismiss(id:, org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/leaked-secrets/{id}/dismiss",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List leaked credentials
+    #
+    # Secrets a scanner account (GitHub secret scanning, GitLab secret
+    # detection) found committed to code, attributed to the account or stored
+    # secret they belong to. Read from the last scan; no provider call is made.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/leaked-secrets
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -14375,116 +16218,255 @@ module Infrawrench
     end
   end
 
-  # `client.linear`
-  class LinearNamespace
+  # `client.linear.links`
+  class LinearLinksNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Disconnect Linear
-    #
-    # Issue links already recorded are kept, so filed findings stay marked as
-    # filed.
+    # Look up filed issues for a set of findings
     #
-    # _Requires permission: `linear:write`._
+    # _Requires permission: `linear:read`._
     #
-    # DELETE /api/org/{orgId}/linear
+    # GET /api/org/{orgId}/linear/links
     #
-    # Raises on 404: Not found
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param source_kind [String, nil]
+    # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
+    #   return every link of the kind; this is the batch lookup a list view makes once instead of
+    #   one request per row.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearIssueLink>` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def delete(org_id: nil, request_options: nil)
+    def list(org_id: nil, source_kind: nil, source_id: nil, request_options: nil)
       @transport.request(
-        http_method: "DELETE",
-        path: "/api/org/{orgId}/linear",
+        http_method: "GET",
+        path: "/api/org/{orgId}/linear/links",
         path_params: { "orgId" => org_id },
+        query: { "sourceKind" => source_kind, "sourceId" => source_id },
         request_options: request_options
       )
     end
 
-    # Get the org's Linear connection
+    # Refresh the status of filed Linear issues now
     #
-    # The stored API key is never returned; `keyHint` stands in for it.
+    # Reads up to 200 of the org's filed issues from Linear (least recently
+    # checked first) instead of waiting for a webhook or the poll.
     #
     # _Requires permission: `linear:read`._
     #
-    # GET /api/org/{orgId}/linear
+    # POST /api/org/{orgId}/linear/links/refresh
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 502: Linear refused or was unreachable
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `IssueStatusRefreshResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def refresh(org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/linear",
+        http_method: "POST",
+        path: "/api/org/{orgId}/linear/links/refresh",
         path_params: { "orgId" => org_id },
         request_options: request_options
       )
     end
+  end
 
-    # File a finding as a Linear issue
+  # `client.linear.webhook`
+  class LinearWebhookNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Set up the issue status webhook
     #
-    # Creates the issue via the issueCreate mutation, then records the link
-    # between it and the finding. The link is what lets a list view show
-    # "already filed" instead of offering the button again.
+    # `auto` creates a webhook in Linear for `Issue` events on all public teams,
+    # signed with a secret Infrawrench generates (Linear allows this for
+    # workspace admins only). `manual` records a webhook somebody created in
+    # Linear's settings at the URL from `POST /linear/webhook/url`, with the
+    # signing secret Linear showed them. Replaces any webhook set up before.
     #
     # _Requires permission: `linear:write`._
     #
-    # POST /api/org/{orgId}/linear/issues
+    # POST /api/org/{orgId}/linear/webhook
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Linear refused to create the issue, or was unreachable
+    # Raises on 502: Linear refused or was unreachable
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CreateLinearIssueInput`.
+    # @param body [Hash] Request body, shaped as `LinearWebhookInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CreateLinearIssueResult` — see
+    # @return [Hash] Parsed JSON, shaped as `IssueWebhookSetupResult` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def issues(body:, org_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
-        path: "/api/org/{orgId}/linear/issues",
+        path: "/api/org/{orgId}/linear/webhook",
         path_params: { "orgId" => org_id },
         body: body,
         request_options: request_options
       )
     end
 
-    # Look up filed issues for a set of findings
+    # Remove the issue status webhook
+    #
+    # Deletes the webhook in Linear when Infrawrench created it. Statuses keep
+    # refreshing through the poll.
+    #
+    # _Requires permission: `linear:write`._
+    #
+    # DELETE /api/org/{orgId}/linear/webhook
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 502: Linear refused or was unreachable
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/linear/webhook",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get the receiver URL for a hand-made Linear webhook
+    #
+    # Linear shows a webhook's signing secret only after it exists, so the URL
+    # comes first; record the secret afterwards with `POST /linear/webhook` in
+    # `manual` mode.
+    #
+    # _Requires permission: `linear:write`._
+    #
+    # POST /api/org/{orgId}/linear/webhook/url
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def url(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/linear/webhook/url",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.linear`
+  class LinearNamespace
+    # @return [LinearLinksNamespace] `client.linear.links`
+    attr_reader :links
+    # @return [LinearWebhookNamespace] `client.linear.webhook`
+    attr_reader :webhook
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @links = LinearLinksNamespace.new(@transport)
+      @webhook = LinearWebhookNamespace.new(@transport)
+    end
+
+    # Disconnect Linear
+    #
+    # Issue links already recorded are kept, so filed findings stay marked as
+    # filed.
+    #
+    # _Requires permission: `linear:write`._
+    #
+    # DELETE /api/org/{orgId}/linear
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/linear",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get the org's Linear connection
+    #
+    # The stored API key is never returned; `keyHint` stands in for it.
     #
     # _Requires permission: `linear:read`._
     #
-    # GET /api/org/{orgId}/linear/links
+    # GET /api/org/{orgId}/linear
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/linear",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # File a finding as a Linear issue
+    #
+    # Creates the issue via the issueCreate mutation, then records the link
+    # between it and the finding. The link is what lets a list view show
+    # "already filed" instead of offering the button again.
+    #
+    # _Requires permission: `linear:write`._
+    #
+    # POST /api/org/{orgId}/linear/issues
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Linear refused to create the issue, or was unreachable
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param source_kind [String, nil]
-    # @param source_id [Array<String>, nil] Repeat to narrow to specific findings. Omit to
-    #   return every link of the kind; this is the batch lookup a list view makes once instead of
-    #   one request per row.
+    # @param body [Hash] Request body, shaped as `CreateLinearIssueInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<LinearIssueLink>` — see
+    # @return [Hash] Parsed JSON, shaped as `CreateLinearIssueResult` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def links(org_id: nil, source_kind: nil, source_id: nil, request_options: nil)
+    def issues(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/linear/links",
+        http_method: "POST",
+        path: "/api/org/{orgId}/linear/issues",
         path_params: { "orgId" => org_id },
-        query: { "sourceKind" => source_kind, "sourceId" => source_id },
+        body: body,
         request_options: request_options
       )
     end
@@ -14730,12 +16712,83 @@ module Infrawrench
     end
   end
 
+  # `client.managed_accounts.assignments`
+  class ManagedAccountsAssignmentsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Assign cost centres and accounts to a customer in bulk
+    #
+    # Takes each item off whichever customer holds it and gives it to
+    # `managedAccountId`, or to nobody when that is null, in one transaction.
+    # Only drafts change: an approved invoice carries its own copy of its scope.
+    #
+    # _Requires permission: `invoices:write`._
+    #
+    # POST /api/org/{orgId}/managed-accounts/assignments
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ManagedAccountAssignment`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ManagedAccountAssignmentResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/managed-accounts/assignments",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Preview a bulk assignment
+    #
+    # What moving these cost centres and accounts would do: who holds each one
+    # today, the spend that moves with it in the period, the totals leaving each
+    # customer, and how many draft invoices will change. Nothing is written.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/managed-accounts/assignments/preview
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ManagedAccountAssignmentPreviewRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ManagedAccountAssignmentPreview` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def preview(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/managed-accounts/assignments/preview",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.managed_accounts`
   class ManagedAccountsNamespace
+    # @return [ManagedAccountsAssignmentsNamespace] `client.managed_accounts.assignments`
+    attr_reader :assignments
+
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
+      @assignments = ManagedAccountsAssignmentsNamespace.new(@transport)
     end
 
     # Create a managed account
@@ -14845,6 +16898,36 @@ module Infrawrench
       )
     end
 
+    # Find spend no customer is billed for
+    #
+    # Spend in the period, by cost centre and account, that no managed account's
+    # scope covers. Requires `costs:read` as well as `invoices:read`: it is a
+    # cost breakdown of the whole organisation.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/managed-accounts/unassigned
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param from [String, nil] Defaults, with `to`, to the last full calendar month.
+    # @param to [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `UnassignedSpendReport` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def unassigned(org_id: nil, from: nil, to: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/managed-accounts/unassigned",
+        path_params: { "orgId" => org_id },
+        query: { "from" => from, "to" => to },
+        request_options: request_options
+      )
+    end
+
     # Update a managed account
     #
     # A full replace. Editing the scope changes what **future** drafts are drawn
@@ -15416,60 +17499,217 @@ module Infrawrench
     end
   end
 
-  # `client.network_flows.settings`
-  class NetworkFlowsSettingsNamespace
+  # `client.network_flows.reports`
+  class NetworkFlowsReportsNamespace
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
     end
 
-    # Read the network flow collection switch
+    # Create a network flow report
     #
-    # _Requires permission: `costs:read`._
+    # _Requires permission: `costs:write`._
     #
-    # GET /api/org/{orgId}/network-flows/settings
+    # POST /api/org/{orgId}/network-flows/reports
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param body [Hash] Request body, shaped as `NetworkFlowReportInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowReport` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/network-flows/settings",
+        http_method: "POST",
+        path: "/api/org/{orgId}/network-flows/reports",
         path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
 
-    # Turn network flow collection on or off
-    #
-    # Collection is **off by default**. Enabling it authorizes Infrawrench to
-    # run daily queries against the provider's log store; and on AWS those
-    # queries are billed to your own cloud account per GB of log data scanned,
-    # every day, until you turn them off. That is why the write is governed by
-    # `org:settings:write` rather than `costs:write`, and why it is
-    # audit-logged.
-    #
-    # _Requires permission: `org:settings:write`._
+    # Delete a network flow report
     #
-    # PUT /api/org/{orgId}/network-flows/settings
+    # _Requires permission: `costs:write`._
     #
-    # Raises on 400: Bad request
+    # DELETE /api/org/{orgId}/network-flows/reports/{id}
     #
     # Raises on 403: Forbidden
     #
-    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
-    #   constructed with.
-    # @param body [Hash] Request body, shaped as `NetworkFlowSettings`.
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(body:, org_id: nil, request_options: nil)
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/network-flows/reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a network flow report
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/reports/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowReport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List saved network flow reports
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/reports
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<NetworkFlowReport>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/reports",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Run a saved network flow report
+    #
+    # A relative date range resolves against today on every run.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/network-flows/reports/{id}/run
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowReportRunResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def run(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/network-flows/reports/{id}/run",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Replace a network flow report
+    #
+    # _Requires permission: `costs:write`._
+    #
+    # PUT /api/org/{orgId}/network-flows/reports/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `NetworkFlowReportInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowReport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/network-flows/reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.network_flows.settings`
+  class NetworkFlowsSettingsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Read the network flow collection switch
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/settings
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/settings",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Turn network flow collection on or off
+    #
+    # Collection is **off by default**. Enabling it authorizes Infrawrench to
+    # run daily queries against the provider's log store; and on AWS those
+    # queries are billed to your own cloud account per GB of log data scanned,
+    # every day, until you turn them off. That is why the write is governed by
+    # `org:settings:write` rather than `costs:write`, and why it is
+    # audit-logged.
+    #
+    # _Requires permission: `org:settings:write`._
+    #
+    # PUT /api/org/{orgId}/network-flows/settings
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `NetworkFlowSettings`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PUT",
         path: "/api/org/{orgId}/network-flows/settings",
@@ -15484,6 +17724,8 @@ module Infrawrench
   class NetworkFlowsNamespace
     # @return [NetworkFlowsKubernetesNamespace] `client.network_flows.kubernetes`
     attr_reader :kubernetes
+    # @return [NetworkFlowsReportsNamespace] `client.network_flows.reports`
+    attr_reader :reports
     # @return [NetworkFlowsSettingsNamespace] `client.network_flows.settings`
     attr_reader :settings
 
@@ -15492,6 +17734,7 @@ module Infrawrench
     def initialize(transport)
       @transport = transport
       @kubernetes = NetworkFlowsKubernetesNamespace.new(@transport)
+      @reports = NetworkFlowsReportsNamespace.new(@transport)
       @settings = NetworkFlowsSettingsNamespace.new(@transport)
     end
 
@@ -15553,6 +17796,59 @@ module Infrawrench
         request_options: request_options
       )
     end
+
+    # Picker values for the network flow report editor
+    #
+    # Accounts whose provider can report flows, and every VPC, region, zone,
+    # peer service, peer resource type and endpoint seen in the store's 90-day
+    # retention. Scoped to what the caller may see.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/network-flows/report-options
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowReportOptions` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def report_options(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/network-flows/report-options",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Run an unsaved network flow report config
+    #
+    # Bytes and estimated cost over time, per group, with the top talking pairs.
+    # A read despite the method.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # POST /api/org/{orgId}/network-flows/report-query
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `NetworkFlowReportConfig`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `NetworkFlowReportResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def report_query(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/network-flows/report-query",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
   end
 
   # `client.on_call.overrides`
@@ -15867,10 +18163,13 @@ module Infrawrench
     # Scans the organization's already-synced resources against each plugin's
     # declarative orphan heuristics (unattached volumes, unassigned
     # floating/elastic IPs, reserved-but-unused static IPs) and returns the
-    # matches grouped by account, each with the plugin's reason. Purely a read
-    # over stored state: no provider API calls are made, so results reflect the
-    # last sync. Where the org's collected cost data has per-resource rows,
-    # matches are annotated with trailing spend.
+    # matches grouped by account, each with the plugin's reason. Rows flagged by
+    # a metric-based idle rule (a NAT gateway with no traffic, a load balancer
+    # with no requests) carry `idle` with the evidence; those verdicts come from
+    # a daily collection, tuned under `/idle-findings`. Purely a read over
+    # stored state: no provider API calls are made. Where the org's collected
+    # cost data has per-resource rows, matches are annotated with trailing
+    # spend; idle rows a plugin could price also carry a list-price `estimate`.
     #
     # _Requires permission: `resources:read`._
     #
@@ -18168,13 +20467,377 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `QuotaListResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `QuotaListResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/quotas",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.resource_reports.csv`
+  class ResourceReportsCsvNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Export an unsaved resource report config as CSV
+    #
+    # Every matching row up to 50,000, with tag and cost columns (one numeric
+    # column per cost column and currency). A cut file ends with a `# Truncated`
+    # line.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resource-reports/csv
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resource-reports/csv",
+        path_params: { "orgId" => org_id },
+        body: body,
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+
+    # Export a saved resource report as CSV
+    #
+    # Every matching row up to 50,000; a cut file ends with a `# Truncated`
+    # line.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports/{id}/csv
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports/{id}/csv",
+        path_params: { "orgId" => org_id, "id" => id },
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.resource_reports`
+  class ResourceReportsNamespace
+    # @return [ResourceReportsCsvNamespace] `client.resource_reports.csv`
+    attr_reader :csv
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @csv = ResourceReportsCsvNamespace.new(@transport)
+    end
+
+    # Create a resource report
+    #
+    # The creator is the report's implicit owner for sharing. Filing it in a
+    # folder needs editor access to the folder. Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resource-reports
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `ResourceReportInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceReport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resource-reports",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a resource report
+    #
+    # Soft delete; its sharing goes with it. Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/resource-reports/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/resource-reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List report folders for resource reports
+    #
+    # The report folders the caller can see. Resource reports share the folder
+    # tree cost reports use; create and rename folders through
+    # `/cost-report-folders`.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports/folders
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<CostReportFolder>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def folders(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports/folders",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Read a resource report
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceReport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List resource reports
+    #
+    # The saved inventory reports the caller's sharing lets them open, by name.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<ResourceReport>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # What a resource report can filter and show
+    #
+    # Providers, accounts, resource types, regions and statuses with resource
+    # counts, the metadata fields the given types expose (from the type
+    # definitions and the newest synced resources), provider tag keys and, with
+    # `costs:read`, virtual tag keys.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports/options
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param types [String, nil] Comma-separated `pluginId/resourceTypeId` pairs narrowing
+    #   `fields`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceReportOptions` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def options(org_id: nil, types: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports/options",
+        path_params: { "orgId" => org_id },
+        query: { "types" => types },
+        request_options: request_options
+      )
+    end
+
+    # Run an unsaved resource report config
+    #
+    # A read despite the method. Returns one page of rows. Cost and virtual tag
+    # cells need `costs:read` and respect the caller's cost visibility scope.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resource-reports/query
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `ResourceReportQueryRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceReportRows` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def query(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resource-reports/query",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Run a saved resource report
+    #
+    # One page of rows. `sort` and `direction` override the saved sort for this
+    # request only.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports/{id}/rows
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param offset [Integer, nil, nil]
+    # @param limit [Integer, nil]
+    # @param sort [String, nil] `<kind>:<key>`.
+    #   `core:name|type|provider|account|region|status|created|external_id`; `field:<key>` a key
+    #   of the resource's synced fields (offered by `GET /resource-reports/options`); `tag:<key>`
+    #   a provider tag; `vtag:<key>` a virtual tag, read from the resource's own cost rows over
+    #   `costRange` (the value holding the most spend); `cost:range|mtd|previous_month` spend
+    #   joined by provider resource id.
+    # @param direction [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceReportRows` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def rows(
+      id:,
+      org_id: nil,
+      offset: nil,
+      limit: nil,
+      sort: nil,
+      direction: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports/{id}/rows",
+        path_params: { "orgId" => org_id, "id" => id },
+        query: { "offset" => offset, "limit" => limit, "sort" => sort, "direction" => direction },
+        request_options: request_options
+      )
+    end
+
+    # Values one tag key takes
+    #
+    # Provider tag values from synced resources, or virtual tag values from
+    # spend (empty without `costs:read`), most common first.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resource-reports/tag-values
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param source [String, nil]
+    # @param key [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def tag_values(key:, org_id: nil, source: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resource-reports/tag-values",
+        path_params: { "orgId" => org_id },
+        query: { "source" => source, "key" => key },
+        request_options: request_options
+      )
+    end
+
+    # Replace a resource report
+    #
+    # Name, description, config and folder together. Needs editor. Audit-logged.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # PUT /api/org/{orgId}/resource-reports/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash, nil] Request body, shaped as `ResourceReportInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceReport` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def update(id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/quotas",
-        path_params: { "orgId" => org_id },
+        http_method: "PUT",
+        path: "/api/org/{orgId}/resource-reports/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
         request_options: request_options
       )
     end
@@ -19747,6 +22410,125 @@ module Infrawrench
     end
   end
 
+  # `client.savings.findings`
+  class SavingsFindingsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List savings findings
+    #
+    # Every savings finder's findings (orphaned and idle resources, oversized
+    # resources, extended support surcharges, unused SaaS seats) with a
+    # lifecycle status, a detected date and summary tiles. Open findings that a
+    # scan stops reporting move to Completed automatically (`resolution:
+    # resolved`); a finding that returns after that reopens as Ready with a new
+    # detected date. A cost-scoped caller sees only findings on accounts granted
+    # to them outright.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/savings/findings
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param view [String, nil] Apply a saved view, by id or name. Explicit params override it.
+    # @param status [String, nil] A status, `open` (Ready or In progress), or `all`.
+    # @param kind [String, nil] Comma-separated finding kinds.
+    # @param provider [String, nil] Comma-separated plugin ids.
+    # @param account [String, nil] Comma-separated account ids.
+    # @param region [String, nil] Comma-separated regions.
+    # @param tag [String, nil] `key` or `key=value`; repeat for more terms (all must match).
+    # @param min_savings [String, nil] Minimum monthly savings, in each finding's own currency.
+    #   Unpriced findings never pass.
+    # @param detected_from [String, nil] Detected on or after (UTC day).
+    # @param detected_to [String, nil] Detected on or before (UTC day).
+    # @param q [String, nil] Case-insensitive text match over title, resource and account.
+    # @param sort [String, nil] `<field>:<asc|desc>`; fields savings, detected, name,
+    #   status_changed.
+    # @param refresh [String, nil] `true` bypasses the right-sizing and extended support caches.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SavingsFindingsResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(
+      org_id: nil,
+      view: nil,
+      status: nil,
+      kind: nil,
+      provider: nil,
+      account: nil,
+      region: nil,
+      tag: nil,
+      min_savings: nil,
+      detected_from: nil,
+      detected_to: nil,
+      q: nil,
+      sort: nil,
+      refresh: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/savings/findings",
+        path_params: { "orgId" => org_id },
+        query: {
+          "view" => view,
+          "status" => status,
+          "kind" => kind,
+          "provider" => provider,
+          "account" => account,
+          "region" => region,
+          "tag" => tag,
+          "minSavings" => min_savings,
+          "detectedFrom" => detected_from,
+          "detectedTo" => detected_to,
+          "q" => q,
+          "sort" => sort,
+          "refresh" => refresh
+        },
+        request_options: request_options
+      )
+    end
+
+    # Change savings finding status
+    #
+    # Moves findings to a status, recording who, when and an optional note;
+    # Completed by hand records `resolution: manual`. Audited per finding and
+    # published as the `savings.finding.status_changed` event. Keys the caller
+    # cannot see come back in `missing`; a 404 when none matched.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/savings/findings/status
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SavingsFindingStatusInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def status(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/savings/findings/status",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.savings.settings`
   class SavingsSettingsNamespace
     # @api private
@@ -19807,6 +22589,8 @@ module Infrawrench
   class SavingsNamespace
     # @return [SavingsEventsNamespace] `client.savings.events`
     attr_reader :events
+    # @return [SavingsFindingsNamespace] `client.savings.findings`
+    attr_reader :findings
     # @return [SavingsSettingsNamespace] `client.savings.settings`
     attr_reader :settings
 
@@ -19815,6 +22599,7 @@ module Infrawrench
     def initialize(transport)
       @transport = transport
       @events = SavingsEventsNamespace.new(@transport)
+      @findings = SavingsFindingsNamespace.new(@transport)
       @settings = SavingsSettingsNamespace.new(@transport)
     end
 
@@ -19850,6 +22635,151 @@ module Infrawrench
     end
   end
 
+  # `client.savings_views`
+  class SavingsViewsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a savings view
+    #
+    # Names are unique per organization, case-insensitively.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/savings-views
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 409: A live savings view already uses this name.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SavingsViewInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SavingsView` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/savings-views",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a savings view
+    #
+    # Soft delete. Needs owner on the view (or editor when nobody owns it).
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/savings-views/{id}
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/savings-views/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a savings view
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/savings-views/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SavingsView` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/savings-views/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List savings views
+    #
+    # Saved views over the savings findings list: a status tab, a filter and a
+    # sort. Narrowed by per-object sharing (`savings_view`); the creator owns a
+    # view.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/savings-views
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<SavingsView>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/savings-views",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Update a savings view
+    #
+    # Full replace. Needs editor on the view.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # PUT /api/org/{orgId}/savings-views/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: A live savings view already uses this name.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `SavingsViewInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SavingsView` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/savings-views/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.schedules`
   class SchedulesNamespace
     # @api private
@@ -20287,25 +23217,41 @@ module Infrawrench
       @transport = transport
     end
 
-    # Search resources (capped at 50 hits) and workflows across the org
+    # Search resources, workflows and (with `kinds`) saved objects across the
+    # org
+    #
+    # Without `kinds`: resources (capped at 50, substring match over name,
+    # account, provider and type) and workflows; requires `resources:read`. With
+    # `kinds`: the command palette's index. Each named kind the caller's role
+    # can read is searched (a kind it cannot read is skipped, not refused),
+    # narrowed to the objects the caller could open (per-object sharing for cost
+    # reports, folders, dashboards and canvases; cost visibility for budgets),
+    # and fuzzy-ranked: every whitespace-separated token must match the name or
+    # a supporting label, as a substring or an in-order subsequence. At most 8
+    # hits per saved-object kind and 50 resources; kinds are ordered by their
+    # best hit.
     #
     # _Requires permission: `resources:read`._
     #
     # GET /api/org/{orgId}/search
     #
+    # Raises on 400: Bad request
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param q [String, nil]
+    # @param kinds [String, nil] `all`, or a comma-separated list of `SearchResultKind` values.
+    #   An unknown kind is a 400.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Array<Hash>] Parsed JSON, shaped as `Array<SearchHit>` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def list(org_id: nil, q: nil, request_options: nil)
+    def list(org_id: nil, q: nil, kinds: nil, request_options: nil)
       @transport.request(
         http_method: "GET",
         path: "/api/org/{orgId}/search",
         path_params: { "orgId" => org_id },
-        query: { "q" => q },
+        query: { "q" => q, "kinds" => kinds },
         request_options: request_options
       )
     end
@@ -22657,6 +25603,92 @@ module Infrawrench
     end
   end
 
+  # `client.starred`
+  class StarredNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Unstar an object
+    #
+    # Idempotent, and allowed on objects the caller can no longer see.
+    #
+    # DELETE /api/org/{orgId}/starred/{kind}/{objectId}
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param kind [String]
+    # @param object_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(kind:, object_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/starred/{kind}/{objectId}",
+        path_params: { "orgId" => org_id, "kind" => kind, "objectId" => object_id },
+        request_options: request_options
+      )
+    end
+
+    # List the caller's starred items
+    #
+    # The caller's own stars in this org, most recently starred first, each
+    # resolved fresh to the same shape as a search hit. Stars on objects the
+    # caller can no longer open (deleted, unshared, outside their cost
+    # visibility, or of a kind their role cannot read) are left out rather than
+    # deleted, so they come back if access does.
+    #
+    # GET /api/org/{orgId}/starred
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/starred",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Star an object
+    #
+    # Idempotent. The object must be one the caller could open; anything else is
+    # a 404. A member can star up to 200 items per org (409 beyond that).
+    #
+    # PUT /api/org/{orgId}/starred/{kind}/{objectId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param kind [String]
+    # @param object_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(kind:, object_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/starred/{kind}/{objectId}",
+        path_params: { "orgId" => org_id, "kind" => kind, "objectId" => object_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.status`
   class StatusNamespace
     # @api private
@@ -23566,10 +26598,10 @@ module Infrawrench
 
     # Delete a virtual tag
     #
-    # Refused with a 409 that names every saved filter, budget, report,
-    # dashboard card, change alert, allocation rule, cost export or business
-    # metric still referencing the key: deleting it would make those fail rather
-    # than quietly widen to all spend.
+    # Refused with a 409 that names every other virtual tag, saved filter,
+    # budget, report, dashboard card, change alert, allocation rule, cost export
+    # or business metric still referencing the key: deleting it would make those
+    # fail rather than quietly widen to all spend.
     #
     # _Requires permission: `costs:write`._
     #
@@ -24445,6 +27477,8 @@ module Infrawrench
     attr_reader :bastions
     # @return [BillingNamespace] `client.billing`
     attr_reader :billing
+    # @return [BillingProfilesNamespace] `client.billing_profiles`
+    attr_reader :billing_profiles
     # @return [BillingRulesNamespace] `client.billing_rules`
     attr_reader :billing_rules
     # @return [BlastRadiusNamespace] `client.blast_radius`
@@ -24481,6 +27515,8 @@ module Infrawrench
     attr_reader :cost_centres
     # @return [CostExportsNamespace] `client.cost_exports`
     attr_reader :cost_exports
+    # @return [CostReportAnomalyAlertsNamespace] `client.cost_report_anomaly_alerts`
+    attr_reader :cost_report_anomaly_alerts
     # @return [CostReportFoldersNamespace] `client.cost_report_folders`
     attr_reader :cost_report_folders
     # @return [CostReportNotificationsNamespace] `client.cost_report_notifications`
@@ -24533,16 +27569,22 @@ module Infrawrench
     attr_reader :github_issues
     # @return [IacNamespace] `client.iac`
     attr_reader :iac
+    # @return [IdleFindingsNamespace] `client.idle_findings`
+    attr_reader :idle_findings
     # @return [IncidentsNamespace] `client.incidents`
     attr_reader :incidents
     # @return [InvitationsNamespace] `client.invitations`
     attr_reader :invitations
     # @return [InvoicesNamespace] `client.invoices`
     attr_reader :invoices
+    # @return [IssueWebhooksNamespace] `client.issue_webhooks`
+    attr_reader :issue_webhooks
     # @return [JiraNamespace] `client.jira`
     attr_reader :jira
     # @return [JitAccessNamespace] `client.jit_access`
     attr_reader :jit_access
+    # @return [K8sEfficiencyReportsNamespace] `client.k8s_efficiency_reports`
+    attr_reader :k8s_efficiency_reports
     # @return [KvNamespace] `client.kv`
     attr_reader :kv
     # @return [LeakedSecretsNamespace] `client.leaked_secrets`
@@ -24595,6 +27637,8 @@ module Infrawrench
     attr_reader :query_monitors
     # @return [QuotasNamespace] `client.quotas`
     attr_reader :quotas
+    # @return [ResourceReportsNamespace] `client.resource_reports`
+    attr_reader :resource_reports
     # @return [ResourcesNamespace] `client.resources`
     attr_reader :resources
     # @return [RightsizingNamespace] `client.rightsizing`
@@ -24605,6 +27649,8 @@ module Infrawrench
     attr_reader :saved_cost_filters
     # @return [SavingsNamespace] `client.savings`
     attr_reader :savings
+    # @return [SavingsViewsNamespace] `client.savings_views`
+    attr_reader :savings_views
     # @return [SchedulesNamespace] `client.schedules`
     attr_reader :schedules
     # @return [ScorecardsNamespace] `client.scorecards`
@@ -24635,6 +27681,8 @@ module Infrawrench
     attr_reader :ssh_keys
     # @return [SshTunnelsNamespace] `client.ssh_tunnels`
     attr_reader :ssh_tunnels
+    # @return [StarredNamespace] `client.starred`
+    attr_reader :starred
     # @return [StatusNamespace] `client.status`
     attr_reader :status
     # @return [StatusIncidentsNamespace] `client.status_incidents`
@@ -24685,6 +27733,7 @@ module Infrawrench
       @backups = BackupsNamespace.new(@transport)
       @bastions = BastionsNamespace.new(@transport)
       @billing = BillingNamespace.new(@transport)
+      @billing_profiles = BillingProfilesNamespace.new(@transport)
       @billing_rules = BillingRulesNamespace.new(@transport)
       @blast_radius = BlastRadiusNamespace.new(@transport)
       @budgets = BudgetsNamespace.new(@transport)
@@ -24703,6 +27752,7 @@ module Infrawrench
       @cost_canvases = CostCanvasesNamespace.new(@transport)
       @cost_centres = CostCentresNamespace.new(@transport)
       @cost_exports = CostExportsNamespace.new(@transport)
+      @cost_report_anomaly_alerts = CostReportAnomalyAlertsNamespace.new(@transport)
       @cost_report_folders = CostReportFoldersNamespace.new(@transport)
       @cost_report_notifications = CostReportNotificationsNamespace.new(@transport)
       @cost_reports = CostReportsNamespace.new(@transport)
@@ -24729,11 +27779,14 @@ module Infrawrench
       @extended_support = ExtendedSupportNamespace.new(@transport)
       @github_issues = GithubIssuesNamespace.new(@transport)
       @iac = IacNamespace.new(@transport)
+      @idle_findings = IdleFindingsNamespace.new(@transport)
       @incidents = IncidentsNamespace.new(@transport)
       @invitations = InvitationsNamespace.new(@transport)
       @invoices = InvoicesNamespace.new(@transport)
+      @issue_webhooks = IssueWebhooksNamespace.new(@transport)
       @jira = JiraNamespace.new(@transport)
       @jit_access = JitAccessNamespace.new(@transport)
+      @k8s_efficiency_reports = K8sEfficiencyReportsNamespace.new(@transport)
       @kv = KvNamespace.new(@transport)
       @leaked_secrets = LeakedSecretsNamespace.new(@transport)
       @leases = LeasesNamespace.new(@transport)
@@ -24760,11 +27813,13 @@ module Infrawrench
       @provider_oauth = ProviderOauthNamespace.new(@transport)
       @query_monitors = QueryMonitorsNamespace.new(@transport)
       @quotas = QuotasNamespace.new(@transport)
+      @resource_reports = ResourceReportsNamespace.new(@transport)
       @resources = ResourcesNamespace.new(@transport)
       @rightsizing = RightsizingNamespace.new(@transport)
       @runbooks = RunbooksNamespace.new(@transport)
       @saved_cost_filters = SavedCostFiltersNamespace.new(@transport)
       @savings = SavingsNamespace.new(@transport)
+      @savings_views = SavingsViewsNamespace.new(@transport)
       @schedules = SchedulesNamespace.new(@transport)
       @scorecards = ScorecardsNamespace.new(@transport)
       @search = SearchNamespace.new(@transport)
@@ -24780,6 +27835,7 @@ module Infrawrench
       @ssh_fanout = SshFanoutNamespace.new(@transport)
       @ssh_keys = SshKeysNamespace.new(@transport)
       @ssh_tunnels = SshTunnelsNamespace.new(@transport)
+      @starred = StarredNamespace.new(@transport)
       @status = StatusNamespace.new(@transport)
       @status_incidents = StatusIncidentsNamespace.new(@transport)
       @status_pages = StatusPagesNamespace.new(@transport)