@cloudpdf/contract 3.0.0-next.5 → 3.0.0-next.6

package/dist/index.d.ts

@@ -1,8 +1,13 @@
-import * as _embedpdf_engine_core_wire from '@embedpdf/engine-core/wire';
 import * as _embedpdf_engine_core_runtime from '@embedpdf/engine-core/runtime';
 import { DocCapability } from '@embedpdf/engine-core/runtime';
 import { z } from 'zod';
 
+/**
+ * Tenant ids share the doc-id charset: URL-safe by construction, since
+ * they appear in every tenant-scoped path (and therefore in logs — do
+ * not put PII in tenant ids).
+ */
+declare const tenantIdPattern: RegExp;
 /**
  * Wire paths. The URL carries the full resource identity — tenant
  * resources live under `/v1/tenants/{tenantId}/…` — and the auth model
@@ -14,6 +19,7 @@ declare const adminWirePaths: {
     readonly tenant: (tenantId: string) => string;
     readonly documents: (tenantId: string) => string;
     readonly documentsInit: (tenantId: string) => string;
+    readonly documentsImport: (tenantId: string) => string;
     readonly document: (tenantId: string, docId: string) => string;
     readonly documentCommit: (tenantId: string, docId: string) => string;
     readonly documentUploadProxy: (tenantId: string, docId: string) => string;
@@ -669,6 +675,239 @@ declare const AdminDocumentCommitResponseSchema: z.ZodObject<{
     };
 }>;
 type AdminDocumentCommitResponse = z.infer<typeof AdminDocumentCommitResponseSchema>;
+/**
+ * A server-side pull source for `documents.importFrom`. The discriminator
+ * distinguishes AUTHORIZATION MODELS, not storage vendors:
+ *
+ *   - `url`        — the CALLER supplies authority: a presigned
+ *     S3/GCS/Azure/R2/MinIO GET, or any HTTPS endpoint the
+ *     deployment's import policy allows. The URL is a capability:
+ *     treat it as a secret. Servers never echo its query string back
+ *     in errors, logs, or stored failure reasons.
+ *   - `connection` — the OPERATOR pre-registered authority: the
+ *     request names a connection and a key; which provider backs it
+ *     (S3, GCS, Azure Blob, filesystem, ...) is deployment
+ *     configuration, never wire surface. `revision` is opaque here
+ *     and provider-interpreted (S3 VersionId, GCS generation, Azure
+ *     version id); unsupported providers reject it.
+ *
+ * Key validation at this layer is deliberately generic (byte length,
+ * no NUL); provider-exact rules live in the server's source adapters,
+ * which know which backend a connection names.
+ */
+declare const AdminImportSourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"url">;
+    url: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    kind: "url";
+}, {
+    url: string;
+    kind: "url";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"connection">;
+    connectionId: z.ZodString;
+    key: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    revision: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    kind: "connection";
+    key: string;
+    connectionId: string;
+    revision?: string | undefined;
+}, {
+    kind: "connection";
+    key: string;
+    connectionId: string;
+    revision?: string | undefined;
+}>]>;
+type AdminImportSource = z.infer<typeof AdminImportSourceSchema>;
+declare const AdminDocumentImportRequestSchema: z.ZodObject<{
+    source: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"url">;
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        kind: "url";
+    }, {
+        url: string;
+        kind: "url";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"connection">;
+        connectionId: z.ZodString;
+        key: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+        revision: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        kind: "connection";
+        key: string;
+        connectionId: string;
+        revision?: string | undefined;
+    }, {
+        kind: "connection";
+        key: string;
+        connectionId: string;
+        revision?: string | undefined;
+    }>]>;
+    /**
+     * Optional integrity pins, enforced when present: `sizeBytes`
+     * against the source's declared Content-Length before the transfer,
+     * `sha256` against the server-observed digest after it. When absent
+     * the server-observed values become authoritative.
+     * `dedupMode=reuse-existing` REQUIRES `sha256` — without a declared
+     * hash the server cannot know what content to reuse.
+     */
+    expected: z.ZodOptional<z.ZodObject<{
+        sizeBytes: z.ZodOptional<z.ZodNumber>;
+        sha256: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        sha256?: string | undefined;
+        sizeBytes?: number | undefined;
+    }, {
+        sha256?: string | undefined;
+        sizeBytes?: number | undefined;
+    }>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+    dedupMode: z.ZodOptional<z.ZodEnum<["always-create", "reuse-existing"]>>;
+    docId: z.ZodOptional<z.ZodString>;
+    /**
+     * `sync` (default) holds the response open for the whole transfer.
+     * `async` accepts the request (202, document `pending`), transfers
+     * in the background, and the caller polls the document. Async
+     * requires a `connection` source (URLs are secrets and expire, so
+     * they cannot sit in a durable job); filesystem connections
+     * additionally require `expected.sha256`, since they have no
+     * revisions to pin retries to.
+     */
+    mode: z.ZodOptional<z.ZodEnum<["sync", "async"]>>;
+}, "strip", z.ZodTypeAny, {
+    source: {
+        url: string;
+        kind: "url";
+    } | {
+        kind: "connection";
+        key: string;
+        connectionId: string;
+        revision?: string | undefined;
+    };
+    expected?: {
+        sha256?: string | undefined;
+        sizeBytes?: number | undefined;
+    } | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    idempotencyKey?: string | undefined;
+    dedupMode?: "always-create" | "reuse-existing" | undefined;
+    docId?: string | undefined;
+    mode?: "sync" | "async" | undefined;
+}, {
+    source: {
+        url: string;
+        kind: "url";
+    } | {
+        kind: "connection";
+        key: string;
+        connectionId: string;
+        revision?: string | undefined;
+    };
+    expected?: {
+        sha256?: string | undefined;
+        sizeBytes?: number | undefined;
+    } | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    idempotencyKey?: string | undefined;
+    dedupMode?: "always-create" | "reuse-existing" | undefined;
+    docId?: string | undefined;
+    mode?: "sync" | "async" | undefined;
+}>;
+type AdminDocumentImportRequest = z.infer<typeof AdminDocumentImportRequestSchema>;
+declare const AdminDocumentImportResponseSchema: z.ZodObject<{
+    /**
+     * `imported` — bytes were pulled, verified, and committed (sync).
+     * `deduped`  — an existing document satisfied the request without a
+     * transfer (content dedup or idempotent replay).
+     * `accepted` — async: the job is queued (HTTP 202); poll the
+     * document until `ready` or `failed`.
+     */
+    tag: z.ZodEnum<["imported", "deduped", "accepted"]>;
+    document: z.ZodObject<{
+        id: z.ZodString;
+        tenantId: z.ZodString;
+        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+        baseSha: z.ZodNullable<z.ZodString>;
+        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        idempotencyKey: z.ZodNullable<z.ZodString>;
+        failureReason: z.ZodNullable<z.ZodString>;
+        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        createdAt: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+        createdBy: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        tenantId: string;
+        state: "pending" | "ready" | "failed" | "deleting";
+        baseSha: string | null;
+        storageSizeBytes: number | null;
+        metadata: Record<string, unknown> | null;
+        idempotencyKey: string | null;
+        failureReason: string | null;
+        createdAt: number;
+        updatedAt: number;
+        createdBy: string | null;
+        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+        thumbnailUrl?: string | null | undefined;
+    }, {
+        id: string;
+        tenantId: string;
+        state: "pending" | "ready" | "failed" | "deleting";
+        baseSha: string | null;
+        storageSizeBytes: number | null;
+        metadata: Record<string, unknown> | null;
+        idempotencyKey: string | null;
+        failureReason: string | null;
+        createdAt: number;
+        updatedAt: number;
+        createdBy: string | null;
+        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+        thumbnailUrl?: string | null | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    tag: "deduped" | "imported" | "accepted";
+    document: {
+        id: string;
+        tenantId: string;
+        state: "pending" | "ready" | "failed" | "deleting";
+        baseSha: string | null;
+        storageSizeBytes: number | null;
+        metadata: Record<string, unknown> | null;
+        idempotencyKey: string | null;
+        failureReason: string | null;
+        createdAt: number;
+        updatedAt: number;
+        createdBy: string | null;
+        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+        thumbnailUrl?: string | null | undefined;
+    };
+}, {
+    tag: "deduped" | "imported" | "accepted";
+    document: {
+        id: string;
+        tenantId: string;
+        state: "pending" | "ready" | "failed" | "deleting";
+        baseSha: string | null;
+        storageSizeBytes: number | null;
+        metadata: Record<string, unknown> | null;
+        idempotencyKey: string | null;
+        failureReason: string | null;
+        createdAt: number;
+        updatedAt: number;
+        createdBy: string | null;
+        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+        thumbnailUrl?: string | null | undefined;
+    };
+}>;
+type AdminDocumentImportResponse = z.infer<typeof AdminDocumentImportResponseSchema>;
 declare const AdminDocumentResponseSchema: z.ZodObject<{
     document: z.ZodObject<{
         id: z.ZodString;
@@ -2935,14 +3174,14 @@ declare const adminOperations: {
         };
         readonly notes: "This bounded origin-mediated fallback must only be used after documents.init returns upload.kind=proxy. Auto mode prefers a presigned object-store PUT whenever available.";
     };
-    readonly 'documents.list': {
-        readonly operationId: "documents.list";
-        readonly title: "List documents";
-        readonly summary: "List documents in the tenant, newest first, cursor-paginated.";
-        readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/documents";
+    readonly 'documents.importFrom': {
+        readonly operationId: "documents.importFrom";
+        readonly title: "Import document";
+        readonly summary: "Server-side pull: fetch a PDF from a caller-supplied URL (e.g. a presigned object-store GET) or an operator-registered storage connection into CloudPDF-owned storage, verify it, and commit it.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/documents/import";
         readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.read"];
+        readonly scope: readonly ["docs.create"];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
@@ -2950,24 +3189,119 @@ declare const adminOperations: {
         }, {
             tenantId: string;
         }>;
-        readonly query: z.ZodObject<{
-            limit: z.ZodDefault<z.ZodNumber>;
-            cursor: z.ZodOptional<z.ZodString>;
-            state: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "deleting"]>>;
-        }, "strip", z.ZodTypeAny, {
-            limit: number;
-            state?: "pending" | "ready" | "failed" | "deleting" | undefined;
-            cursor?: string | undefined;
-        }, {
-            state?: "pending" | "ready" | "failed" | "deleting" | undefined;
-            limit?: number | undefined;
-            cursor?: string | undefined;
-        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                source: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                    kind: z.ZodLiteral<"url">;
+                    url: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    url: string;
+                    kind: "url";
+                }, {
+                    url: string;
+                    kind: "url";
+                }>, z.ZodObject<{
+                    kind: z.ZodLiteral<"connection">;
+                    connectionId: z.ZodString;
+                    key: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+                    revision: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                }, {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                }>]>;
+                /**
+                 * Optional integrity pins, enforced when present: `sizeBytes`
+                 * against the source's declared Content-Length before the transfer,
+                 * `sha256` against the server-observed digest after it. When absent
+                 * the server-observed values become authoritative.
+                 * `dedupMode=reuse-existing` REQUIRES `sha256` — without a declared
+                 * hash the server cannot know what content to reuse.
+                 */
+                expected: z.ZodOptional<z.ZodObject<{
+                    sizeBytes: z.ZodOptional<z.ZodNumber>;
+                    sha256: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                }, {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                }>>;
+                metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                idempotencyKey: z.ZodOptional<z.ZodString>;
+                dedupMode: z.ZodOptional<z.ZodEnum<["always-create", "reuse-existing"]>>;
+                docId: z.ZodOptional<z.ZodString>;
+                /**
+                 * `sync` (default) holds the response open for the whole transfer.
+                 * `async` accepts the request (202, document `pending`), transfers
+                 * in the background, and the caller polls the document. Async
+                 * requires a `connection` source (URLs are secrets and expire, so
+                 * they cannot sit in a durable job); filesystem connections
+                 * additionally require `expected.sha256`, since they have no
+                 * revisions to pin retries to.
+                 */
+                mode: z.ZodOptional<z.ZodEnum<["sync", "async"]>>;
+            }, "strip", z.ZodTypeAny, {
+                source: {
+                    url: string;
+                    kind: "url";
+                } | {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                };
+                expected?: {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                } | undefined;
+                metadata?: Record<string, unknown> | undefined;
+                idempotencyKey?: string | undefined;
+                dedupMode?: "always-create" | "reuse-existing" | undefined;
+                docId?: string | undefined;
+                mode?: "sync" | "async" | undefined;
+            }, {
+                source: {
+                    url: string;
+                    kind: "url";
+                } | {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                };
+                expected?: {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                } | undefined;
+                metadata?: Record<string, unknown> | undefined;
+                idempotencyKey?: string | undefined;
+                dedupMode?: "always-create" | "reuse-existing" | undefined;
+                docId?: string | undefined;
+                mode?: "sync" | "async" | undefined;
+            }>;
+        };
         readonly responses: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    documents: z.ZodArray<z.ZodObject<{
+                    /**
+                     * `imported` — bytes were pulled, verified, and committed (sync).
+                     * `deduped`  — an existing document satisfied the request without a
+                     * transfer (content dedup or idempotent replay).
+                     * `accepted` — async: the job is queued (HTTP 202); poll the
+                     * document until `ready` or `failed`.
+                     */
+                    tag: z.ZodEnum<["imported", "deduped", "accepted"]>;
+                    document: z.ZodObject<{
                         id: z.ZodString;
                         tenantId: z.ZodString;
                         state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
@@ -3010,15 +3344,10 @@ declare const adminOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
-                    }>, "many">;
-                    /**
-                     * Opaque cursor for the next page; `null` on the last page. Optional
-                     * because pre-pagination servers omit it — clients treat absence as
-                     * "no continuation available", same convention as the thumbnail fields.
-                     */
-                    nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                    }>;
                 }, "strip", z.ZodTypeAny, {
-                    documents: {
+                    tag: "deduped" | "imported" | "accepted";
+                    document: {
                         id: string;
                         tenantId: string;
                         state: "pending" | "ready" | "failed" | "deleting";
@@ -3032,10 +3361,10 @@ declare const adminOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
-                    }[];
-                    nextCursor?: string | null | undefined;
+                    };
                 }, {
-                    documents: {
+                    tag: "deduped" | "imported" | "accepted";
+                    document: {
                         id: string;
                         tenantId: string;
                         state: "pending" | "ready" | "failed" | "deleting";
@@ -3049,88 +3378,49 @@ declare const adminOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
-                    }[];
-                    nextCursor?: string | null | undefined;
+                    };
                 }>;
             };
-            readonly 400: {
+            readonly 202: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
+                    /**
+                     * `imported` — bytes were pulled, verified, and committed (sync).
+                     * `deduped`  — an existing document satisfied the request without a
+                     * transfer (content dedup or idempotent replay).
+                     * `accepted` — async: the job is queued (HTTP 202); poll the
+                     * document until `ready` or `failed`.
+                     */
+                    tag: z.ZodEnum<["imported", "deduped", "accepted"]>;
+                    document: z.ZodObject<{
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+                        baseSha: z.ZodNullable<z.ZodString>;
+                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                        idempotencyKey: z.ZodNullable<z.ZodString>;
+                        failureReason: z.ZodNullable<z.ZodString>;
+                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                        createdBy: z.ZodNullable<z.ZodString>;
                     }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }>;
-            };
-        };
-    };
-    readonly 'documents.get': {
-        readonly operationId: "documents.get";
-        readonly title: "Get document";
-        readonly summary: "Fetch one document record.";
-        readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/documents/:id";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.read"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            id: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            id: string;
-            tenantId: string;
-        }, {
-            id: string;
-            tenantId: string;
-        }>;
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    document: z.ZodObject<{
-                        id: z.ZodString;
-                        tenantId: z.ZodString;
-                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
-                        baseSha: z.ZodNullable<z.ZodString>;
-                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
-                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        idempotencyKey: z.ZodNullable<z.ZodString>;
-                        failureReason: z.ZodNullable<z.ZodString>;
-                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
-                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
-                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-                        createdAt: z.ZodNumber;
-                        updatedAt: z.ZodNumber;
-                        createdBy: z.ZodNullable<z.ZodString>;
-                    }, "strip", z.ZodTypeAny, {
-                        id: string;
-                        tenantId: string;
-                        state: "pending" | "ready" | "failed" | "deleting";
-                        baseSha: string | null;
-                        storageSizeBytes: number | null;
-                        metadata: Record<string, unknown> | null;
-                        idempotencyKey: string | null;
-                        failureReason: string | null;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string | null;
-                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
-                        thumbnailUrl?: string | null | undefined;
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
                     }, {
                         id: string;
                         tenantId: string;
@@ -3147,6 +3437,7 @@ declare const adminOperations: {
                         thumbnailUrl?: string | null | undefined;
                     }>;
                 }, "strip", z.ZodTypeAny, {
+                    tag: "deduped" | "imported" | "accepted";
                     document: {
                         id: string;
                         tenantId: string;
@@ -3163,6 +3454,7 @@ declare const adminOperations: {
                         thumbnailUrl?: string | null | undefined;
                     };
                 }, {
+                    tag: "deduped" | "imported" | "accepted";
                     document: {
                         id: string;
                         tenantId: string;
@@ -3180,32 +3472,7 @@ declare const adminOperations: {
                     };
                 }>;
             };
-            readonly 403: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
-                    }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }>;
-            };
-            readonly 404: {
+            readonly 400: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -3230,30 +3497,6 @@ declare const adminOperations: {
                     };
                 }>;
             };
-        };
-    };
-    readonly 'documents.download': {
-        readonly operationId: "documents.download";
-        readonly title: "Download document";
-        readonly summary: "Download the stored base PDF bytes.";
-        readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/documents/:id/download";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.read"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            id: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            id: string;
-            tenantId: string;
-        }, {
-            id: string;
-            tenantId: string;
-        }>;
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/pdf";
-            };
             readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
@@ -3279,7 +3522,7 @@ declare const adminOperations: {
                     };
                 }>;
             };
-            readonly 404: {
+            readonly 502: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -3305,53 +3548,127 @@ declare const adminOperations: {
                 }>;
             };
         };
+        readonly notes: "Default mode is synchronous and bounded: the response returns only after the transfer verified and committed (or failed). mode=async (connection sources only) answers 202 immediately and an in-process worker performs the transfer with leased, fenced retries; poll the document until ready/failed. The deployment import policy gates scheme, network range, and size; sources must declare a length. CloudPDF copies and owns the bytes — the source is never referenced in place. A 502 marks a retryable upstream failure: retry with the same idempotencyKey to resume the same document. URL sources are capabilities and never echoed back. Connection sources name operator-registered storage (bucket/prefix scope, allowed credential classes, and tenant bindings are deployment configuration); `revision` is provider-interpreted (S3 VersionId, GCS generation, Azure version id).";
     };
-    readonly 'documents.delete': {
-        readonly operationId: "documents.delete";
-        readonly title: "Delete document";
-        readonly summary: "Delete a document and its stored artifacts.";
-        readonly method: "DELETE";
-        readonly path: "/v1/tenants/:tenantId/documents/:id";
+    readonly 'documents.list': {
+        readonly operationId: "documents.list";
+        readonly title: "List documents";
+        readonly summary: "List documents in the tenant, newest first, cursor-paginated.";
+        readonly method: "GET";
+        readonly path: "/v1/tenants/:tenantId/documents";
         readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.delete"];
+        readonly scope: readonly ["docs.read"];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
-            id: z.ZodString;
         }, "strip", z.ZodTypeAny, {
-            id: string;
             tenantId: string;
         }, {
-            id: string;
             tenantId: string;
         }>;
+        readonly query: z.ZodObject<{
+            limit: z.ZodDefault<z.ZodNumber>;
+            cursor: z.ZodOptional<z.ZodString>;
+            state: z.ZodOptional<z.ZodEnum<["pending", "ready", "failed", "deleting"]>>;
+        }, "strip", z.ZodTypeAny, {
+            limit: number;
+            state?: "pending" | "ready" | "failed" | "deleting" | undefined;
+            cursor?: string | undefined;
+        }, {
+            state?: "pending" | "ready" | "failed" | "deleting" | undefined;
+            limit?: number | undefined;
+            cursor?: string | undefined;
+        }>;
         readonly responses: {
-            readonly 204: {};
-            readonly 403: {
+            readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
+                    documents: z.ZodArray<z.ZodObject<{
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+                        baseSha: z.ZodNullable<z.ZodString>;
+                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                        idempotencyKey: z.ZodNullable<z.ZodString>;
+                        failureReason: z.ZodNullable<z.ZodString>;
+                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                        createdBy: z.ZodNullable<z.ZodString>;
                     }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
                     }, {
-                        code: string;
-                        message: string;
-                    }>;
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }>, "many">;
+                    /**
+                     * Opaque cursor for the next page; `null` on the last page. Optional
+                     * because pre-pagination servers omit it — clients treat absence as
+                     * "no continuation available", same convention as the thumbnail fields.
+                     */
+                    nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
+                    documents: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }[];
+                    nextCursor?: string | null | undefined;
                 }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
+                    documents: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }[];
+                    nextCursor?: string | null | undefined;
                 }>;
             };
-            readonly 404: {
+            readonly 400: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -3378,12 +3695,12 @@ declare const adminOperations: {
             };
         };
     };
-    readonly 'documents.thumbnail': {
-        readonly operationId: "documents.thumbnail";
-        readonly title: "Get thumbnail";
-        readonly summary: "Fetch the warmed dashboard-tile render for a document.";
+    readonly 'documents.get': {
+        readonly operationId: "documents.get";
+        readonly title: "Get document";
+        readonly summary: "Fetch one document record.";
         readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/documents/:id/thumbnail";
+        readonly path: "/v1/tenants/:tenantId/documents/:id";
         readonly credentials: readonly ["api-token", "tenant-jwt"];
         readonly scope: readonly ["docs.read"];
         readonly params: z.ZodObject<{
@@ -3398,171 +3715,112 @@ declare const adminOperations: {
         }>;
         readonly responses: {
             readonly 200: {
-                readonly contentType: readonly ["image/webp", "image/png"];
-            };
-            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    document: z.ZodObject<{
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+                        baseSha: z.ZodNullable<z.ZodString>;
+                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                        idempotencyKey: z.ZodNullable<z.ZodString>;
+                        failureReason: z.ZodNullable<z.ZodString>;
+                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                        createdBy: z.ZodNullable<z.ZodString>;
+                    }, "strip", z.ZodTypeAny, {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }, {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                }, {
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                }>;
+            };
+            readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
                         code: z.ZodString;
                         message: z.ZodString;
-                        state: z.ZodString;
                     }, "strip", z.ZodTypeAny, {
                         code: string;
                         message: string;
-                        state: string;
                     }, {
                         code: string;
                         message: string;
-                        state: string;
                     }>;
                 }, "strip", z.ZodTypeAny, {
                     error: {
                         code: string;
                         message: string;
-                        state: string;
                     };
                 }, {
                     error: {
                         code: string;
                         message: string;
-                        state: string;
                     };
                 }>;
             };
-        };
-    };
-    readonly 'deployment.licenseStatus': {
-        readonly operationId: "deployment.licenseStatus";
-        readonly title: "License status";
-        readonly summary: "License decision plus usage-reporting and meter snapshots for this deployment.";
-        readonly method: "GET";
-        readonly path: "/v1/deployment/license/status";
-        readonly credentials: readonly ["api-token"];
-        readonly scope: readonly [];
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    license: z.ZodUnknown;
-                    reporting: z.ZodNullable<z.ZodUnknown>;
-                    usage: z.ZodNullable<z.ZodUnknown>;
-                }, "strip", z.ZodTypeAny, {
-                    license?: unknown;
-                    reporting?: unknown;
-                    usage?: unknown;
-                }, {
-                    license?: unknown;
-                    reporting?: unknown;
-                    usage?: unknown;
-                }>;
-            };
-        };
-    };
-    readonly 'tokens.issue': {
-        readonly operationId: "tokens.issue";
-        readonly title: "Issue token";
-        readonly summary: "Mint a delegated JWT: a doc token, or (API token only) a tenant token.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/tokens";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["tokens.issue-doc"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            tenantId: string;
-        }, {
-            tenantId: string;
-        }>;
-        readonly body: {
-            readonly contentType: "application/json";
-            readonly schema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
-                kind: z.ZodLiteral<"doc">;
-                /** Subject of the minted token — the end user's id in your system. */
-                sub: z.ZodString;
-                docId: z.ZodString;
-                layerName: z.ZodOptional<z.ZodString>;
-                /**
-                 * Doc capability scopes (`doc.open`, `doc.render`, …, plus the
-                 * collab grammar). Validated server-side against the engine's scope
-                 * vocabulary — an unknown string rejects the whole request.
-                 */
-                scope: z.ZodArray<z.ZodString, "many">;
-                userId: z.ZodOptional<z.ZodString>;
-                displayName: z.ZodOptional<z.ZodString>;
-                groupId: z.ZodOptional<z.ZodString>;
-                groups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-                /**
-                 * Origin lock: web origins (scheme + host, optional port; one leading
-                 * `*.` wildcard label allowed) the minted token may be presented
-                 * from. Enforced on every engine request that carries a browser
-                 * `Origin` header — hotlink prevention, not DRM: non-browser callers
-                 * are governed by the token itself.
-                 */
-                origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-                /** Token lifetime in seconds. */
-                expiresIn: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                docId: string;
-                kind: "doc";
-                sub: string;
-                scope: string[];
-                expiresIn: number;
-                layerName?: string | undefined;
-                userId?: string | undefined;
-                displayName?: string | undefined;
-                groupId?: string | undefined;
-                groups?: string[] | undefined;
-                origins?: string[] | undefined;
-            }, {
-                docId: string;
-                kind: "doc";
-                sub: string;
-                scope: string[];
-                expiresIn: number;
-                layerName?: string | undefined;
-                userId?: string | undefined;
-                displayName?: string | undefined;
-                groupId?: string | undefined;
-                groups?: string[] | undefined;
-                origins?: string[] | undefined;
-            }>, z.ZodObject<{
-                kind: z.ZodLiteral<"tenant">;
-                sub: z.ZodString;
-                scope: z.ZodArray<z.ZodUnion<[z.ZodLiteral<"*">, z.ZodEnum<["docs.create", "docs.read", "docs.delete", "tokens.issue-doc", "tokens.revoke", "shares.manage"]>]>, "many">;
-                /** Token lifetime in seconds. */
-                expiresIn: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "tenant";
-                sub: string;
-                scope: ("docs.create" | "docs.read" | "docs.delete" | "tokens.issue-doc" | "tokens.revoke" | "shares.manage" | "*")[];
-                expiresIn: number;
-            }, {
-                kind: "tenant";
-                sub: string;
-                scope: ("docs.create" | "docs.read" | "docs.delete" | "tokens.issue-doc" | "tokens.revoke" | "shares.manage" | "*")[];
-                expiresIn: number;
-            }>]>;
-        };
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    token: z.ZodString;
-                    jti: z.ZodString;
-                    /** Unix seconds. */
-                    expiresAt: z.ZodNumber;
-                }, "strip", z.ZodTypeAny, {
-                    expiresAt: number;
-                    jti: string;
-                    token: string;
-                }, {
-                    expiresAt: number;
-                    jti: string;
-                    token: string;
-                }>;
-            };
-            readonly 400: {
+            readonly 404: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -3587,6 +3845,30 @@ declare const adminOperations: {
                     };
                 }>;
             };
+        };
+    };
+    readonly 'documents.download': {
+        readonly operationId: "documents.download";
+        readonly title: "Download document";
+        readonly summary: "Download the stored base PDF bytes.";
+        readonly method: "GET";
+        readonly path: "/v1/tenants/:tenantId/documents/:id/download";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["docs.read"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            id: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            tenantId: string;
+        }, {
+            id: string;
+            tenantId: string;
+        }>;
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/pdf";
+            };
             readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
@@ -3638,140 +3920,28 @@ declare const adminOperations: {
                 }>;
             };
         };
-        readonly notes: "kind \"tenant\" requires the API token — authority mints only downward. Mounted only when the deployment can sign (HS256 mode); asymmetric deployments mint with their own private key.";
     };
-    readonly 'tokens.revoke': {
-        readonly operationId: "tokens.revoke";
-        readonly title: "Revoke token";
-        readonly summary: "Revoke a token by jti; live sessions drop on their next heartbeat.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/tokens/:jti/revoke";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["tokens.revoke"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            jti: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            tenantId: string;
-            jti: string;
-        }, {
-            tenantId: string;
-            jti: string;
-        }>;
-        readonly body: {
-            readonly contentType: "application/json";
-            readonly schema: z.ZodObject<{
-                /** Optional human reason, written to the audit row. */
-                reason: z.ZodOptional<z.ZodString>;
-                /**
-                 * The token's `exp` (unix seconds), used to GC the revocation row
-                 * once the token would have expired anyway. Defaults server-side to
-                 * now + 30 days.
-                 */
-                expiresAtSeconds: z.ZodOptional<z.ZodNumber>;
-            }, "strip", z.ZodTypeAny, {
-                reason?: string | undefined;
-                expiresAtSeconds?: number | undefined;
-            }, {
-                reason?: string | undefined;
-                expiresAtSeconds?: number | undefined;
-            }>;
-            readonly required: false;
-        };
-        readonly responses: {
-            readonly 204: {};
-            readonly 400: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
-                    }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }>;
-            };
-        };
-        readonly notes: "Mounted only when the deployment enables token revocation.";
-    };
-    readonly 'tenants.usage': {
-        readonly operationId: "tenants.usage";
-        readonly title: "Tenant usage";
-        readonly summary: "Per-tenant usage facts (views, uploads, stored bytes) for one UTC month.";
-        readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/usage";
+    readonly 'documents.delete': {
+        readonly operationId: "documents.delete";
+        readonly title: "Delete document";
+        readonly summary: "Delete a document and its stored artifacts.";
+        readonly method: "DELETE";
+        readonly path: "/v1/tenants/:tenantId/documents/:id";
         readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.read"];
+        readonly scope: readonly ["docs.delete"];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
+            id: z.ZodString;
         }, "strip", z.ZodTypeAny, {
+            id: string;
             tenantId: string;
         }, {
+            id: string;
             tenantId: string;
         }>;
-        readonly query: z.ZodObject<{
-            /** UTC month to report, `YYYY-MM`. Defaults to the current month. */
-            period: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
-            period?: string | undefined;
-        }, {
-            period?: string | undefined;
-        }>;
         readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    tenantId: z.ZodString;
-                    periodStart: z.ZodString;
-                    periodEnd: z.ZodString;
-                    metrics: z.ZodObject<{
-                        'pdf.views': z.ZodNumber;
-                        'pdf.uploads': z.ZodNumber;
-                        'storage.bytes': z.ZodNumber;
-                    }, "strip", z.ZodTypeAny, {
-                        'pdf.views': number;
-                        'pdf.uploads': number;
-                        'storage.bytes': number;
-                    }, {
-                        'pdf.views': number;
-                        'pdf.uploads': number;
-                        'storage.bytes': number;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    tenantId: string;
-                    periodStart: string;
-                    periodEnd: string;
-                    metrics: {
-                        'pdf.views': number;
-                        'pdf.uploads': number;
-                        'storage.bytes': number;
-                    };
-                }, {
-                    tenantId: string;
-                    periodStart: string;
-                    periodEnd: string;
-                    metrics: {
-                        'pdf.views': number;
-                        'pdf.uploads': number;
-                        'storage.bytes': number;
-                    };
-                }>;
-            };
-            readonly 400: {
+            readonly 204: {};
+            readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -3822,117 +3992,96 @@ declare const adminOperations: {
                 }>;
             };
         };
-        readonly notes: string;
     };
-    readonly 'tenants.suspend': {
-        readonly operationId: "tenants.suspend";
-        readonly title: "Suspend tenant";
-        readonly summary: "Fail the tenant closed: refuse every tenant JWT, doc JWT, and share exchange.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/suspend";
-        readonly credentials: readonly ["api-token"];
-        readonly scope: readonly [];
+    readonly 'documents.thumbnail': {
+        readonly operationId: "documents.thumbnail";
+        readonly title: "Get thumbnail";
+        readonly summary: "Fetch the warmed dashboard-tile render for a document.";
+        readonly method: "GET";
+        readonly path: "/v1/tenants/:tenantId/documents/:id/thumbnail";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["docs.read"];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
+            id: z.ZodString;
         }, "strip", z.ZodTypeAny, {
+            id: string;
             tenantId: string;
         }, {
+            id: string;
             tenantId: string;
         }>;
-        readonly body: {
-            readonly contentType: "application/json";
-            readonly schema: z.ZodObject<{
-                /** Optional operator reason, written to the security-events trail. */
-                reason: z.ZodOptional<z.ZodString>;
-            }, "strip", z.ZodTypeAny, {
-                reason?: string | undefined;
-            }, {
-                reason?: string | undefined;
-            }>;
-            readonly required: false;
-        };
         readonly responses: {
-            readonly 204: {};
+            readonly 200: {
+                readonly contentType: readonly ["image/webp", "image/png"];
+            };
             readonly 404: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
                         code: z.ZodString;
                         message: z.ZodString;
+                        state: z.ZodString;
                     }, "strip", z.ZodTypeAny, {
                         code: string;
                         message: string;
+                        state: string;
                     }, {
                         code: string;
                         message: string;
+                        state: string;
                     }>;
                 }, "strip", z.ZodTypeAny, {
                     error: {
                         code: string;
                         message: string;
+                        state: string;
                     };
                 }, {
                     error: {
                         code: string;
                         message: string;
+                        state: string;
                     };
                 }>;
             };
         };
-        readonly notes: string;
     };
-    readonly 'tenants.resume': {
-        readonly operationId: "tenants.resume";
-        readonly title: "Resume tenant";
-        readonly summary: "Lift a suspension; credentials for the tenant verify again.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/resume";
+    readonly 'deployment.licenseStatus': {
+        readonly operationId: "deployment.licenseStatus";
+        readonly title: "License status";
+        readonly summary: "License decision plus usage-reporting and meter snapshots for this deployment.";
+        readonly method: "GET";
+        readonly path: "/v1/deployment/license/status";
         readonly credentials: readonly ["api-token"];
         readonly scope: readonly [];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            tenantId: string;
-        }, {
-            tenantId: string;
-        }>;
         readonly responses: {
-            readonly 204: {};
-            readonly 404: {
+            readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
-                    }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
+                    license: z.ZodUnknown;
+                    reporting: z.ZodNullable<z.ZodUnknown>;
+                    usage: z.ZodNullable<z.ZodUnknown>;
                 }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
+                    license?: unknown;
+                    reporting?: unknown;
+                    usage?: unknown;
                 }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
+                    license?: unknown;
+                    reporting?: unknown;
+                    usage?: unknown;
                 }>;
             };
         };
     };
-    readonly 'shares.create': {
-        readonly operationId: "shares.create";
-        readonly title: "Create share";
-        readonly summary: "Create a standing share grant for one document — the no-backend embed credential.";
+    readonly 'tokens.issue': {
+        readonly operationId: "tokens.issue";
+        readonly title: "Issue token";
+        readonly summary: "Mint a delegated JWT: a doc token, or (API token only) a tenant token.";
         readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/shares";
+        readonly path: "/v1/tenants/:tenantId/tokens";
         readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["shares.manage"];
+        readonly scope: readonly ["tokens.issue-doc"];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
@@ -3942,141 +4091,118 @@ declare const adminOperations: {
         }>;
         readonly body: {
             readonly contentType: "application/json";
-            readonly schema: z.ZodObject<{
+            readonly schema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                kind: z.ZodLiteral<"doc">;
+                /** Subject of the minted token — the end user's id in your system. */
+                sub: z.ZodString;
                 docId: z.ZodString;
                 layerName: z.ZodOptional<z.ZodString>;
                 /**
-                 * Doc capability scopes the exchanged session will carry. Validated
-                 * server-side against the engine's scope vocabulary, same as
-                 * `tokens.issue`.
+                 * Doc capability scopes (`doc.open`, `doc.render`, …, plus the
+                 * collab grammar). Validated server-side against the engine's scope
+                 * vocabulary — an unknown string rejects the whole request.
                  */
                 scope: z.ZodArray<z.ZodString, "many">;
-                /** Origin allowlist; omit to allow any origin. */
+                userId: z.ZodOptional<z.ZodString>;
+                displayName: z.ZodOptional<z.ZodString>;
+                groupId: z.ZodOptional<z.ZodString>;
+                groups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                /**
+                 * Origin lock: web origins (scheme + host, optional port; one leading
+                 * `*.` wildcard label allowed) the minted token may be presented
+                 * from. Enforced on every engine request that carries a browser
+                 * `Origin` header — hotlink prevention, not DRM: non-browser callers
+                 * are governed by the token itself.
+                 */
                 origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-                /** Optional passphrase gate, checked at exchange. Stored as a hash; never returned. */
-                password: z.ZodOptional<z.ZodString>;
-                /** Lifetime of exchanged session tokens. Default 600. */
-                sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-                /** Unix epoch ms after which the grant stops exchanging; omit for no expiry. */
-                expiresAt: z.ZodOptional<z.ZodNumber>;
+                /** Token lifetime in seconds. */
+                expiresIn: z.ZodNumber;
             }, "strip", z.ZodTypeAny, {
                 docId: string;
+                kind: "doc";
+                sub: string;
                 scope: string[];
-                expiresAt?: number | undefined;
+                expiresIn: number;
                 layerName?: string | undefined;
+                userId?: string | undefined;
+                displayName?: string | undefined;
+                groupId?: string | undefined;
+                groups?: string[] | undefined;
                 origins?: string[] | undefined;
-                sessionTtlSeconds?: number | undefined;
-                password?: string | undefined;
             }, {
                 docId: string;
+                kind: "doc";
+                sub: string;
                 scope: string[];
-                expiresAt?: number | undefined;
+                expiresIn: number;
                 layerName?: string | undefined;
+                userId?: string | undefined;
+                displayName?: string | undefined;
+                groupId?: string | undefined;
+                groups?: string[] | undefined;
                 origins?: string[] | undefined;
-                sessionTtlSeconds?: number | undefined;
-                password?: string | undefined;
-            }>;
+            }>, z.ZodObject<{
+                kind: z.ZodLiteral<"tenant">;
+                sub: z.ZodString;
+                scope: z.ZodArray<z.ZodUnion<[z.ZodLiteral<"*">, z.ZodEnum<["docs.create", "docs.read", "docs.delete", "tokens.issue-doc", "tokens.revoke", "shares.manage"]>]>, "many">;
+                /** Token lifetime in seconds. */
+                expiresIn: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "tenant";
+                sub: string;
+                scope: ("docs.create" | "docs.read" | "docs.delete" | "tokens.issue-doc" | "tokens.revoke" | "shares.manage" | "*")[];
+                expiresIn: number;
+            }, {
+                kind: "tenant";
+                sub: string;
+                scope: ("docs.create" | "docs.read" | "docs.delete" | "tokens.issue-doc" | "tokens.revoke" | "shares.manage" | "*")[];
+                expiresIn: number;
+            }>]>;
         };
         readonly responses: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    share: z.ZodObject<{
-                        /** Grant id; doubles as the public share token (`shr_…`). */
-                        id: z.ZodString;
-                        tenantId: z.ZodString;
-                        docId: z.ZodString;
-                        layerName: z.ZodString;
-                        /** Doc capabilities the exchanged session carries. */
-                        scope: z.ZodArray<z.ZodString, "many">;
-                        /** Origin allowlist; null means any origin. */
-                        origins: z.ZodNullable<z.ZodArray<z.ZodString, "many">>;
-                        /** True when a passphrase is required at exchange. The passphrase itself is never returned. */
-                        passwordProtected: z.ZodBoolean;
-                        /** Lifetime of each exchanged session token, in seconds. */
-                        sessionTtlSeconds: z.ZodNumber;
-                        /** Paused grants refuse exchange (404) but keep their configuration. */
-                        disabled: z.ZodBoolean;
-                        /** Unix epoch ms after which exchange returns 410; null = no expiry. */
-                        expiresAt: z.ZodNullable<z.ZodNumber>;
-                        /** Total successful exchanges — a dashboard convenience, not the usage meter. */
-                        exchangeCount: z.ZodNumber;
-                        lastExchangedAt: z.ZodNullable<z.ZodNumber>;
-                        createdBy: z.ZodString;
-                        createdAt: z.ZodNumber;
-                        updatedAt: z.ZodNumber;
+                    token: z.ZodString;
+                    jti: z.ZodString;
+                    /** Unix seconds. */
+                    expiresAt: z.ZodNumber;
+                }, "strip", z.ZodTypeAny, {
+                    expiresAt: number;
+                    jti: string;
+                    token: string;
+                }, {
+                    expiresAt: number;
+                    jti: string;
+                    token: string;
+                }>;
+            };
+            readonly 400: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
                     }, "strip", z.ZodTypeAny, {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
+                        code: string;
+                        message: string;
                     }, {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
+                        code: string;
+                        message: string;
                     }>;
                 }, "strip", z.ZodTypeAny, {
-                    share: {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
+                    error: {
+                        code: string;
+                        message: string;
                     };
                 }, {
-                    share: {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
+                    error: {
+                        code: string;
+                        message: string;
                     };
                 }>;
             };
-            readonly 400: {
+            readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -4101,7 +4227,7 @@ declare const adminOperations: {
                     };
                 }>;
             };
-            readonly 403: {
+            readonly 404: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -4126,7 +4252,50 @@ declare const adminOperations: {
                     };
                 }>;
             };
-            readonly 404: {
+        };
+        readonly notes: "kind \"tenant\" requires the API token — authority mints only downward. Mounted only when the deployment can sign (HS256 mode); asymmetric deployments mint with their own private key.";
+    };
+    readonly 'tokens.revoke': {
+        readonly operationId: "tokens.revoke";
+        readonly title: "Revoke token";
+        readonly summary: "Revoke a token by jti; live sessions drop on their next heartbeat.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/tokens/:jti/revoke";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["tokens.revoke"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            jti: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+            jti: string;
+        }, {
+            tenantId: string;
+            jti: string;
+        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                /** Optional human reason, written to the audit row. */
+                reason: z.ZodOptional<z.ZodString>;
+                /**
+                 * The token's `exp` (unix seconds), used to GC the revocation row
+                 * once the token would have expired anyway. Defaults server-side to
+                 * now + 30 days.
+                 */
+                expiresAtSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                reason?: string | undefined;
+                expiresAtSeconds?: number | undefined;
+            }, {
+                reason?: string | undefined;
+                expiresAtSeconds?: number | undefined;
+            }>;
+            readonly required: false;
+        };
+        readonly responses: {
+            readonly 204: {};
+            readonly 400: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -4152,16 +4321,16 @@ declare const adminOperations: {
                 }>;
             };
         };
-        readonly notes: string;
+        readonly notes: "Mounted only when the deployment enables token revocation.";
     };
-    readonly 'shares.list': {
-        readonly operationId: "shares.list";
-        readonly title: "List shares";
-        readonly summary: "List share grants in the tenant, newest first, cursor-paginated.";
+    readonly 'tenants.usage': {
+        readonly operationId: "tenants.usage";
+        readonly title: "Tenant usage";
+        readonly summary: "Per-tenant usage facts (views, uploads, stored bytes) for one UTC month.";
         readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/shares";
+        readonly path: "/v1/tenants/:tenantId/usage";
         readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["shares.manage"];
+        readonly scope: readonly ["docs.read"];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
@@ -4170,120 +4339,51 @@ declare const adminOperations: {
             tenantId: string;
         }>;
         readonly query: z.ZodObject<{
-            limit: z.ZodDefault<z.ZodNumber>;
-            cursor: z.ZodOptional<z.ZodString>;
-            /** Filter to one document's grants. */
-            docId: z.ZodOptional<z.ZodString>;
+            /** UTC month to report, `YYYY-MM`. Defaults to the current month. */
+            period: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            limit: number;
-            docId?: string | undefined;
-            cursor?: string | undefined;
+            period?: string | undefined;
         }, {
-            docId?: string | undefined;
-            limit?: number | undefined;
-            cursor?: string | undefined;
+            period?: string | undefined;
         }>;
         readonly responses: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    shares: z.ZodArray<z.ZodObject<{
-                        /** Grant id; doubles as the public share token (`shr_…`). */
-                        id: z.ZodString;
-                        tenantId: z.ZodString;
-                        docId: z.ZodString;
-                        layerName: z.ZodString;
-                        /** Doc capabilities the exchanged session carries. */
-                        scope: z.ZodArray<z.ZodString, "many">;
-                        /** Origin allowlist; null means any origin. */
-                        origins: z.ZodNullable<z.ZodArray<z.ZodString, "many">>;
-                        /** True when a passphrase is required at exchange. The passphrase itself is never returned. */
-                        passwordProtected: z.ZodBoolean;
-                        /** Lifetime of each exchanged session token, in seconds. */
-                        sessionTtlSeconds: z.ZodNumber;
-                        /** Paused grants refuse exchange (404) but keep their configuration. */
-                        disabled: z.ZodBoolean;
-                        /** Unix epoch ms after which exchange returns 410; null = no expiry. */
-                        expiresAt: z.ZodNullable<z.ZodNumber>;
-                        /** Total successful exchanges — a dashboard convenience, not the usage meter. */
-                        exchangeCount: z.ZodNumber;
-                        lastExchangedAt: z.ZodNullable<z.ZodNumber>;
-                        createdBy: z.ZodString;
-                        createdAt: z.ZodNumber;
-                        updatedAt: z.ZodNumber;
+                    tenantId: z.ZodString;
+                    periodStart: z.ZodString;
+                    periodEnd: z.ZodString;
+                    metrics: z.ZodObject<{
+                        'pdf.views': z.ZodNumber;
+                        'pdf.uploads': z.ZodNumber;
+                        'storage.bytes': z.ZodNumber;
                     }, "strip", z.ZodTypeAny, {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
+                        'pdf.views': number;
+                        'pdf.uploads': number;
+                        'storage.bytes': number;
                     }, {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    }>, "many">;
-                    /** Opaque cursor for the next page; `null` on the last page. */
-                    nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        'pdf.views': number;
+                        'pdf.uploads': number;
+                        'storage.bytes': number;
+                    }>;
                 }, "strip", z.ZodTypeAny, {
-                    shares: {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    }[];
-                    nextCursor?: string | null | undefined;
+                    tenantId: string;
+                    periodStart: string;
+                    periodEnd: string;
+                    metrics: {
+                        'pdf.views': number;
+                        'pdf.uploads': number;
+                        'storage.bytes': number;
+                    };
                 }, {
-                    shares: {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    }[];
-                    nextCursor?: string | null | undefined;
+                    tenantId: string;
+                    periodStart: string;
+                    periodEnd: string;
+                    metrics: {
+                        'pdf.views': number;
+                        'pdf.uploads': number;
+                        'storage.bytes': number;
+                    };
                 }>;
             };
             readonly 400: {
@@ -4311,125 +4411,6 @@ declare const adminOperations: {
                     };
                 }>;
             };
-        };
-    };
-    readonly 'shares.get': {
-        readonly operationId: "shares.get";
-        readonly title: "Get share";
-        readonly summary: "Fetch one share grant.";
-        readonly method: "GET";
-        readonly path: "/v1/tenants/:tenantId/shares/:shareId";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["shares.manage"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            shareId: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            tenantId: string;
-            shareId: string;
-        }, {
-            tenantId: string;
-            shareId: string;
-        }>;
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    share: z.ZodObject<{
-                        /** Grant id; doubles as the public share token (`shr_…`). */
-                        id: z.ZodString;
-                        tenantId: z.ZodString;
-                        docId: z.ZodString;
-                        layerName: z.ZodString;
-                        /** Doc capabilities the exchanged session carries. */
-                        scope: z.ZodArray<z.ZodString, "many">;
-                        /** Origin allowlist; null means any origin. */
-                        origins: z.ZodNullable<z.ZodArray<z.ZodString, "many">>;
-                        /** True when a passphrase is required at exchange. The passphrase itself is never returned. */
-                        passwordProtected: z.ZodBoolean;
-                        /** Lifetime of each exchanged session token, in seconds. */
-                        sessionTtlSeconds: z.ZodNumber;
-                        /** Paused grants refuse exchange (404) but keep their configuration. */
-                        disabled: z.ZodBoolean;
-                        /** Unix epoch ms after which exchange returns 410; null = no expiry. */
-                        expiresAt: z.ZodNullable<z.ZodNumber>;
-                        /** Total successful exchanges — a dashboard convenience, not the usage meter. */
-                        exchangeCount: z.ZodNumber;
-                        lastExchangedAt: z.ZodNullable<z.ZodNumber>;
-                        createdBy: z.ZodString;
-                        createdAt: z.ZodNumber;
-                        updatedAt: z.ZodNumber;
-                    }, "strip", z.ZodTypeAny, {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    }, {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    share: {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    };
-                }, {
-                    share: {
-                        id: string;
-                        tenantId: string;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string;
-                        docId: string;
-                        expiresAt: number | null;
-                        layerName: string;
-                        scope: string[];
-                        origins: string[] | null;
-                        passwordProtected: boolean;
-                        sessionTtlSeconds: number;
-                        disabled: boolean;
-                        exchangeCount: number;
-                        lastExchangedAt: number | null;
-                    };
-                }>;
-            };
             readonly 404: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
@@ -4456,48 +4437,159 @@ declare const adminOperations: {
                 }>;
             };
         };
+        readonly notes: string;
     };
-    readonly 'shares.update': {
-        readonly operationId: "shares.update";
-        readonly title: "Update share";
-        readonly summary: "Edit a grant in place — every embedded copy of the token follows the row.";
-        readonly method: "PATCH";
-        readonly path: "/v1/tenants/:tenantId/shares/:shareId";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["shares.manage"];
+    readonly 'tenants.suspend': {
+        readonly operationId: "tenants.suspend";
+        readonly title: "Suspend tenant";
+        readonly summary: "Fail the tenant closed: refuse every tenant JWT, doc JWT, and share exchange.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/suspend";
+        readonly credentials: readonly ["api-token"];
+        readonly scope: readonly [];
         readonly params: z.ZodObject<{
             tenantId: z.ZodString;
-            shareId: z.ZodString;
         }, "strip", z.ZodTypeAny, {
             tenantId: string;
-            shareId: string;
         }, {
             tenantId: string;
-            shareId: string;
         }>;
         readonly body: {
             readonly contentType: "application/json";
             readonly schema: z.ZodObject<{
-                scope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-                origins: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString, "many">>>;
-                password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-                sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-                disabled: z.ZodOptional<z.ZodBoolean>;
-                expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                /** Optional operator reason, written to the security-events trail. */
+                reason: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
-                expiresAt?: number | null | undefined;
-                scope?: string[] | undefined;
-                origins?: string[] | null | undefined;
-                sessionTtlSeconds?: number | undefined;
-                disabled?: boolean | undefined;
-                password?: string | null | undefined;
+                reason?: string | undefined;
             }, {
-                expiresAt?: number | null | undefined;
-                scope?: string[] | undefined;
-                origins?: string[] | null | undefined;
+                reason?: string | undefined;
+            }>;
+            readonly required: false;
+        };
+        readonly responses: {
+            readonly 204: {};
+            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+        readonly notes: string;
+    };
+    readonly 'tenants.resume': {
+        readonly operationId: "tenants.resume";
+        readonly title: "Resume tenant";
+        readonly summary: "Lift a suspension; credentials for the tenant verify again.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/resume";
+        readonly credentials: readonly ["api-token"];
+        readonly scope: readonly [];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+        }, {
+            tenantId: string;
+        }>;
+        readonly responses: {
+            readonly 204: {};
+            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+    };
+    readonly 'shares.create': {
+        readonly operationId: "shares.create";
+        readonly title: "Create share";
+        readonly summary: "Create a standing share grant for one document — the no-backend embed credential.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/shares";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["shares.manage"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+        }, {
+            tenantId: string;
+        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                docId: z.ZodString;
+                layerName: z.ZodOptional<z.ZodString>;
+                /**
+                 * Doc capability scopes the exchanged session will carry. Validated
+                 * server-side against the engine's scope vocabulary, same as
+                 * `tokens.issue`.
+                 */
+                scope: z.ZodArray<z.ZodString, "many">;
+                /** Origin allowlist; omit to allow any origin. */
+                origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                /** Optional passphrase gate, checked at exchange. Stored as a hash; never returned. */
+                password: z.ZodOptional<z.ZodString>;
+                /** Lifetime of exchanged session tokens. Default 600. */
+                sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+                /** Unix epoch ms after which the grant stops exchanging; omit for no expiry. */
+                expiresAt: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                docId: string;
+                scope: string[];
+                expiresAt?: number | undefined;
+                layerName?: string | undefined;
+                origins?: string[] | undefined;
                 sessionTtlSeconds?: number | undefined;
-                disabled?: boolean | undefined;
-                password?: string | null | undefined;
+                password?: string | undefined;
+            }, {
+                docId: string;
+                scope: string[];
+                expiresAt?: number | undefined;
+                layerName?: string | undefined;
+                origins?: string[] | undefined;
+                sessionTtlSeconds?: number | undefined;
+                password?: string | undefined;
             }>;
         };
         readonly responses: {
@@ -4624,7 +4716,7 @@ declare const adminOperations: {
                     };
                 }>;
             };
-            readonly 404: {
+            readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -4649,28 +4741,6 @@ declare const adminOperations: {
                     };
                 }>;
             };
-        };
-    };
-    readonly 'shares.delete': {
-        readonly operationId: "shares.delete";
-        readonly title: "Revoke share";
-        readonly summary: "Delete a grant; exchange stops immediately, live sessions lapse at their exp.";
-        readonly method: "DELETE";
-        readonly path: "/v1/tenants/:tenantId/shares/:shareId";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["shares.manage"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            shareId: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            tenantId: string;
-            shareId: string;
-        }, {
-            tenantId: string;
-            shareId: string;
-        }>;
-        readonly responses: {
-            readonly 204: {};
             readonly 404: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
@@ -4697,102 +4767,141 @@ declare const adminOperations: {
                 }>;
             };
         };
+        readonly notes: string;
     };
-    readonly 'shares.exchange': {
-        readonly operationId: "shares.exchange";
-        readonly title: "Exchange share token";
-        readonly summary: "Trade a public share token for a short-lived document session JWT.";
-        readonly method: "POST";
-        readonly path: "/v1/share-sessions";
-        readonly credentials: readonly [];
-        readonly scope: readonly [];
-        readonly body: {
-            readonly contentType: "application/json";
-            readonly schema: z.ZodObject<{
-                shareToken: z.ZodString;
-                /** Required when the grant is passphrase-protected (422 otherwise). */
-                password: z.ZodOptional<z.ZodString>;
-            }, "strip", z.ZodTypeAny, {
-                shareToken: string;
-                password?: string | undefined;
-            }, {
-                shareToken: string;
-                password?: string | undefined;
-            }>;
-        };
+    readonly 'shares.list': {
+        readonly operationId: "shares.list";
+        readonly title: "List shares";
+        readonly summary: "List share grants in the tenant, newest first, cursor-paginated.";
+        readonly method: "GET";
+        readonly path: "/v1/tenants/:tenantId/shares";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["shares.manage"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+        }, {
+            tenantId: string;
+        }>;
+        readonly query: z.ZodObject<{
+            limit: z.ZodDefault<z.ZodNumber>;
+            cursor: z.ZodOptional<z.ZodString>;
+            /** Filter to one document's grants. */
+            docId: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            limit: number;
+            docId?: string | undefined;
+            cursor?: string | undefined;
+        }, {
+            docId?: string | undefined;
+            limit?: number | undefined;
+            cursor?: string | undefined;
+        }>;
         readonly responses: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    /** A doc-scoped session JWT carrying the grant's capabilities and origin lock. */
-                    token: z.ZodString;
-                    docId: z.ZodString;
-                    layerName: z.ZodString;
-                    /** Unix seconds when the session token expires; exchange again for a fresh one. */
-                    expiresAt: z.ZodNumber;
-                }, "strip", z.ZodTypeAny, {
-                    docId: string;
-                    expiresAt: number;
-                    layerName: string;
-                    token: string;
-                }, {
-                    docId: string;
-                    expiresAt: number;
-                    layerName: string;
-                    token: string;
-                }>;
-            };
-            readonly 400: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
+                    shares: z.ZodArray<z.ZodObject<{
+                        /** Grant id; doubles as the public share token (`shr_…`). */
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        docId: z.ZodString;
+                        layerName: z.ZodString;
+                        /** Doc capabilities the exchanged session carries. */
+                        scope: z.ZodArray<z.ZodString, "many">;
+                        /** Origin allowlist; null means any origin. */
+                        origins: z.ZodNullable<z.ZodArray<z.ZodString, "many">>;
+                        /** True when a passphrase is required at exchange. The passphrase itself is never returned. */
+                        passwordProtected: z.ZodBoolean;
+                        /** Lifetime of each exchanged session token, in seconds. */
+                        sessionTtlSeconds: z.ZodNumber;
+                        /** Paused grants refuse exchange (404) but keep their configuration. */
+                        disabled: z.ZodBoolean;
+                        /** Unix epoch ms after which exchange returns 410; null = no expiry. */
+                        expiresAt: z.ZodNullable<z.ZodNumber>;
+                        /** Total successful exchanges — a dashboard convenience, not the usage meter. */
+                        exchangeCount: z.ZodNumber;
+                        lastExchangedAt: z.ZodNullable<z.ZodNumber>;
+                        createdBy: z.ZodString;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
                     }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }>;
-            };
-            readonly 403: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
-                    }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
                     }, {
-                        code: string;
-                        message: string;
-                    }>;
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    }>, "many">;
+                    /** Opaque cursor for the next page; `null` on the last page. */
+                    nextCursor: z.ZodOptional<z.ZodNullable<z.ZodString>>;
                 }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
+                    shares: {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    }[];
+                    nextCursor?: string | null | undefined;
                 }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
+                    shares: {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    }[];
+                    nextCursor?: string | null | undefined;
                 }>;
             };
-            readonly 404: {
+            readonly 400: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -4817,32 +4926,126 @@ declare const adminOperations: {
                     };
                 }>;
             };
-            readonly 410: {
+        };
+    };
+    readonly 'shares.get': {
+        readonly operationId: "shares.get";
+        readonly title: "Get share";
+        readonly summary: "Fetch one share grant.";
+        readonly method: "GET";
+        readonly path: "/v1/tenants/:tenantId/shares/:shareId";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["shares.manage"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            shareId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+            shareId: string;
+        }, {
+            tenantId: string;
+            shareId: string;
+        }>;
+        readonly responses: {
+            readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
+                    share: z.ZodObject<{
+                        /** Grant id; doubles as the public share token (`shr_…`). */
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        docId: z.ZodString;
+                        layerName: z.ZodString;
+                        /** Doc capabilities the exchanged session carries. */
+                        scope: z.ZodArray<z.ZodString, "many">;
+                        /** Origin allowlist; null means any origin. */
+                        origins: z.ZodNullable<z.ZodArray<z.ZodString, "many">>;
+                        /** True when a passphrase is required at exchange. The passphrase itself is never returned. */
+                        passwordProtected: z.ZodBoolean;
+                        /** Lifetime of each exchanged session token, in seconds. */
+                        sessionTtlSeconds: z.ZodNumber;
+                        /** Paused grants refuse exchange (404) but keep their configuration. */
+                        disabled: z.ZodBoolean;
+                        /** Unix epoch ms after which exchange returns 410; null = no expiry. */
+                        expiresAt: z.ZodNullable<z.ZodNumber>;
+                        /** Total successful exchanges — a dashboard convenience, not the usage meter. */
+                        exchangeCount: z.ZodNumber;
+                        lastExchangedAt: z.ZodNullable<z.ZodNumber>;
+                        createdBy: z.ZodString;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
                     }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
                     }, {
-                        code: string;
-                        message: string;
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
                     }>;
                 }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
+                    share: {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
                     };
                 }, {
-                    error: {
-                        code: string;
-                        message: string;
+                    share: {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
                     };
                 }>;
             };
-            readonly 422: {
+            readonly 404: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -4868,32 +5071,444 @@ declare const adminOperations: {
                 }>;
             };
         };
-        readonly notes: string;
     };
-};
-type AdminOperationId = keyof typeof adminOperations;
-declare const DocIdParamsSchema: z.ZodObject<{
-    docId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    docId: string;
-}, {
-    docId: string;
-}>;
-declare const DocLayerParamsSchema: z.ZodObject<{
-    docId: z.ZodString;
-} & {
-    layerName: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    docId: string;
-    layerName: string;
-}, {
-    docId: string;
-    layerName: string;
-}>;
-declare const DocPageParamsSchema: z.ZodObject<{
-    docId: z.ZodString;
-} & {
-    layerName: z.ZodString;
+    readonly 'shares.update': {
+        readonly operationId: "shares.update";
+        readonly title: "Update share";
+        readonly summary: "Edit a grant in place — every embedded copy of the token follows the row.";
+        readonly method: "PATCH";
+        readonly path: "/v1/tenants/:tenantId/shares/:shareId";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["shares.manage"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            shareId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+            shareId: string;
+        }, {
+            tenantId: string;
+            shareId: string;
+        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                scope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                origins: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString, "many">>>;
+                password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+                disabled: z.ZodOptional<z.ZodBoolean>;
+                expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                expiresAt?: number | null | undefined;
+                scope?: string[] | undefined;
+                origins?: string[] | null | undefined;
+                sessionTtlSeconds?: number | undefined;
+                disabled?: boolean | undefined;
+                password?: string | null | undefined;
+            }, {
+                expiresAt?: number | null | undefined;
+                scope?: string[] | undefined;
+                origins?: string[] | null | undefined;
+                sessionTtlSeconds?: number | undefined;
+                disabled?: boolean | undefined;
+                password?: string | null | undefined;
+            }>;
+        };
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    share: z.ZodObject<{
+                        /** Grant id; doubles as the public share token (`shr_…`). */
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        docId: z.ZodString;
+                        layerName: z.ZodString;
+                        /** Doc capabilities the exchanged session carries. */
+                        scope: z.ZodArray<z.ZodString, "many">;
+                        /** Origin allowlist; null means any origin. */
+                        origins: z.ZodNullable<z.ZodArray<z.ZodString, "many">>;
+                        /** True when a passphrase is required at exchange. The passphrase itself is never returned. */
+                        passwordProtected: z.ZodBoolean;
+                        /** Lifetime of each exchanged session token, in seconds. */
+                        sessionTtlSeconds: z.ZodNumber;
+                        /** Paused grants refuse exchange (404) but keep their configuration. */
+                        disabled: z.ZodBoolean;
+                        /** Unix epoch ms after which exchange returns 410; null = no expiry. */
+                        expiresAt: z.ZodNullable<z.ZodNumber>;
+                        /** Total successful exchanges — a dashboard convenience, not the usage meter. */
+                        exchangeCount: z.ZodNumber;
+                        lastExchangedAt: z.ZodNullable<z.ZodNumber>;
+                        createdBy: z.ZodString;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                    }, "strip", z.ZodTypeAny, {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    }, {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    share: {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    };
+                }, {
+                    share: {
+                        id: string;
+                        tenantId: string;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string;
+                        docId: string;
+                        expiresAt: number | null;
+                        layerName: string;
+                        scope: string[];
+                        origins: string[] | null;
+                        passwordProtected: boolean;
+                        sessionTtlSeconds: number;
+                        disabled: boolean;
+                        exchangeCount: number;
+                        lastExchangedAt: number | null;
+                    };
+                }>;
+            };
+            readonly 400: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+    };
+    readonly 'shares.delete': {
+        readonly operationId: "shares.delete";
+        readonly title: "Revoke share";
+        readonly summary: "Delete a grant; exchange stops immediately, live sessions lapse at their exp.";
+        readonly method: "DELETE";
+        readonly path: "/v1/tenants/:tenantId/shares/:shareId";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["shares.manage"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            shareId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+            shareId: string;
+        }, {
+            tenantId: string;
+            shareId: string;
+        }>;
+        readonly responses: {
+            readonly 204: {};
+            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+    };
+    readonly 'shares.exchange': {
+        readonly operationId: "shares.exchange";
+        readonly title: "Exchange share token";
+        readonly summary: "Trade a public share token for a short-lived document session JWT.";
+        readonly method: "POST";
+        readonly path: "/v1/share-sessions";
+        readonly credentials: readonly [];
+        readonly scope: readonly [];
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                shareToken: z.ZodString;
+                /** Required when the grant is passphrase-protected (422 otherwise). */
+                password: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                shareToken: string;
+                password?: string | undefined;
+            }, {
+                shareToken: string;
+                password?: string | undefined;
+            }>;
+        };
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    /** A doc-scoped session JWT carrying the grant's capabilities and origin lock. */
+                    token: z.ZodString;
+                    docId: z.ZodString;
+                    layerName: z.ZodString;
+                    /** Unix seconds when the session token expires; exchange again for a fresh one. */
+                    expiresAt: z.ZodNumber;
+                }, "strip", z.ZodTypeAny, {
+                    docId: string;
+                    expiresAt: number;
+                    layerName: string;
+                    token: string;
+                }, {
+                    docId: string;
+                    expiresAt: number;
+                    layerName: string;
+                    token: string;
+                }>;
+            };
+            readonly 400: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 403: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 410: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 422: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+        readonly notes: string;
+    };
+};
+type AdminOperationId = keyof typeof adminOperations;
+declare const DocIdParamsSchema: z.ZodObject<{
+    docId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    docId: string;
+}, {
+    docId: string;
+}>;
+declare const DocLayerParamsSchema: z.ZodObject<{
+    docId: z.ZodString;
+} & {
+    layerName: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    docId: string;
+    layerName: string;
+}, {
+    docId: string;
+    layerName: string;
+}>;
+declare const DocPageParamsSchema: z.ZodObject<{
+    docId: z.ZodString;
+} & {
+    layerName: z.ZodString;
 } & {
     pon: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
@@ -5095,7 +5710,7 @@ declare const docOperations: {
         readonly responses: {
             readonly 200: {
                 readonly contentType: "application/json";
-                readonly schema: z.ZodType<_embedpdf_engine_core_wire.DocumentManifest, z.ZodTypeDef, _embedpdf_engine_core_wire.DocumentManifest>;
+                readonly schema: z.ZodType<_embedpdf_engine_core_runtime.DocumentManifest, z.ZodTypeDef, _embedpdf_engine_core_runtime.DocumentManifest>;
             };
             readonly 404: {
                 readonly contentType: "application/json";
@@ -5277,11 +5892,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5331,11 +5946,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5381,11 +5996,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 404: {
@@ -5459,11 +6074,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5505,11 +6120,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 404: {
@@ -5585,11 +6200,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5631,11 +6246,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5677,11 +6292,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5723,11 +6338,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5770,11 +6385,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -5817,11 +6432,11 @@ declare const docOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6018,7 +6633,7 @@ declare const allOperations: {
         readonly responses: {
             readonly 200: {
                 readonly contentType: "application/json";
-                readonly schema: z.ZodType<_embedpdf_engine_core_wire.DocumentManifest, z.ZodTypeDef, _embedpdf_engine_core_wire.DocumentManifest>;
+                readonly schema: z.ZodType<_embedpdf_engine_core_runtime.DocumentManifest, z.ZodTypeDef, _embedpdf_engine_core_runtime.DocumentManifest>;
             };
             readonly 404: {
                 readonly contentType: "application/json";
@@ -6200,11 +6815,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6254,11 +6869,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6304,11 +6919,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 404: {
@@ -6382,11 +6997,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6428,11 +7043,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 404: {
@@ -6508,11 +7123,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6554,11 +7169,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6600,11 +7215,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6646,11 +7261,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6693,11 +7308,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -6740,11 +7355,11 @@ declare const allOperations: {
             readonly 200: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-                    meta: z.ZodType<_embedpdf_engine_core_wire.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_wire.MutationMeta>;
+                    meta: z.ZodType<_embedpdf_engine_core_runtime.MutationMeta, z.ZodTypeDef, _embedpdf_engine_core_runtime.MutationMeta>;
                 }, z.ZodTypeAny, "passthrough">>;
             };
             readonly 400: {
@@ -7116,62 +7731,220 @@ declare const allOperations: {
                         code: string;
                         message: string;
                     };
-                }>;
-            };
-        };
-        readonly notes: "Destroys the tenant and everything in its namespace — documents, layers, stored bytes, audit history. Irreversible.";
-    };
-    readonly 'documents.init': {
-        readonly operationId: "documents.init";
-        readonly title: "Initialize upload";
-        readonly summary: "Begin an upload: create (or resume/dedupe) a pending document and issue upload access.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/documents/init";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.create"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            tenantId: string;
-        }, {
-            tenantId: string;
-        }>;
-        readonly body: {
-            readonly contentType: "application/json";
-            readonly schema: z.ZodObject<{
-                contentLength: z.ZodNumber;
-                contentSha256: z.ZodString;
-                metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                idempotencyKey: z.ZodOptional<z.ZodString>;
-                dedupMode: z.ZodOptional<z.ZodEnum<["always-create", "reuse-existing"]>>;
-                docId: z.ZodOptional<z.ZodString>;
-                uploadTtlSec: z.ZodOptional<z.ZodNumber>;
-                uploadPreference: z.ZodOptional<z.ZodEnum<["auto", "presigned", "proxy"]>>;
-            }, "strip", z.ZodTypeAny, {
-                contentLength: number;
-                contentSha256: string;
-                metadata?: Record<string, unknown> | undefined;
-                idempotencyKey?: string | undefined;
-                dedupMode?: "always-create" | "reuse-existing" | undefined;
-                docId?: string | undefined;
-                uploadTtlSec?: number | undefined;
-                uploadPreference?: "auto" | "presigned" | "proxy" | undefined;
-            }, {
-                contentLength: number;
-                contentSha256: string;
-                metadata?: Record<string, unknown> | undefined;
-                idempotencyKey?: string | undefined;
-                dedupMode?: "always-create" | "reuse-existing" | undefined;
-                docId?: string | undefined;
-                uploadTtlSec?: number | undefined;
-                uploadPreference?: "auto" | "presigned" | "proxy" | undefined;
-            }>;
-        };
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodDiscriminatedUnion<"tag", [z.ZodObject<{
-                    tag: z.ZodLiteral<"created">;
+                }>;
+            };
+        };
+        readonly notes: "Destroys the tenant and everything in its namespace — documents, layers, stored bytes, audit history. Irreversible.";
+    };
+    readonly 'documents.init': {
+        readonly operationId: "documents.init";
+        readonly title: "Initialize upload";
+        readonly summary: "Begin an upload: create (or resume/dedupe) a pending document and issue upload access.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/documents/init";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["docs.create"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+        }, {
+            tenantId: string;
+        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                contentLength: z.ZodNumber;
+                contentSha256: z.ZodString;
+                metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                idempotencyKey: z.ZodOptional<z.ZodString>;
+                dedupMode: z.ZodOptional<z.ZodEnum<["always-create", "reuse-existing"]>>;
+                docId: z.ZodOptional<z.ZodString>;
+                uploadTtlSec: z.ZodOptional<z.ZodNumber>;
+                uploadPreference: z.ZodOptional<z.ZodEnum<["auto", "presigned", "proxy"]>>;
+            }, "strip", z.ZodTypeAny, {
+                contentLength: number;
+                contentSha256: string;
+                metadata?: Record<string, unknown> | undefined;
+                idempotencyKey?: string | undefined;
+                dedupMode?: "always-create" | "reuse-existing" | undefined;
+                docId?: string | undefined;
+                uploadTtlSec?: number | undefined;
+                uploadPreference?: "auto" | "presigned" | "proxy" | undefined;
+            }, {
+                contentLength: number;
+                contentSha256: string;
+                metadata?: Record<string, unknown> | undefined;
+                idempotencyKey?: string | undefined;
+                dedupMode?: "always-create" | "reuse-existing" | undefined;
+                docId?: string | undefined;
+                uploadTtlSec?: number | undefined;
+                uploadPreference?: "auto" | "presigned" | "proxy" | undefined;
+            }>;
+        };
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodDiscriminatedUnion<"tag", [z.ZodObject<{
+                    tag: z.ZodLiteral<"created">;
+                    document: z.ZodObject<{
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+                        baseSha: z.ZodNullable<z.ZodString>;
+                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                        idempotencyKey: z.ZodNullable<z.ZodString>;
+                        failureReason: z.ZodNullable<z.ZodString>;
+                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                        createdBy: z.ZodNullable<z.ZodString>;
+                    }, "strip", z.ZodTypeAny, {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }, {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }>;
+                    upload: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                        kind: z.ZodLiteral<"presigned">;
+                        presigned: z.ZodObject<{
+                            url: z.ZodString;
+                            headers: z.ZodRecord<z.ZodString, z.ZodString>;
+                            method: z.ZodLiteral<"PUT">;
+                            expiresAt: z.ZodNumber;
+                        }, "strip", z.ZodTypeAny, {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        }, {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        }>;
+                        key: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        presigned: {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        };
+                        kind: "presigned";
+                        key: string;
+                    }, {
+                        presigned: {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        };
+                        kind: "presigned";
+                        key: string;
+                    }>, z.ZodObject<{
+                        kind: z.ZodLiteral<"proxy">;
+                        url: z.ZodString;
+                        key: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    }, {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    }>]>;
+                }, "strip", z.ZodTypeAny, {
+                    tag: "created";
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                    upload: {
+                        presigned: {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        };
+                        kind: "presigned";
+                        key: string;
+                    } | {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    };
+                }, {
+                    tag: "created";
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                    upload: {
+                        presigned: {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        };
+                        kind: "presigned";
+                        key: string;
+                    } | {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    };
+                }>, z.ZodObject<{
+                    tag: z.ZodLiteral<"resumed">;
                     document: z.ZodObject<{
                         id: z.ZodString;
                         tenantId: z.ZodString;
@@ -7258,17 +8031,233 @@ declare const allOperations: {
                         url: z.ZodString;
                         key: z.ZodString;
                     }, "strip", z.ZodTypeAny, {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
-                    }, {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
-                    }>]>;
-                }, "strip", z.ZodTypeAny, {
-                    tag: "created";
-                    document: {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    }, {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    }>]>;
+                }, "strip", z.ZodTypeAny, {
+                    tag: "resumed";
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                    upload: {
+                        presigned: {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        };
+                        kind: "presigned";
+                        key: string;
+                    } | {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    };
+                }, {
+                    tag: "resumed";
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                    upload: {
+                        presigned: {
+                            url: string;
+                            headers: Record<string, string>;
+                            method: "PUT";
+                            expiresAt: number;
+                        };
+                        kind: "presigned";
+                        key: string;
+                    } | {
+                        url: string;
+                        kind: "proxy";
+                        key: string;
+                    };
+                }>, z.ZodObject<{
+                    tag: z.ZodLiteral<"deduped">;
+                    document: z.ZodObject<{
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+                        baseSha: z.ZodNullable<z.ZodString>;
+                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                        idempotencyKey: z.ZodNullable<z.ZodString>;
+                        failureReason: z.ZodNullable<z.ZodString>;
+                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                        createdBy: z.ZodNullable<z.ZodString>;
+                    }, "strip", z.ZodTypeAny, {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }, {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    tag: "deduped";
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                }, {
+                    tag: "deduped";
+                    document: {
+                        id: string;
+                        tenantId: string;
+                        state: "pending" | "ready" | "failed" | "deleting";
+                        baseSha: string | null;
+                        storageSizeBytes: number | null;
+                        metadata: Record<string, unknown> | null;
+                        idempotencyKey: string | null;
+                        failureReason: string | null;
+                        createdAt: number;
+                        updatedAt: number;
+                        createdBy: string | null;
+                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
+                        thumbnailUrl?: string | null | undefined;
+                    };
+                }>]>;
+            };
+            readonly 400: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+    };
+    readonly 'documents.commit': {
+        readonly operationId: "documents.commit";
+        readonly title: "Commit upload";
+        readonly summary: "Finish an upload: verify the SHA-256 and promote the document to ready.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/documents/:id/commit";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["docs.create"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            id: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            tenantId: string;
+        }, {
+            id: string;
+            tenantId: string;
+        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                sha256: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                sha256: string;
+            }, {
+                sha256: string;
+            }>;
+        };
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    document: z.ZodObject<{
+                        id: z.ZodString;
+                        tenantId: z.ZodString;
+                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
+                        baseSha: z.ZodNullable<z.ZodString>;
+                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
+                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                        idempotencyKey: z.ZodNullable<z.ZodString>;
+                        failureReason: z.ZodNullable<z.ZodString>;
+                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
+                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
+                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                        createdAt: z.ZodNumber;
+                        updatedAt: z.ZodNumber;
+                        createdBy: z.ZodNullable<z.ZodString>;
+                    }, "strip", z.ZodTypeAny, {
                         id: string;
                         tenantId: string;
                         state: "pending" | "ready" | "failed" | "deleting";
@@ -7282,24 +8271,7 @@ declare const allOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
-                    };
-                    upload: {
-                        presigned: {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        };
-                        kind: "presigned";
-                        key: string;
-                    } | {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
-                    };
-                }, {
-                    tag: "created";
-                    document: {
+                    }, {
                         id: string;
                         tenantId: string;
                         state: "pending" | "ready" | "failed" | "deleting";
@@ -7313,39 +8285,9 @@ declare const allOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
-                    };
-                    upload: {
-                        presigned: {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        };
-                        kind: "presigned";
-                        key: string;
-                    } | {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
-                    };
-                }>, z.ZodObject<{
-                    tag: z.ZodLiteral<"resumed">;
-                    document: z.ZodObject<{
-                        id: z.ZodString;
-                        tenantId: z.ZodString;
-                        state: z.ZodEnum<["pending", "ready", "failed", "deleting"]>;
-                        baseSha: z.ZodNullable<z.ZodString>;
-                        storageSizeBytes: z.ZodNullable<z.ZodNumber>;
-                        metadata: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                        idempotencyKey: z.ZodNullable<z.ZodString>;
-                        failureReason: z.ZodNullable<z.ZodString>;
-                        /** Dashboard tile lifecycle. Optional because older servers omit these fields. */
-                        thumbnailState: z.ZodOptional<z.ZodEnum<["pending", "ready", "locked", "failed"]>>;
-                        thumbnailUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-                        createdAt: z.ZodNumber;
-                        updatedAt: z.ZodNumber;
-                        createdBy: z.ZodNullable<z.ZodString>;
-                    }, "strip", z.ZodTypeAny, {
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    document: {
                         id: string;
                         tenantId: string;
                         state: "pending" | "ready" | "failed" | "deleting";
@@ -7359,7 +8301,9 @@ declare const allOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
-                    }, {
+                    };
+                }, {
+                    document: {
                         id: string;
                         tenantId: string;
                         state: "pending" | "ready" | "failed" | "deleting";
@@ -7373,121 +8317,273 @@ declare const allOperations: {
                         createdBy: string | null;
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
+                    };
+                }>;
+            };
+            readonly 400: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
                     }>;
-                    upload: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
-                        kind: z.ZodLiteral<"presigned">;
-                        presigned: z.ZodObject<{
-                            url: z.ZodString;
-                            headers: z.ZodRecord<z.ZodString, z.ZodString>;
-                            method: z.ZodLiteral<"PUT">;
-                            expiresAt: z.ZodNumber;
-                        }, "strip", z.ZodTypeAny, {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        }, {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        }>;
-                        key: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 404: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
                     }, "strip", z.ZodTypeAny, {
-                        presigned: {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        };
-                        kind: "presigned";
-                        key: string;
+                        code: string;
+                        message: string;
                     }, {
-                        presigned: {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        };
-                        kind: "presigned";
-                        key: string;
-                    }>, z.ZodObject<{
-                        kind: z.ZodLiteral<"proxy">;
-                        url: z.ZodString;
-                        key: z.ZodString;
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+        };
+    };
+    readonly 'documents.uploadProxy': {
+        readonly operationId: "documents.uploadProxy";
+        readonly title: "Upload document through the origin";
+        readonly summary: "Upload a bounded PDF through the API when the initialized transfer kind is proxy.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/documents/:id/upload-proxy";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["docs.create"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+            id: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            tenantId: string;
+        }, {
+            id: string;
+            tenantId: string;
+        }>;
+        readonly body: {
+            readonly contentType: "multipart/form-data";
+        };
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    sha256: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    sha256: string;
+                }, {
+                    sha256: string;
+                }>;
+            };
+            readonly 400: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        code: string;
+                        message: string;
+                    }, {
+                        code: string;
+                        message: string;
+                    }>;
+                }, "strip", z.ZodTypeAny, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }, {
+                    error: {
+                        code: string;
+                        message: string;
+                    };
+                }>;
+            };
+            readonly 409: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    error: z.ZodObject<{
+                        code: z.ZodString;
+                        message: z.ZodString;
                     }, "strip", z.ZodTypeAny, {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
+                        code: string;
+                        message: string;
                     }, {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
-                    }>]>;
+                        code: string;
+                        message: string;
+                    }>;
                 }, "strip", z.ZodTypeAny, {
-                    tag: "resumed";
-                    document: {
-                        id: string;
-                        tenantId: string;
-                        state: "pending" | "ready" | "failed" | "deleting";
-                        baseSha: string | null;
-                        storageSizeBytes: number | null;
-                        metadata: Record<string, unknown> | null;
-                        idempotencyKey: string | null;
-                        failureReason: string | null;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string | null;
-                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
-                        thumbnailUrl?: string | null | undefined;
-                    };
-                    upload: {
-                        presigned: {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        };
-                        kind: "presigned";
-                        key: string;
-                    } | {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
+                    error: {
+                        code: string;
+                        message: string;
                     };
                 }, {
-                    tag: "resumed";
-                    document: {
-                        id: string;
-                        tenantId: string;
-                        state: "pending" | "ready" | "failed" | "deleting";
-                        baseSha: string | null;
-                        storageSizeBytes: number | null;
-                        metadata: Record<string, unknown> | null;
-                        idempotencyKey: string | null;
-                        failureReason: string | null;
-                        createdAt: number;
-                        updatedAt: number;
-                        createdBy: string | null;
-                        thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
-                        thumbnailUrl?: string | null | undefined;
-                    };
-                    upload: {
-                        presigned: {
-                            url: string;
-                            headers: Record<string, string>;
-                            method: "PUT";
-                            expiresAt: number;
-                        };
-                        kind: "presigned";
-                        key: string;
-                    } | {
-                        url: string;
-                        kind: "proxy";
-                        key: string;
+                    error: {
+                        code: string;
+                        message: string;
                     };
+                }>;
+            };
+        };
+        readonly notes: "This bounded origin-mediated fallback must only be used after documents.init returns upload.kind=proxy. Auto mode prefers a presigned object-store PUT whenever available.";
+    };
+    readonly 'documents.importFrom': {
+        readonly operationId: "documents.importFrom";
+        readonly title: "Import document";
+        readonly summary: "Server-side pull: fetch a PDF from a caller-supplied URL (e.g. a presigned object-store GET) or an operator-registered storage connection into CloudPDF-owned storage, verify it, and commit it.";
+        readonly method: "POST";
+        readonly path: "/v1/tenants/:tenantId/documents/import";
+        readonly credentials: readonly ["api-token", "tenant-jwt"];
+        readonly scope: readonly ["docs.create"];
+        readonly params: z.ZodObject<{
+            tenantId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            tenantId: string;
+        }, {
+            tenantId: string;
+        }>;
+        readonly body: {
+            readonly contentType: "application/json";
+            readonly schema: z.ZodObject<{
+                source: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+                    kind: z.ZodLiteral<"url">;
+                    url: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    url: string;
+                    kind: "url";
+                }, {
+                    url: string;
+                    kind: "url";
                 }>, z.ZodObject<{
-                    tag: z.ZodLiteral<"deduped">;
+                    kind: z.ZodLiteral<"connection">;
+                    connectionId: z.ZodString;
+                    key: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+                    revision: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                }, {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                }>]>;
+                /**
+                 * Optional integrity pins, enforced when present: `sizeBytes`
+                 * against the source's declared Content-Length before the transfer,
+                 * `sha256` against the server-observed digest after it. When absent
+                 * the server-observed values become authoritative.
+                 * `dedupMode=reuse-existing` REQUIRES `sha256` — without a declared
+                 * hash the server cannot know what content to reuse.
+                 */
+                expected: z.ZodOptional<z.ZodObject<{
+                    sizeBytes: z.ZodOptional<z.ZodNumber>;
+                    sha256: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                }, {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                }>>;
+                metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                idempotencyKey: z.ZodOptional<z.ZodString>;
+                dedupMode: z.ZodOptional<z.ZodEnum<["always-create", "reuse-existing"]>>;
+                docId: z.ZodOptional<z.ZodString>;
+                /**
+                 * `sync` (default) holds the response open for the whole transfer.
+                 * `async` accepts the request (202, document `pending`), transfers
+                 * in the background, and the caller polls the document. Async
+                 * requires a `connection` source (URLs are secrets and expire, so
+                 * they cannot sit in a durable job); filesystem connections
+                 * additionally require `expected.sha256`, since they have no
+                 * revisions to pin retries to.
+                 */
+                mode: z.ZodOptional<z.ZodEnum<["sync", "async"]>>;
+            }, "strip", z.ZodTypeAny, {
+                source: {
+                    url: string;
+                    kind: "url";
+                } | {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                };
+                expected?: {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                } | undefined;
+                metadata?: Record<string, unknown> | undefined;
+                idempotencyKey?: string | undefined;
+                dedupMode?: "always-create" | "reuse-existing" | undefined;
+                docId?: string | undefined;
+                mode?: "sync" | "async" | undefined;
+            }, {
+                source: {
+                    url: string;
+                    kind: "url";
+                } | {
+                    kind: "connection";
+                    key: string;
+                    connectionId: string;
+                    revision?: string | undefined;
+                };
+                expected?: {
+                    sha256?: string | undefined;
+                    sizeBytes?: number | undefined;
+                } | undefined;
+                metadata?: Record<string, unknown> | undefined;
+                idempotencyKey?: string | undefined;
+                dedupMode?: "always-create" | "reuse-existing" | undefined;
+                docId?: string | undefined;
+                mode?: "sync" | "async" | undefined;
+            }>;
+        };
+        readonly responses: {
+            readonly 200: {
+                readonly contentType: "application/json";
+                readonly schema: z.ZodObject<{
+                    /**
+                     * `imported` — bytes were pulled, verified, and committed (sync).
+                     * `deduped`  — an existing document satisfied the request without a
+                     * transfer (content dedup or idempotent replay).
+                     * `accepted` — async: the job is queued (HTTP 202); poll the
+                     * document until `ready` or `failed`.
+                     */
+                    tag: z.ZodEnum<["imported", "deduped", "accepted"]>;
                     document: z.ZodObject<{
                         id: z.ZodString;
                         tenantId: z.ZodString;
@@ -7533,7 +8629,7 @@ declare const allOperations: {
                         thumbnailUrl?: string | null | undefined;
                     }>;
                 }, "strip", z.ZodTypeAny, {
-                    tag: "deduped";
+                    tag: "deduped" | "imported" | "accepted";
                     document: {
                         id: string;
                         tenantId: string;
@@ -7550,7 +8646,7 @@ declare const allOperations: {
                         thumbnailUrl?: string | null | undefined;
                     };
                 }, {
-                    tag: "deduped";
+                    tag: "deduped" | "imported" | "accepted";
                     document: {
                         id: string;
                         tenantId: string;
@@ -7566,67 +8662,19 @@ declare const allOperations: {
                         thumbnailState?: "pending" | "ready" | "failed" | "locked" | undefined;
                         thumbnailUrl?: string | null | undefined;
                     };
-                }>]>;
-            };
-            readonly 400: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
-                    }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
                 }>;
             };
-        };
-    };
-    readonly 'documents.commit': {
-        readonly operationId: "documents.commit";
-        readonly title: "Commit upload";
-        readonly summary: "Finish an upload: verify the SHA-256 and promote the document to ready.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/documents/:id/commit";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.create"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            id: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            id: string;
-            tenantId: string;
-        }, {
-            id: string;
-            tenantId: string;
-        }>;
-        readonly body: {
-            readonly contentType: "application/json";
-            readonly schema: z.ZodObject<{
-                sha256: z.ZodString;
-            }, "strip", z.ZodTypeAny, {
-                sha256: string;
-            }, {
-                sha256: string;
-            }>;
-        };
-        readonly responses: {
-            readonly 200: {
+            readonly 202: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
+                    /**
+                     * `imported` — bytes were pulled, verified, and committed (sync).
+                     * `deduped`  — an existing document satisfied the request without a
+                     * transfer (content dedup or idempotent replay).
+                     * `accepted` — async: the job is queued (HTTP 202); poll the
+                     * document until `ready` or `failed`.
+                     */
+                    tag: z.ZodEnum<["imported", "deduped", "accepted"]>;
                     document: z.ZodObject<{
                         id: z.ZodString;
                         tenantId: z.ZodString;
@@ -7672,6 +8720,7 @@ declare const allOperations: {
                         thumbnailUrl?: string | null | undefined;
                     }>;
                 }, "strip", z.ZodTypeAny, {
+                    tag: "deduped" | "imported" | "accepted";
                     document: {
                         id: string;
                         tenantId: string;
@@ -7688,6 +8737,7 @@ declare const allOperations: {
                         thumbnailUrl?: string | null | undefined;
                     };
                 }, {
+                    tag: "deduped" | "imported" | "accepted";
                     document: {
                         id: string;
                         tenantId: string;
@@ -7730,66 +8780,7 @@ declare const allOperations: {
                     };
                 }>;
             };
-            readonly 404: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    error: z.ZodObject<{
-                        code: z.ZodString;
-                        message: z.ZodString;
-                    }, "strip", z.ZodTypeAny, {
-                        code: string;
-                        message: string;
-                    }, {
-                        code: string;
-                        message: string;
-                    }>;
-                }, "strip", z.ZodTypeAny, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }, {
-                    error: {
-                        code: string;
-                        message: string;
-                    };
-                }>;
-            };
-        };
-    };
-    readonly 'documents.uploadProxy': {
-        readonly operationId: "documents.uploadProxy";
-        readonly title: "Upload document through the origin";
-        readonly summary: "Upload a bounded PDF through the API when the initialized transfer kind is proxy.";
-        readonly method: "POST";
-        readonly path: "/v1/tenants/:tenantId/documents/:id/upload-proxy";
-        readonly credentials: readonly ["api-token", "tenant-jwt"];
-        readonly scope: readonly ["docs.create"];
-        readonly params: z.ZodObject<{
-            tenantId: z.ZodString;
-            id: z.ZodString;
-        }, "strip", z.ZodTypeAny, {
-            id: string;
-            tenantId: string;
-        }, {
-            id: string;
-            tenantId: string;
-        }>;
-        readonly body: {
-            readonly contentType: "multipart/form-data";
-        };
-        readonly responses: {
-            readonly 200: {
-                readonly contentType: "application/json";
-                readonly schema: z.ZodObject<{
-                    sha256: z.ZodString;
-                }, "strip", z.ZodTypeAny, {
-                    sha256: string;
-                }, {
-                    sha256: string;
-                }>;
-            };
-            readonly 400: {
+            readonly 403: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -7814,7 +8805,7 @@ declare const allOperations: {
                     };
                 }>;
             };
-            readonly 409: {
+            readonly 502: {
                 readonly contentType: "application/json";
                 readonly schema: z.ZodObject<{
                     error: z.ZodObject<{
@@ -7840,7 +8831,7 @@ declare const allOperations: {
                 }>;
             };
         };
-        readonly notes: "This bounded origin-mediated fallback must only be used after documents.init returns upload.kind=proxy. Auto mode prefers a presigned object-store PUT whenever available.";
+        readonly notes: "Default mode is synchronous and bounded: the response returns only after the transfer verified and committed (or failed). mode=async (connection sources only) answers 202 immediately and an in-process worker performs the transfer with leased, fenced retries; poll the document until ready/failed. The deployment import policy gates scheme, network range, and size; sources must declare a length. CloudPDF copies and owns the bytes — the source is never referenced in place. A 502 marks a retryable upstream failure: retry with the same idempotencyKey to resume the same document. URL sources are capabilities and never echoed back. Connection sources name operator-registered storage (bucket/prefix scope, allowed credential classes, and tenant bindings are deployment configuration); `revision` is provider-interpreted (S3 VersionId, GCS generation, Azure version id).";
     };
     readonly 'documents.list': {
         readonly operationId: "documents.list";
@@ -9827,4 +10818,4 @@ declare const docsGroups: {
     };
 };
 
-export { ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT, ADMIN_DOCUMENT_LIST_MAX_LIMIT, type AdminCredential, type AdminDocumentCommitRequest, AdminDocumentCommitRequestSchema, type AdminDocumentCommitResponse, AdminDocumentCommitResponseSchema, type AdminDocumentInitRequest, AdminDocumentInitRequestSchema, type AdminDocumentInitResponse, AdminDocumentInitResponseSchema, type AdminDocumentListQuery, AdminDocumentListQuerySchema, type AdminDocumentListResponse, AdminDocumentListResponseSchema, type AdminDocumentRecord, AdminDocumentRecordSchema, type AdminDocumentResponse, AdminDocumentResponseSchema, type AdminErrorPayload, AdminErrorPayloadSchema, type AdminInitUpload, AdminInitUploadSchema, type AdminLicenseStatusResponse, AdminLicenseStatusResponseSchema, type AdminOperation, type AdminOperationBody, type AdminOperationHeader, type AdminOperationId, type AdminOperationMethod, type AdminOperationResponse, type AdminPresignedUpload, AdminPresignedUploadSchema, type AdminTenantCreateRequest, AdminTenantCreateRequestSchema, type AdminTenantCreateResponse, AdminTenantCreateResponseSchema, type AdminTenantDocParams, AdminTenantDocParamsSchema, type AdminTenantJtiParams, AdminTenantJtiParamsSchema, type AdminTenantListQuery, AdminTenantListQuerySchema, type AdminTenantListResponse, AdminTenantListResponseSchema, type AdminTenantParams, AdminTenantParamsSchema, type AdminTenantRecord, AdminTenantRecordSchema, type AdminTenantResponse, AdminTenantResponseSchema, type AdminTenantScope, type AdminTenantShareParams, AdminTenantShareParamsSchema, type AdminThumbnailUnavailablePayload, AdminThumbnailUnavailablePayloadSchema, type AdminTokenIssueDocRequest, AdminTokenIssueDocRequestSchema, type AdminTokenIssueRequest, AdminTokenIssueRequestSchema, type AdminTokenIssueResponse, AdminTokenIssueResponseSchema, type AdminTokenIssueTenantRequest, AdminTokenIssueTenantRequestSchema, type AdminTokenRevokeRequest, AdminTokenRevokeRequestSchema, type AdminUploadProxyResponse, AdminUploadProxyResponseSchema, type DedupMode, DedupModeSchema, DocAnnotationParamsSchema, DocFieldParamsSchema, DocIdParamsSchema, DocLayerParamsSchema, type DocOperationId, DocPageParamsSchema, type DocsGroup, type DocumentState, DocumentStateSchema, type ShareExchangeRequest, ShareExchangeRequestSchema, type ShareGrantCreateRequest, ShareGrantCreateRequestSchema, type ShareGrantListQuery, ShareGrantListQuerySchema, type ShareGrantListResponse, ShareGrantListResponseSchema, type ShareGrantRecord, ShareGrantRecordSchema, type ShareGrantResponse, ShareGrantResponseSchema, type ShareGrantUpdateRequest, ShareGrantUpdateRequestSchema, type ShareSessionResponse, ShareSessionResponseSchema, type TenantSuspendRequest, TenantSuspendRequestSchema, type TenantUsageQuery, TenantUsageQuerySchema, type TenantUsageResponse, TenantUsageResponseSchema, type UploadPreference, UploadPreferenceSchema, adminCredentials, adminOperations, adminTenantScopes, adminWirePaths, allOperations, docOperations, docsGroups, documentPasswordHeader };
+export { ADMIN_DOCUMENT_LIST_DEFAULT_LIMIT, ADMIN_DOCUMENT_LIST_MAX_LIMIT, type AdminCredential, type AdminDocumentCommitRequest, AdminDocumentCommitRequestSchema, type AdminDocumentCommitResponse, AdminDocumentCommitResponseSchema, type AdminDocumentImportRequest, AdminDocumentImportRequestSchema, type AdminDocumentImportResponse, AdminDocumentImportResponseSchema, type AdminDocumentInitRequest, AdminDocumentInitRequestSchema, type AdminDocumentInitResponse, AdminDocumentInitResponseSchema, type AdminDocumentListQuery, AdminDocumentListQuerySchema, type AdminDocumentListResponse, AdminDocumentListResponseSchema, type AdminDocumentRecord, AdminDocumentRecordSchema, type AdminDocumentResponse, AdminDocumentResponseSchema, type AdminErrorPayload, AdminErrorPayloadSchema, type AdminImportSource, AdminImportSourceSchema, type AdminInitUpload, AdminInitUploadSchema, type AdminLicenseStatusResponse, AdminLicenseStatusResponseSchema, type AdminOperation, type AdminOperationBody, type AdminOperationHeader, type AdminOperationId, type AdminOperationMethod, type AdminOperationResponse, type AdminPresignedUpload, AdminPresignedUploadSchema, type AdminTenantCreateRequest, AdminTenantCreateRequestSchema, type AdminTenantCreateResponse, AdminTenantCreateResponseSchema, type AdminTenantDocParams, AdminTenantDocParamsSchema, type AdminTenantJtiParams, AdminTenantJtiParamsSchema, type AdminTenantListQuery, AdminTenantListQuerySchema, type AdminTenantListResponse, AdminTenantListResponseSchema, type AdminTenantParams, AdminTenantParamsSchema, type AdminTenantRecord, AdminTenantRecordSchema, type AdminTenantResponse, AdminTenantResponseSchema, type AdminTenantScope, type AdminTenantShareParams, AdminTenantShareParamsSchema, type AdminThumbnailUnavailablePayload, AdminThumbnailUnavailablePayloadSchema, type AdminTokenIssueDocRequest, AdminTokenIssueDocRequestSchema, type AdminTokenIssueRequest, AdminTokenIssueRequestSchema, type AdminTokenIssueResponse, AdminTokenIssueResponseSchema, type AdminTokenIssueTenantRequest, AdminTokenIssueTenantRequestSchema, type AdminTokenRevokeRequest, AdminTokenRevokeRequestSchema, type AdminUploadProxyResponse, AdminUploadProxyResponseSchema, type DedupMode, DedupModeSchema, DocAnnotationParamsSchema, DocFieldParamsSchema, DocIdParamsSchema, DocLayerParamsSchema, type DocOperationId, DocPageParamsSchema, type DocsGroup, type DocumentState, DocumentStateSchema, type ShareExchangeRequest, ShareExchangeRequestSchema, type ShareGrantCreateRequest, ShareGrantCreateRequestSchema, type ShareGrantListQuery, ShareGrantListQuerySchema, type ShareGrantListResponse, ShareGrantListResponseSchema, type ShareGrantRecord, ShareGrantRecordSchema, type ShareGrantResponse, ShareGrantResponseSchema, type ShareGrantUpdateRequest, ShareGrantUpdateRequestSchema, type ShareSessionResponse, ShareSessionResponseSchema, type TenantSuspendRequest, TenantSuspendRequestSchema, type TenantUsageQuery, TenantUsageQuerySchema, type TenantUsageResponse, TenantUsageResponseSchema, type UploadPreference, UploadPreferenceSchema, adminCredentials, adminOperations, adminTenantScopes, adminWirePaths, allOperations, docOperations, docsGroups, documentPasswordHeader, tenantIdPattern };