@clossir-tech/ts-sdk 0.7.0 → 0.9.0

package/src/sdk/organizations.ts

@@ -6,6 +6,7 @@ import { organizationsDeleteOrgsByOrgIdApiKeysByKeyId } from "../funcs/organizat
 import { organizationsDeleteOrgsByOrgIdChainsByChainId } from "../funcs/organizations-delete-orgs-by-org-id-chains-by-chain-id.js";
 import { organizationsDeleteOrgsByOrgIdIssuer } from "../funcs/organizations-delete-orgs-by-org-id-issuer.js";
 import { organizationsDeleteOrgsByOrgIdMembersByUserId } from "../funcs/organizations-delete-orgs-by-org-id-members-by-user-id.js";
+import { organizationsGetOrgsByOrgIdApiKeysAudit } from "../funcs/organizations-get-orgs-by-org-id-api-keys-audit.js";
 import { organizationsGetOrgsByOrgIdApiKeys } from "../funcs/organizations-get-orgs-by-org-id-api-keys.js";
 import { organizationsGetOrgsByOrgIdAttestations } from "../funcs/organizations-get-orgs-by-org-id-attestations.js";
 import { organizationsGetOrgsByOrgIdAuditLogsArchive } from "../funcs/organizations-get-orgs-by-org-id-audit-logs-archive.js";
@@ -35,6 +36,7 @@ import { organizationsGetOrgsPermissionScopes } from "../funcs/organizations-get
 import { organizationsGetOrgs } from "../funcs/organizations-get-orgs.js";
 import { organizationsPatchOrgsByOrgIdSecurity } from "../funcs/organizations-patch-orgs-by-org-id-security.js";
 import { organizationsPatchOrgsByOrgId } from "../funcs/organizations-patch-orgs-by-org-id.js";
+import { organizationsPostOrgsByOrgIdApiKeysByKeyIdRotate } from "../funcs/organizations-post-orgs-by-org-id-api-keys-by-key-id-rotate.js";
 import { organizationsPostOrgsByOrgIdApiKeys } from "../funcs/organizations-post-orgs-by-org-id-api-keys.js";
 import { organizationsPostOrgsByOrgIdChains } from "../funcs/organizations-post-orgs-by-org-id-chains.js";
 import { organizationsPostOrgsByOrgIdInvitationsByInvitationIdResend } from "../funcs/organizations-post-orgs-by-org-id-invitations-by-invitation-id-resend.js";
@@ -42,6 +44,7 @@ import { organizationsPostOrgsByOrgIdInvitationsByInvitationIdRevoke } from "../
 import { organizationsPostOrgsByOrgIdInviteEligibility } from "../funcs/organizations-post-orgs-by-org-id-invite-eligibility.js";
 import { organizationsPostOrgsByOrgIdIssuerRegister } from "../funcs/organizations-post-orgs-by-org-id-issuer-register.js";
 import { organizationsPostOrgsByOrgIdMembersByUserIdAttest } from "../funcs/organizations-post-orgs-by-org-id-members-by-user-id-attest.js";
+import { organizationsPostOrgsByOrgIdMembersByUserIdServerWallet } from "../funcs/organizations-post-orgs-by-org-id-members-by-user-id-server-wallet.js";
 import { organizationsPostOrgsByOrgIdMembersInvite } from "../funcs/organizations-post-orgs-by-org-id-members-invite.js";
 import { organizationsPostOrgsByOrgIdMembers } from "../funcs/organizations-post-orgs-by-org-id-members.js";
 import { organizationsPostOrgsByOrgIdServerWallet } from "../funcs/organizations-post-orgs-by-org-id-server-wallet.js";
@@ -496,6 +499,25 @@ export class Organizations extends ClientSDK {
     ));
   }
 
+  /**
+   * List API key audit trail
+   *
+   * @remarks
+   * Returns the audit trail for API key operations in the organization. Filter by key_id, event_type, and date range. Requires audit:read permission.
+   */
+  async getOrgsByOrgIdApiKeysAudit(
+    security: operations.GetOrgsByOrgIdApiKeysAuditSecurity,
+    request: operations.GetOrgsByOrgIdApiKeysAuditRequest,
+    options?: RequestOptions,
+  ): Promise<any> {
+    return unwrapAsync(organizationsGetOrgsByOrgIdApiKeysAudit(
+      this,
+      security,
+      request,
+      options,
+    ));
+  }
+
   /**
    * Revoke API key
    *
@@ -515,6 +537,27 @@ export class Organizations extends ClientSDK {
     ));
   }
 
+  /**
+   * Rotate API key
+   *
+   * @remarks
+   * Issues a successor key and immediately revokes the predecessor. The new key plaintext is returned only once. Optionally override the predecessor's permissions. Requires JWT auth with api-keys:write permission.
+   */
+  async postOrgsByOrgIdApiKeysByKeyIdRotate(
+    orgId: string,
+    keyId: string,
+    body: operations.PostOrgsByOrgIdApiKeysByKeyIdRotateRequestBody,
+    options?: RequestOptions,
+  ): Promise<operations.PostOrgsByOrgIdApiKeysByKeyIdRotateResponse> {
+    return unwrapAsync(organizationsPostOrgsByOrgIdApiKeysByKeyIdRotate(
+      this,
+      orgId,
+      keyId,
+      body,
+      options,
+    ));
+  }
+
   /**
    * List sub-organizations
    *
@@ -646,7 +689,7 @@ export class Organizations extends ClientSDK {
   }
 
   /**
-   * List org transactions
+   * List org transactions (deprecated)
    */
   async getOrgsByOrgIdTransactions(
     security: operations.GetOrgsByOrgIdTransactionsSecurity,
@@ -662,7 +705,7 @@ export class Organizations extends ClientSDK {
   }
 
   /**
-   * List org chain transactions
+   * List org chain transactions (deprecated)
    */
   async getOrgsByOrgIdChainTransactions(
     security: operations.GetOrgsByOrgIdChainTransactionsSecurity,
@@ -876,6 +919,27 @@ export class Organizations extends ClientSDK {
     ));
   }
 
+  /**
+   * Provision server wallets for an org member
+   *
+   * @remarks
+   * Creates the Privy embedded wallets (EVM + Solana) for a named member of this organization and records the resulting privy_accounts / user_chain_identities rows. Requires an active membership for the target user and the `wallets:write` permission. Idempotent: re-running returns the same addresses. Returns 404 if the target user is not an active member of the organization.
+   */
+  async postOrgsByOrgIdMembersByUserIdServerWallet(
+    security: operations.PostOrgsByOrgIdMembersByUserIdServerWalletSecurity,
+    orgId: string,
+    userId: string,
+    options?: RequestOptions,
+  ): Promise<operations.PostOrgsByOrgIdMembersByUserIdServerWalletResponse> {
+    return unwrapAsync(organizationsPostOrgsByOrgIdMembersByUserIdServerWallet(
+      this,
+      security,
+      orgId,
+      userId,
+      options,
+    ));
+  }
+
   /**
    * Get issuer status for organization
    *

package/src/sdk/preflight.ts

@@ -0,0 +1,29 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { preflightPostPreflight } from "../funcs/preflight-post-preflight.js";
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as operations from "../models/operations/index.js";
+import { unwrapAsync } from "../types/fp.js";
+
+export class Preflight extends ClientSDK {
+  /**
+   * Preflight a chain action under org-scoped compliance facts
+   *
+   * @remarks
+   * Authenticates and authorizes the caller's org against the target asset, assembles the initiating holder's compliance facts, and returns a SignedPreflightReport from the preflight-gateway (verbatim, client-verifiable). Returns an unsigned red report when facts are denied. Accepts a JWT/session caller or an org-scoped API key carrying the `preflight:read` permission; EVM/HyperEVM only in v1.
+   */
+  async postPreflight(
+    security: operations.PostPreflightSecurity,
+    request: operations.PostPreflightRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostPreflightResponse> {
+    return unwrapAsync(preflightPostPreflight(
+      this,
+      security,
+      request,
+      options,
+    ));
+  }
+}

package/src/sdk/sdk.ts

@@ -2,7 +2,9 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  */
 
-import { ClientSDK } from "../lib/sdks.js";
+import { getMetrics } from "../funcs/get-metrics.js";
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import { unwrapAsync } from "../types/fp.js";
 import { AccountTimeseries } from "./account-timeseries.js";
 import { Accounts } from "./accounts.js";
 import { Assets } from "./assets.js";
@@ -23,6 +25,7 @@ import { Nav } from "./nav.js";
 import { OAuthManagement } from "./o-auth-management.js";
 import { OAuth } from "./o-auth.js";
 import { Organizations } from "./organizations.js";
+import { Preflight } from "./preflight.js";
 import { PublicMarketData } from "./public-market-data.js";
 import { Timeseries } from "./timeseries.js";
 import { Transfers } from "./transfers.js";
@@ -131,6 +134,11 @@ export class Clossir extends ClientSDK {
     return (this._chainEvents ??= new ChainEvents(this._options));
   }
 
+  private _preflight?: Preflight;
+  get preflight(): Preflight {
+    return (this._preflight ??= new Preflight(this._options));
+  }
+
   private _jurisdictions?: Jurisdictions;
   get jurisdictions(): Jurisdictions {
     return (this._jurisdictions ??= new Jurisdictions(this._options));
@@ -160,4 +168,13 @@ export class Clossir extends ClientSDK {
   get accountTimeseries(): AccountTimeseries {
     return (this._accountTimeseries ??= new AccountTimeseries(this._options));
   }
+
+  async getMetrics(
+    options?: RequestOptions,
+  ): Promise<void> {
+    return unwrapAsync(getMetrics(
+      this,
+      options,
+    ));
+  }
 }

package/tests/problem-details-ctype-propagation.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Matcher ctype-propagation proof (R1 evidence).
+ *
+ * The func-level oracle (problem-details-matcher.test.ts) goes GREEN only after
+ * the SDK is regenerated from the re-keyed spec — the regen emits
+ * `M.jsonErr(codes, schema, { ctype: "application/problem+json" })` for every
+ * problem+json response and adds a 428 matcher. That regen requires the
+ * Speakeasy toolchain.
+ *
+ * This test proves the LOAD-BEARING mechanism the regen relies on WITHOUT the
+ * toolchain: it runs the REAL, generated `M.match(...)` chain (from
+ * ../src/lib/matchers, DO-NOT-EDIT generated code) over the SAME matcher shape
+ * Speakeasy will emit for a re-keyed spec, and shows an application/problem+json
+ * body types as ProblemDetailsError. It also shows the CURRENT (pre-fix)
+ * bare `M.jsonErr` matcher misses the same body — i.e. the re-key is REQUIRED
+ * and SUFFICIENT at the matcher layer. This is the empirical proof that the
+ * spec fix propagates to the matcher `ctype` (spec Step 5b / R1), pending the
+ * regen that wires it into every generated func.
+ */
+import { describe, expect, test } from "bun:test";
+import * as M from "../src/lib/matchers";
+import { DefaultError } from "../src/models/errors/default-error";
+import { ProblemDetailsError } from "../src/models/errors/problem-details-error";
+
+function problemJson(status: number, body: Record<string, unknown>): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/problem+json" },
+  });
+}
+
+const PROBLEM_403 = {
+  type: "https://signum.dev/problems/forbidden",
+  title: "forbidden",
+  status: 403,
+  detail: "Not allowed.",
+  instance: "/orgs/org_123/security",
+};
+
+const req = new Request("http://localhost:9999/orgs/org_123/security", {
+  method: "PATCH",
+});
+
+describe("matcher ctype propagation (real M.match chain)", () => {
+  test("PRE-FIX shape: bare jsonErr (no ctype) MISSES problem+json → DefaultError", async () => {
+    // This is exactly what the current generated funcs emit:
+    // M.jsonErr([403], schema) with no ctype → defaults application/json.
+    const matchFn = M.match(M.jsonErr([403], ProblemDetailsError$schema()), M.fail("4XX"));
+    const [result] = await matchFn(problemJson(403, PROBLEM_403), req);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(DefaultError);
+    }
+  });
+
+  test("POST-FIX shape: jsonErr with ctype application/problem+json MATCHES → ProblemDetailsError", async () => {
+    // This is exactly what Speakeasy emits for a re-keyed (problem+json) spec
+    // response: M.jsonErr([403], schema, { ctype: "application/problem+json" }).
+    const matchFn = M.match(
+      M.jsonErr([403], ProblemDetailsError$schema(), {
+        ctype: "application/problem+json",
+      }),
+      M.fail("4XX"),
+    );
+    const [result] = await matchFn(problemJson(403, PROBLEM_403), req);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(ProblemDetailsError);
+      expect(result.error).not.toBeInstanceOf(DefaultError);
+      const e = result.error as ProblemDetailsError;
+      expect(e.status).toBe(403);
+      expect(e.title).toBe("forbidden");
+      expect(e.type).toBe("https://signum.dev/problems/forbidden");
+    }
+  });
+
+  test("POST-FIX 428: jsonErr(428, ..., problem+json ctype) types the injected 428", async () => {
+    const body = {
+      type: "https://signum.dev/problems/mfa-enrollment-required",
+      title: "mfa_enrollment_required",
+      status: 428,
+      detail: "MFA enrollment is required for your organization.",
+    };
+    const matchFn = M.match(
+      M.jsonErr(428, ProblemDetailsError$schema(), {
+        ctype: "application/problem+json",
+      }),
+      M.fail("4XX"),
+    );
+    const [result] = await matchFn(problemJson(428, body), req);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(ProblemDetailsError);
+      const e = result.error as ProblemDetailsError;
+      expect(e.status).toBe(428);
+      expect(e.title).toBe("mfa_enrollment_required");
+    }
+  });
+});
+
+/**
+ * The generated inbound schema for ProblemDetailsError. Imported lazily so
+ * the test reads the real generated schema (same one the funcs use), not a
+ * hand-rolled copy.
+ */
+function ProblemDetailsError$schema() {
+  // eslint-disable-next-line @typescript-eslint/no-var-requires
+  const mod = require("../src/models/errors/problem-details-error");
+  return mod.ProblemDetailsError$inboundSchema;
+}

package/tests/problem-details-error.test.ts

@@ -0,0 +1,134 @@
+/**
+ * ProblemDetailsError wiring test
+ *
+ * Verifies that the Speakeasy overlay renamed ProblemDetailError to
+ * ProblemDetailsError and that the class is properly exported,
+ * extends the correct base class, and supports type narrowing.
+ *
+ * Fails if the overlay is disconnected or the generated SDK reverts
+ * to the old name.
+ */
+import { describe, expect, test } from "bun:test";
+// Also verify the old name is NOT exported (breaking change confirmation)
+import * as allErrors from "../src/models/errors";
+// Import from the barrel — proves the index.ts wires the export
+import { DefaultError, ProblemDetailsError, SDKError } from "../src/models/errors";
+
+describe("ProblemDetailsError (SIG-834 wiring)", () => {
+  test("ProblemDetailsError is exported from models/errors barrel", () => {
+    expect(ProblemDetailsError).toBeDefined();
+    expect(typeof ProblemDetailsError).toBe("function");
+  });
+
+  test("old ProblemDetailError name is no longer exported", () => {
+    expect("ProblemDetailError" in allErrors).toBe(false);
+    expect("ProblemDetailErrorData" in allErrors).toBe(false);
+  });
+
+  test("extends SDKError (inheritance chain)", () => {
+    const mockRequest = new Request("http://localhost:5000/test");
+    const mockResponse = new Response("", { status: 403 });
+
+    const err = new ProblemDetailsError(
+      {
+        type: "urn:signum:error:kyc-required",
+        title: "Forbidden",
+        status: 403,
+        detail: "Organization KYC not approved",
+        instance: "/attestations/test-123",
+      },
+      { response: mockResponse, request: mockRequest, body: "" },
+    );
+
+    // Inheritance chain
+    expect(err).toBeInstanceOf(ProblemDetailsError);
+    expect(err).toBeInstanceOf(SDKError);
+    expect(err).toBeInstanceOf(Error);
+
+    // NOT an instance of sibling class
+    expect(err).not.toBeInstanceOf(DefaultError);
+  });
+
+  test("typed fields are accessible after construction", () => {
+    const mockRequest = new Request("http://localhost:5000/test");
+    const mockResponse = new Response("", { status: 422 });
+
+    const err = new ProblemDetailsError(
+      {
+        type: "urn:signum:error:validation",
+        title: "Unprocessable Entity",
+        status: 422,
+        detail: "Invalid wallet address format",
+        instance: "/wallets/create",
+        resolution_hints: ["Use a valid EVM address"],
+      },
+      { response: mockResponse, request: mockRequest, body: "" },
+    );
+
+    expect(err.type).toBe("urn:signum:error:validation");
+    expect(err.title).toBe("Unprocessable Entity");
+    expect(err.status).toBe(422);
+    expect(err.detail).toBe("Invalid wallet address format");
+    expect(err.instance).toBe("/wallets/create");
+  });
+
+  test("additional properties accessible via data$", () => {
+    const mockRequest = new Request("http://localhost:5000/test");
+    const mockResponse = new Response("", { status: 403 });
+
+    const err = new ProblemDetailsError(
+      {
+        type: "urn:signum:error:kyc-required",
+        title: "Forbidden",
+        status: 403,
+        resolution_hints: ["Complete KYC verification"],
+        failed_checks: ["org_kyc_approved"],
+      },
+      { response: mockResponse, request: mockRequest, body: "" },
+    );
+
+    expect(err.data$["resolution_hints"]).toEqual(["Complete KYC verification"]);
+    expect(err.data$["failed_checks"]).toEqual(["org_kyc_approved"]);
+  });
+
+  test("type narrowing via instanceof works in catch block", () => {
+    const mockRequest = new Request("http://localhost:5000/test");
+    const mockResponse = new Response("", { status: 429 });
+
+    const thrown: unknown = new ProblemDetailsError(
+      {
+        type: "urn:signum:error:rate-limited",
+        title: "Too Many Requests",
+        status: 429,
+      },
+      { response: mockResponse, request: mockRequest, body: "" },
+    );
+
+    // Simulate catch block narrowing
+    let narrowed = false;
+    try {
+      throw thrown;
+    } catch (e: unknown) {
+      if (e instanceof ProblemDetailsError) {
+        // TypeScript narrows e to ProblemDetailsError here
+        expect(e.status).toBe(429);
+        expect(e.title).toBe("Too Many Requests");
+        expect(e.statusCode).toBe(429); // from SDKError base
+        narrowed = true;
+      }
+    }
+    expect(narrowed).toBe(true);
+  });
+
+  test("name property is set correctly", () => {
+    const mockRequest = new Request("http://localhost:5000/test");
+    const mockResponse = new Response("", { status: 500 });
+
+    const err = new ProblemDetailsError(
+      { title: "Internal Server Error", status: 500 },
+      { response: mockResponse, request: mockRequest, body: "" },
+    );
+
+    expect(err.name).toBe("ProblemDetailsError");
+  });
+});

package/tests/problem-details-matcher.test.ts

@@ -0,0 +1,166 @@
+/**
+ * POST-REGEN ACCEPTANCE oracle.
+ *
+ * This is NOT wired into the required in-PR CI gate (see `test:sdk:acceptance`
+ * in package.json — deliberately separate from `test:sdk:mechanism`). It is the
+ * acceptance check that goes GREEN on the SDK-REGEN PR, not on this
+ * spec/pipeline-fix PR.
+ *
+ * The published SDK's generated error-matchers key on `application/json`, but
+ * the API runtime correctly returns `application/problem+json` (RFC 9457). Every
+ * 4xx/5xx therefore misses the `ProblemDetailsError` matcher and falls
+ * through to `DefaultError`, stripping the typed problem fields. The
+ * `428 mfa_enrollment_required` response is undeclared in the spec, so the SDK
+ * has no 428 type at all.
+ *
+ * This test drives the REAL generated function (`patchOrgsByOrgIdSecurity`) via
+ * a custom `HTTPClient` fetcher that returns a mocked `application/problem+json`
+ * Response, so the actual `M.match(...)` chain in the generated code runs. It is
+ * therefore a genuine wiring test — it fails if the spec fix does not reach the
+ * generated matcher, and it cannot be satisfied by mocks.
+ *
+ * RED (pre-regen): generated matchers emit bare `M.jsonErr(codes, schema)` with
+ * no `ctype` override → default `application/json` → problem+json body misses →
+ * `DefaultError`; and no 428 matcher exists at all.
+ *
+ * GREEN (post-regen): matchers carry `{ ctype: "application/problem+json" }` and
+ * a 428 matcher exists → the problem+json body yields `ProblemDetailsError`
+ * with typed fields.
+ *
+ * STATE / DELIVERY MODEL: this oracle is RED until the SDK is REGENERATED from
+ * the re-keyed `docs/api/openapi.json`. That regen is CI-DRIVEN — the
+ * `sdk_generation_typescript.yaml` generate-action (`mode: pr`) reads the fixed
+ * `docs/api/openapi.json` and opens a separate regen PR that rewrites
+ * `packages/ts-sdk`. This oracle flips GREEN on THAT regen PR. It is NOT satisfied
+ * by a local `speakeasy run` / a committed `packages/ts-sdk` in this PR, and it is
+ * intentionally excluded from the required in-PR gate so it never blocks this
+ * spec-fix PR on an artifact CI produces downstream. The matcher-layer mechanism
+ * it relies on is proven GREEN NOW in
+ * `tests/problem-details-ctype-propagation.test.ts` (the same real `M.match`
+ * chain, driven with the exact post-regen matcher shape) — that is the required
+ * in-PR gate. Do NOT hand-edit generated funcs to force this green — regenerate.
+ */
+import { describe, expect, test } from "bun:test";
+import { Clossir } from "../src";
+import { HTTPClient } from "../src/lib/http";
+import { DefaultError } from "../src/models/errors/default-error";
+import { ProblemDetailsError } from "../src/models/errors/problem-details-error";
+
+/** A valid RFC 9457 ProblemDetail body served as `application/problem+json`. */
+function problemJsonResponse(status: number, body: Record<string, unknown>): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/problem+json" },
+  });
+}
+
+/** Build a Clossir SDK whose transport returns a fixed mocked Response. */
+function sdkReturning(response: Response): InstanceType<typeof Clossir> {
+  const httpClient = new HTTPClient({
+    // Speakeasy's Fetcher signature; we ignore the request and return the fixture.
+    fetcher: async () => response.clone(),
+  });
+  return new Clossir({ serverURL: "http://localhost:9999", httpClient });
+}
+
+const PROBLEM_403 = {
+  type: "https://signum.dev/problems/forbidden",
+  title: "forbidden",
+  status: 403,
+  detail: "You do not have permission to update this org security policy.",
+  instance: "/orgs/org_123/security",
+};
+
+const PROBLEM_428 = {
+  type: "https://signum.dev/problems/mfa-enrollment-required",
+  title: "mfa_enrollment_required",
+  status: 428,
+  detail: "MFA enrollment is required for your organization.",
+  instance: "/orgs/org_123/security",
+};
+
+// A ProblemDetail body keyed by a status this generated func DECLARES as an
+// error matcher (404), so the ONLY reason a miss can occur pre-fix is the
+// content-type mismatch — isolating the re-key defect precisely.
+const PROBLEM_404 = {
+  type: "https://signum.dev/problems/not-found",
+  title: "not_found",
+  status: 404,
+  detail: "Organization not found.",
+  instance: "/orgs/org_123/security",
+};
+
+describe("problem+json SDK error typing (generated matcher)", () => {
+  test("declared-error problem+json (404) → ProblemDetailsError, not DefaultError", async () => {
+    const sdk = sdkReturning(problemJsonResponse(404, PROBLEM_404));
+
+    let caught: unknown;
+    try {
+      await sdk.organizations.patchOrgsByOrgIdSecurity("org_123", {
+        requireMfa: true,
+      });
+      throw new Error("expected the SDK call to throw a typed error");
+    } catch (err) {
+      caught = err;
+    }
+
+    // Post-fix: the re-keyed spec makes the generated matcher carry
+    // ctype:"application/problem+json", so this is a typed ProblemDetails error.
+    expect(caught).toBeInstanceOf(ProblemDetailsError);
+    expect(caught).not.toBeInstanceOf(DefaultError);
+    if (caught instanceof ProblemDetailsError) {
+      expect(caught.status).toBe(404);
+      expect(caught.title).toBe("not_found");
+      expect(caught.type).toBe("https://signum.dev/problems/not-found");
+      expect(caught.detail).toBe("Organization not found.");
+      expect(caught.instance).toBe("/orgs/org_123/security");
+    }
+  });
+
+  test("403 problem+json also types as ProblemDetailsError once declared", async () => {
+    // 403 is not a per-status matcher on this func, but the re-keyed spec +
+    // regen widen the error matcher family; if a 403 matcher is present it must
+    // type as ProblemDetails. This guards the general re-key propagation.
+    const sdk = sdkReturning(problemJsonResponse(403, PROBLEM_403));
+
+    let caught: unknown;
+    try {
+      await sdk.organizations.patchOrgsByOrgIdSecurity("org_123", {
+        requireMfa: true,
+      });
+      throw new Error("expected the SDK call to throw");
+    } catch (err) {
+      caught = err;
+    }
+
+    // The func declares 404/409/500 + 428 (post-fix) as ProblemDetails and
+    // M.fail("4XX") as the catch-all. A 403 with NO explicit matcher still falls
+    // to M.fail → DefaultError even post-fix; that is expected. The
+    // load-bearing assertion is the 404 (declared) and 428 (injected) cases.
+    // We assert only that a problem+json body never silently succeeds.
+    expect(caught).toBeDefined();
+  });
+
+  test("428 mfa_enrollment_required problem+json → typed 428 ProblemDetailsError", async () => {
+    const sdk = sdkReturning(problemJsonResponse(428, PROBLEM_428));
+
+    let caught: unknown;
+    try {
+      await sdk.organizations.patchOrgsByOrgIdSecurity("org_123", {
+        requireMfa: true,
+      });
+      throw new Error("expected the SDK call to throw a typed 428 error");
+    } catch (err) {
+      caught = err;
+    }
+
+    // Post-fix: 428 is injected into the spec for this non-allowlisted op and
+    // regenerated as an application/problem+json matcher → typed 428.
+    expect(caught).toBeInstanceOf(ProblemDetailsError);
+    expect(caught).not.toBeInstanceOf(DefaultError);
+    if (caught instanceof ProblemDetailsError) {
+      expect(caught.status).toBe(428);
+      expect(caught.title).toBe("mfa_enrollment_required");
+    }
+  });
+});