@atlanai/sdk 0.1.0

package/dist/raw/registry/apis/ServiceAccountsApi.js

@@ -0,0 +1,309 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccountsApi = void 0;
+const runtime = __importStar(require("../runtime"));
+const CreateServiceAccountBody_1 = require("../models/CreateServiceAccountBody");
+const RotatedCredentialDto_1 = require("../models/RotatedCredentialDto");
+const ServiceAccountDto_1 = require("../models/ServiceAccountDto");
+const ServiceAccountsPage_1 = require("../models/ServiceAccountsPage");
+/**
+ *
+ */
+class ServiceAccountsApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryCreateServiceAccount without sending the request
+     */
+    async registryCreateServiceAccountRequestOpts(requestParameters) {
+        if (requestParameters['createServiceAccountBody'] == null) {
+            throw new runtime.RequiredError('createServiceAccountBody', 'Required parameter "createServiceAccountBody" was null or undefined when calling registryCreateServiceAccount().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/service-accounts`;
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, CreateServiceAccountBody_1.CreateServiceAccountBodyToJSON)(requestParameters['createServiceAccountBody']),
+        };
+    }
+    /**
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Create a machine identity
+     */
+    async registryCreateServiceAccountRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryCreateServiceAccountRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ServiceAccountDto_1.ServiceAccountDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Registers a principal the account\'s automation can authenticate as. **The registry does not mint the credential** — `secret_ref` is a handle into the secret provider, supplied by whatever provisioned it, and this row is the durable identity that references it.  There is no `PATCH`: a machine identity\'s `client_id`, `principal_type` and `secret_ref` are what it *is*, and editing them would repoint an identity that live credentials already authenticate as.
+     * Create a machine identity
+     */
+    async registryCreateServiceAccount(requestParameters, initOverrides) {
+        const response = await this.registryCreateServiceAccountRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryGetServiceAccount without sending the request
+     */
+    async registryGetServiceAccountRequestOpts(requestParameters) {
+        if (requestParameters['principalId'] == null) {
+            throw new runtime.RequiredError('principalId', 'Required parameter "principalId" was null or undefined when calling registryGetServiceAccount().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/service-accounts/{principal_id}`;
+        urlPath = urlPath.replace('{principal_id}', encodeURIComponent(String(requestParameters['principalId'])));
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Use this operation to get a machine identity.
+     * Get a machine identity
+     */
+    async registryGetServiceAccountRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryGetServiceAccountRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ServiceAccountDto_1.ServiceAccountDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Use this operation to get a machine identity.
+     * Get a machine identity
+     */
+    async registryGetServiceAccount(requestParameters, initOverrides) {
+        const response = await this.registryGetServiceAccountRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryListServiceAccounts without sending the request
+     */
+    async registryListServiceAccountsRequestOpts() {
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/service-accounts`;
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Agents, service accounts and action identities. A `revoked` row stays: the audit trail names these principals, so erasing one would leave its events pointing at nothing.  Narrowed through the shared query grammar rather than bespoke parameters: `filter[principal_type][eq]`, `filter[principal_status][eq]`, `filter[credential_kind][eq]`, `filter[client_id][eq]`, `filter[principal_id][eq]`, `filter[display_name][contains]`, and `q=` for a case-insensitive substring over `display_name`. `sort`, `limit`/`offset` and `count=false` behave as they do on every other collection. **Credential material is never returned** — `secret_ref` is neither readable nor filterable, because a grammar that can probe for a secret handle turns a directory read into an oracle.  Fields: `principal_id`, `principal_type`, `principal_status`, `credential_kind`, `client_id`, `created_at`, `expires_at`.
+     * List machine identities
+     */
+    async registryListServiceAccountsRaw(initOverrides) {
+        const requestOptions = await this.registryListServiceAccountsRequestOpts();
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ServiceAccountsPage_1.ServiceAccountsPageFromJSON)(jsonValue));
+    }
+    /**
+     * Agents, service accounts and action identities. A `revoked` row stays: the audit trail names these principals, so erasing one would leave its events pointing at nothing.  Narrowed through the shared query grammar rather than bespoke parameters: `filter[principal_type][eq]`, `filter[principal_status][eq]`, `filter[credential_kind][eq]`, `filter[client_id][eq]`, `filter[principal_id][eq]`, `filter[display_name][contains]`, and `q=` for a case-insensitive substring over `display_name`. `sort`, `limit`/`offset` and `count=false` behave as they do on every other collection. **Credential material is never returned** — `secret_ref` is neither readable nor filterable, because a grammar that can probe for a secret handle turns a directory read into an oracle.  Fields: `principal_id`, `principal_type`, `principal_status`, `credential_kind`, `client_id`, `created_at`, `expires_at`.
+     * List machine identities
+     */
+    async registryListServiceAccounts(initOverrides) {
+        const response = await this.registryListServiceAccountsRaw(initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryRevokeServiceAccount without sending the request
+     */
+    async registryRevokeServiceAccountRequestOpts(requestParameters) {
+        if (requestParameters['principalId'] == null) {
+            throw new runtime.RequiredError('principalId', 'Required parameter "principalId" was null or undefined when calling registryRevokeServiceAccount().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/service-accounts/{principal_id}`;
+        urlPath = urlPath.replace('{principal_id}', encodeURIComponent(String(requestParameters['principalId'])));
+        return {
+            path: urlPath,
+            method: 'DELETE',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * **Revokes, and the row stays readable.** `status` becomes `revoked` and `revoked_at` is stamped in the same statement — the row is not removed and not hidden, because every audit event this principal ever produced names it as the actor. A revoked identity that vanished from reads would make its own history unreadable.  Returns the retired row rather than 204, so a client can see the revocation time it just caused. Revoking twice is idempotent.
+     * Revoke a machine identity
+     */
+    async registryRevokeServiceAccountRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryRevokeServiceAccountRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ServiceAccountDto_1.ServiceAccountDtoFromJSON)(jsonValue));
+    }
+    /**
+     * **Revokes, and the row stays readable.** `status` becomes `revoked` and `revoked_at` is stamped in the same statement — the row is not removed and not hidden, because every audit event this principal ever produced names it as the actor. A revoked identity that vanished from reads would make its own history unreadable.  Returns the retired row rather than 204, so a client can see the revocation time it just caused. Revoking twice is idempotent.
+     * Revoke a machine identity
+     */
+    async registryRevokeServiceAccount(requestParameters, initOverrides) {
+        const response = await this.registryRevokeServiceAccountRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryRevokeServiceAccountCredential without sending the request
+     */
+    async registryRevokeServiceAccountCredentialRequestOpts(requestParameters) {
+        if (requestParameters['principalId'] == null) {
+            throw new runtime.RequiredError('principalId', 'Required parameter "principalId" was null or undefined when calling registryRevokeServiceAccountCredential().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/service-accounts/{principal_id}/revoke`;
+        urlPath = urlPath.replace('{principal_id}', encodeURIComponent(String(requestParameters['principalId'])));
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Revokes the credential at the identity provider **and** retires the row, in that order. Distinct from `DELETE /service-accounts/{principal_id}`, which only retires the row: that leaves a live credential at the provider that this registry no longer knows about, which is the worse half of a revocation to skip.  The provider first, deliberately. If it refuses, the row stays active and the caller sees why — a retired row beside a working credential is the state nobody can discover.  Idempotent: revoking twice succeeds, since both halves are.
+     * Revoke this identity\'s credential at the provider
+     */
+    async registryRevokeServiceAccountCredentialRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryRevokeServiceAccountCredentialRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, ServiceAccountDto_1.ServiceAccountDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Revokes the credential at the identity provider **and** retires the row, in that order. Distinct from `DELETE /service-accounts/{principal_id}`, which only retires the row: that leaves a live credential at the provider that this registry no longer knows about, which is the worse half of a revocation to skip.  The provider first, deliberately. If it refuses, the row stays active and the caller sees why — a retired row beside a working credential is the state nobody can discover.  Idempotent: revoking twice succeeds, since both halves are.
+     * Revoke this identity\'s credential at the provider
+     */
+    async registryRevokeServiceAccountCredential(requestParameters, initOverrides) {
+        const response = await this.registryRevokeServiceAccountCredentialRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+    /**
+     * Creates request options for registryRotateServiceAccountCredential without sending the request
+     */
+    async registryRotateServiceAccountCredentialRequestOpts(requestParameters) {
+        if (requestParameters['principalId'] == null) {
+            throw new runtime.RequiredError('principalId', 'Required parameter "principalId" was null or undefined when calling registryRotateServiceAccountCredential().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/service-accounts/{principal_id}/rotate`;
+        urlPath = urlPath.replace('{principal_id}', encodeURIComponent(String(requestParameters['principalId'])));
+        return {
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotate this identity\'s credential
+     */
+    async registryRotateServiceAccountCredentialRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registryRotateServiceAccountCredentialRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, RotatedCredentialDto_1.RotatedCredentialDtoFromJSON)(jsonValue));
+    }
+    /**
+     * Rotates the credential at the identity provider and returns the new secret **once**. It is not stored: `secret_ref` on this row is a handle into whatever provisioned the credential, and the registry never held the value — so the actor that registered this identity is the actor that must record the new one.  The old secret stops working the moment this returns, so a caller that loses the response has to rotate again. That is the honest failure mode for reveal-once and it is why the response is the whole point of the call.  The registry can rotate a credential it never minted — rotation needs only the recorded `client_id` — which follows from `POST /service-accounts` **registering** rather than provisioning. Authorization is therefore on the row, not on provenance.  **Runs as the calling operator.** The identity provider grants no machine-usable client-admin scope, so the caller\'s own bearer is forwarded; a machine principal\'s token is refused by the provider rather than by this route.  **`credential_kind` is sent to the provider verbatim, and this surface\'s closed set is `secret` | `api_key`.** So an identity whose provider-side credential is filed under any other name cannot be rotated here: `POST /service-accounts` refuses the value at registration, and a mismatched one that did get stored answers 404 from the provider. Widening the set is an `api-contract` change; it is not done here because the right vocabulary is the provider\'s and this route should not be the place that guesses it.
+     * Rotate this identity\'s credential
+     */
+    async registryRotateServiceAccountCredential(requestParameters, initOverrides) {
+        const response = await this.registryRotateServiceAccountCredentialRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
+}
+exports.ServiceAccountsApi = ServiceAccountsApi;

package/dist/raw/registry/apis/UsageApi.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import { type BudgetDto } from '../models/BudgetDto';
+import { type BudgetsPage } from '../models/BudgetsPage';
+import { type CreateBudgetBody } from '../models/CreateBudgetBody';
+import { type PatchBudgetBody } from '../models/PatchBudgetBody';
+import { type UsageDaysPage } from '../models/UsageDaysPage';
+import { type UsageMinutesPage } from '../models/UsageMinutesPage';
+export interface RegistryCreateBudgetRequest {
+    createBudgetBody: CreateBudgetBody;
+}
+export interface RegistryDeleteBudgetRequest {
+    budgetId: string;
+}
+export interface RegistryGetBudgetRequest {
+    budgetId: string;
+}
+export interface RegistryUpdateBudgetRequest {
+    budgetId: string;
+    patchBudgetBody: PatchBudgetBody;
+}
+/**
+ *
+ */
+export declare class UsageApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for registryCreateBudget without sending the request
+     */
+    registryCreateBudgetRequestOpts(requestParameters: RegistryCreateBudgetRequest): Promise<runtime.RequestOpts>;
+    /**
+     * A spend or token cap. `metric: cost` limits are in **nano-USD**, the same unit the usage ledger carries — a $1/day cap is `1000000000`. The limit must be positive; a cap of zero is `enabled: false`.
+     * Create a budget
+     */
+    registryCreateBudgetRaw(requestParameters: RegistryCreateBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BudgetDto>>;
+    /**
+     * A spend or token cap. `metric: cost` limits are in **nano-USD**, the same unit the usage ledger carries — a $1/day cap is `1000000000`. The limit must be positive; a cap of zero is `enabled: false`.
+     * Create a budget
+     */
+    registryCreateBudget(requestParameters: RegistryCreateBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BudgetDto>;
+    /**
+     * Creates request options for registryDeleteBudget without sending the request
+     */
+    registryDeleteBudgetRequestOpts(requestParameters: RegistryDeleteBudgetRequest): Promise<runtime.RequestOpts>;
+    /**
+     * **A real delete**, with the audit event in the same transaction. A cap is either in force or gone; suspending one without removing it is `enabled: false`.
+     * Delete a budget
+     */
+    registryDeleteBudgetRaw(requestParameters: RegistryDeleteBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * **A real delete**, with the audit event in the same transaction. A cap is either in force or gone; suspending one without removing it is `enabled: false`.
+     * Delete a budget
+     */
+    registryDeleteBudget(requestParameters: RegistryDeleteBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Creates request options for registryGetBudget without sending the request
+     */
+    registryGetBudgetRequestOpts(requestParameters: RegistryGetBudgetRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to get a budget.
+     * Get a budget
+     */
+    registryGetBudgetRaw(requestParameters: RegistryGetBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BudgetDto>>;
+    /**
+     * Use this operation to get a budget.
+     * Get a budget
+     */
+    registryGetBudget(requestParameters: RegistryGetBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BudgetDto>;
+    /**
+     * Creates request options for registryListBudgets without sending the request
+     */
+    registryListBudgetsRequestOpts(): Promise<runtime.RequestOpts>;
+    /**
+     * Spend and token caps. `scope_type`/`scope_value` say what a budget is *about* — an org, a provider, a model, a user — while the row itself is always account-level, so every member can see that a cap exists.
+     * List budgets
+     */
+    registryListBudgetsRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BudgetsPage>>;
+    /**
+     * Spend and token caps. `scope_type`/`scope_value` say what a budget is *about* — an org, a provider, a model, a user — while the row itself is always account-level, so every member can see that a cap exists.
+     * List budgets
+     */
+    registryListBudgets(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BudgetsPage>;
+    /**
+     * Creates request options for registryListUsageDays without sending the request
+     */
+    registryListUsageDaysRequestOpts(): Promise<runtime.RequestOpts>;
+    /**
+     * The day grain: one row per dimension tuple per day. **Workspace-scoped at `read`**, so a caller sees the workspaces they can read rather than the account\'s whole spend — a row keys on `user_id`, so it is a named person\'s per-provider spend rather than a workspace total. The account-wide question is `POST /usage/query`, which is `org_admin`. `updated_at` is the staleness a reader has to reason about — the fold is periodic, not synchronous.
+     * List daily usage
+     */
+    registryListUsageDaysRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<UsageDaysPage>>;
+    /**
+     * The day grain: one row per dimension tuple per day. **Workspace-scoped at `read`**, so a caller sees the workspaces they can read rather than the account\'s whole spend — a row keys on `user_id`, so it is a named person\'s per-provider spend rather than a workspace total. The account-wide question is `POST /usage/query`, which is `org_admin`. `updated_at` is the staleness a reader has to reason about — the fold is periodic, not synchronous.
+     * List daily usage
+     */
+    registryListUsageDays(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<UsageDaysPage>;
+    /**
+     * Creates request options for registryListUsageMinutes without sending the request
+     */
+    registryListUsageMinutesRequestOpts(): Promise<runtime.RequestOpts>;
+    /**
+     * The hot grain, which the budget check reads. **Workspace-scoped at `read`**, on the same terms as `GET /usage` — the finer grain is more revealing, not less. Rows are **per writer**: concurrent replicas fold the same minute into separate rows, so a client summing a minute must sum across them. That is the sharding that keeps the write path from contending, surfaced rather than hidden.
+     * List per-minute usage
+     */
+    registryListUsageMinutesRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<UsageMinutesPage>>;
+    /**
+     * The hot grain, which the budget check reads. **Workspace-scoped at `read`**, on the same terms as `GET /usage` — the finer grain is more revealing, not less. Rows are **per writer**: concurrent replicas fold the same minute into separate rows, so a client summing a minute must sum across them. That is the sharding that keeps the write path from contending, surfaced rather than hidden.
+     * List per-minute usage
+     */
+    registryListUsageMinutes(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<UsageMinutesPage>;
+    /**
+     * Creates request options for registryUpdateBudget without sending the request
+     */
+    registryUpdateBudgetRequestOpts(requestParameters: RegistryUpdateBudgetRequest): Promise<runtime.RequestOpts>;
+    /**
+     * `limit_value`, `enabled` and the labels are editable — raising a cap is the common operation. **What the budget is *about* is not**: `surface`, `scope_type`, `scope_value`, `metric` and `window_unit` together decide which calls it governs, so editing one would turn a $100/day model cap into a 100-token/minute MCP cap while keeping its id and whatever a client pinned to it. That is a new budget, and this is a 422.
+     * Update a budget
+     */
+    registryUpdateBudgetRaw(requestParameters: RegistryUpdateBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<BudgetDto>>;
+    /**
+     * `limit_value`, `enabled` and the labels are editable — raising a cap is the common operation. **What the budget is *about* is not**: `surface`, `scope_type`, `scope_value`, `metric` and `window_unit` together decide which calls it governs, so editing one would turn a $100/day model cap into a 100-token/minute MCP cap while keeping its id and whatever a client pinned to it. That is a new budget, and this is a 422.
+     * Update a budget
+     */
+    registryUpdateBudget(requestParameters: RegistryUpdateBudgetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<BudgetDto>;
+}