@codespar/sdk 0.12.0 → 0.13.0

package/dist/generated/openapi.d.ts

@@ -2759,7 +2759,7 @@ export interface paths {
          *
          *     `tool_input` IS NOT THE CALL. It is what the lane that raised the hold recorded, and two things happen to it on the way in. A hold raised on the session execute path carries `{}`, because that path hands the policy engine no tool input at all and the engine stores an empty object when it gets none. A hold raised on the proxy path carries `{ server, method, endpoint, body, params, headers }`, with the `authorization` and `cookie` request headers removed before the row is written. So an empty object here means 'this lane records nothing', not 'the agent sent nothing'.
          *
-         *     `tool_name` HAS NO SINGLE FORMAT, because four lanes write it. The proxy path writes `<server>:<method>:<endpoint>` with the leading slash dropped and the remaining slashes turned into colons (`asaas`, `POST`, `/payments/create` becomes `asaas:post:payments:create`). The session execute path writes the caller's own `tool` string verbatim, which is any non-empty string that caller chose. The over-cap settlement lane writes `codespar_pay`. The operator account-status lane writes `admin:account_status_set`. Match on it only knowing which lane you are reading.
+         *     `tool_name` HAS NO SINGLE FORMAT, because four lanes write it. The proxy path writes `<server>:<method>:<endpoint>` with the leading slash dropped and the remaining slashes turned into colons (`asaas`, `POST`, `/payments/create` becomes `asaas:post:payments:create`). The session execute path writes the caller's own `tool` string verbatim, which is any non-empty string that caller chose. The over-cap settlement lane writes `codespar_pay`. The operator account-status lane writes `admin:account_status_set` and the operator withdrawal-resolution lane `admin:withdrawal_resolve`. Match on it only knowing which lane you are reading.
          *
          *     `expires_at` is the end of the hold, not a display hint: once it passes, the row stops being decidable and the expiry sweep moves it to `expired`.
          *
@@ -3907,7 +3907,7 @@ export interface paths {
          * Which rate-card lanes are measured and charged for this org
          * @description The public rate card has four lanes, told apart by the direction of the money: MOVIMENTAR (money leaving under a mandate, 10 bps), FATURAR (money being born in the receiver's account, 1%), GOVERNAR (account governance, per governed account) and OPERAR (non-monetary outcomes). A published price is not the same thing as a measured one, and this answer keeps the two apart per lane so a client never shows a figure the platform is not computing.
          *
-         *     `computed` says whether this build measures the lane from the organization's own ledger; `charging` says whether the organization is actually invoiced for it; `latest` is the last computed period and is only ever non-null on a computed lane (its shape is the one `GET /v1/fees/movimentar` returns). Today MOVIMENTAR is the only computed lane. `period` is the current calendar month in Sao Paulo time.
+         *     `computed` says whether this build measures the lane from the organization's own ledger; `charging` says whether the organization is actually invoiced for it; `latest` is the last computed period and is only ever non-null on a computed lane (its shape is the one the lane's own read returns: `GET /v1/fees/movimentar`, `GET /v1/fees/governar`). Today MOVIMENTAR and GOVERNAR are the computed lanes; FATURAR and OPERAR are not measured and always answer `latest: null`. `charging` is each lane's own switch: an organization can be charged for one lane and not the other. `period` is the current calendar month in Sao Paulo time.
          *
          *     Scope: `fees:read`.
          */
@@ -3951,36 +3951,16 @@ export interface paths {
                                 faturar: {
                                     computed: boolean;
                                     charging: boolean;
-                                    latest: {
-                                        period: string;
-                                        consumerCount: number;
-                                        movedMinor: number;
-                                        freeTierAppliedMinor: number;
-                                        billableMinor: number;
-                                        refundCreditMinor: number;
-                                        refundedCount: number;
-                                        feeMinor: number;
-                                        /** @enum {string} */
-                                        rateTier: "self_serve" | "commit_8bps" | "commit_6bps";
-                                        /** Format: date-time */
-                                        computedAt: string;
-                                        invoiced: boolean;
-                                    } | null;
+                                    latest: null;
                                 };
                                 governar: {
                                     computed: boolean;
                                     charging: boolean;
                                     latest: {
                                         period: string;
-                                        consumerCount: number;
-                                        movedMinor: number;
-                                        freeTierAppliedMinor: number;
-                                        billableMinor: number;
-                                        refundCreditMinor: number;
-                                        refundedCount: number;
+                                        governedAccountsCount: number;
+                                        consumerIdsSha256: string;
                                         feeMinor: number;
-                                        /** @enum {string} */
-                                        rateTier: "self_serve" | "commit_8bps" | "commit_6bps";
                                         /** Format: date-time */
                                         computedAt: string;
                                         invoiced: boolean;
@@ -3989,21 +3969,7 @@ export interface paths {
                                 operar: {
                                     computed: boolean;
                                     charging: boolean;
-                                    latest: {
-                                        period: string;
-                                        consumerCount: number;
-                                        movedMinor: number;
-                                        freeTierAppliedMinor: number;
-                                        billableMinor: number;
-                                        refundCreditMinor: number;
-                                        refundedCount: number;
-                                        feeMinor: number;
-                                        /** @enum {string} */
-                                        rateTier: "self_serve" | "commit_8bps" | "commit_6bps";
-                                        /** Format: date-time */
-                                        computedAt: string;
-                                        invoiced: boolean;
-                                    } | null;
+                                    latest: null;
                                 };
                             };
                         };
@@ -4078,6 +4044,61 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/fees/governar": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The org's latest GOVERNAR-lane fee period (rate card v1)
+         * @description What the calling credential's organization owes CodeSpar for the most recently computed calendar month (Sao Paulo time) under the GOVERNAR lane of the public rate card (Account governance): R$4,90 per governed account active in the month. A governed account active in the month is a holder that had a consumer mandate active at some instant of the month AND at least one outcome settled under one of their mandates in the month (a debit in the wallet ledger, or a receipt sealed). A holder with mandates and no settled outcome in the month costs nothing; a holder with three mandates is one account; the population resets every month.
+         *
+         *     This lane prices the ACCOUNT, not the outcome. The same debit that pays 10 bps under MOVIMENTAR is what shows the account was alive in the month; it is not priced twice, because the two lines price two different things.
+         *
+         *     HOW TO READ THE NUMBERS. `governedAccountsCount` is how many holders were counted; `feeMinor` is that count times R$4,90, in centavos; `consumerIdsSha256` is the SHA-256 (hex) of the counted consumer ids sorted and joined by a newline, so a client can verify its own list of accounts against the figure; the ids themselves stay on the platform's row for audit. `invoiced` says whether the period has been invoiced; a period is invoiced at most once.
+         *
+         *     `null` (200) when no period has been computed for the organization yet. The period is computed by the platform, not on this read; `computedAt` says when.
+         *
+         *     Scope: `fees:read`.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            period: string;
+                            governedAccountsCount: number;
+                            consumerIdsSha256: string;
+                            feeMinor: number;
+                            /** Format: date-time */
+                            computedAt: string;
+                            invoiced: boolean;
+                        } | null;
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/cart/meli/connect/start": {
         parameters: {
             query?: never;
@@ -4502,6 +4523,7 @@ export interface paths {
         };
         /**
          * Read the credential form a provider needs, without reading any credential
+         * @deprecated
          * @description What to ask an operator for before connecting this provider, and where the request will go once connected. It NEVER returns a stored secret: the vault is write-only from this side, and `fields` describes inputs to collect, not values that exist.
          *
          *     AN EMPTY `fields` DOES NOT MEAN NOTHING TO DO, and four auth types produce one. `oauth` collects nothing here because the browser leg starts at `POST /v1/connections/start` instead. `none` needs no credential. And `jwt_ecdsa` and `cdp` reach no field-building branch at all, so they come back empty while still needing operator-issued material: read that pair as unsupported by this form rather than as ready to connect. The other five all return at least one field, `cert` included.
@@ -4664,6 +4686,7 @@ export interface paths {
         put?: never;
         /**
          * Ask the provider whether this project's stored credential still works
+         * @deprecated
          * @description Issues ONE safe read against the provider using the credential this project has stored for it, and reports what came back. POST because it leaves the process and spends a provider call, not because it changes anything here: no state of yours is altered by it. It takes NO REQUEST BODY, and anything sent is ignored.
          *
          *     WHICH READ depends on the provider. A handful ship a bespoke recipe, and those are the ones that can return an `account` summary. Everything else re-runs the provider's declared functional probe, the same authenticated read used to confirm a sandbox works when it is first set up; that path returns no `account`. A provider with neither answers 501.
@@ -4778,6 +4801,24 @@ export interface paths {
                         };
                     };
                 };
+                /** @description `test_venue_unavailable`. The project is in `environment="test"` and this provider cannot be exercised there: its catalog entry classifies `test_venue` as `none` (the provider runs no test environment, so a call would land on production with a real effect) or `unclassified` (nobody has established what it does in test). Not a verdict on the credential and not retryable — the identical request from a `live` project reaches the provider (ent#722). */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            ok: false;
+                            /** @description The provider id from the path. */
+                            provider: string;
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            /** @description A CodeSpar-authored sentence naming the catalog file and the field to declare. Never provider text — no round trip was made. */
+                            detail: string;
+                        };
+                    };
+                };
                 /** @description `not_connected`. There is nothing to verify: either no active connection exists for this project and provider, or one exists and its stored credential did not resolve to a value. Connect the provider, or reconnect it. */
                 424: {
                     headers: {
@@ -5967,8 +6008,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6000,8 +6041,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6028,8 +6069,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6056,8 +6097,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6084,8 +6125,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6112,8 +6153,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6140,8 +6181,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6875,6 +6916,23 @@ export interface paths {
                         };
                     };
                 };
+                /** @description The project is in `environment="test"` and this provider has no test venue, so the flow is refused BEFORE a state token is minted — a refused start leaves no half-begun link behind. Sending a test project to the provider's LIVE consent screen would have it authorise a real account and vault a real token under a project that is not supposed to hold one (ent#722). Not retryable; the same call from a `live` project succeeds. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            server_id: string;
+                            /** @enum {string} */
+                            environment: "live" | "test";
+                            /** @description Names the catalog file and the field to declare. */
+                            detail: string;
+                        };
+                    };
+                };
                 /** @description The platform's OAuth client credential is not seeded for this provider. A configuration defect on our side. */
                 500: {
                     headers: {
@@ -7968,6 +8026,7 @@ export interface paths {
         };
         /**
          * Browse the audit chain (alias path)
+         * @deprecated
          * @description A read-only page of the caller's own tamper-evident chain, newest first.
          *
          *     THIS IS AN ALIAS OF `GET /v1/audit-events`, NOT A SECOND RESOURCE. One handler serves both paths, so the query, the body and every refusal are identical and there is nothing to choose between them. It is described separately only because a generated client sees two operations; pick one spelling and stay on it. Note that the OTHER audit operations — the chain's health report, its incidents, its configuration — have no twin under this prefix and live only under `/v1/audit-events`.
@@ -8525,8 +8584,12 @@ export interface paths {
                                 counterparty_id: string;
                                 /** @enum {string} */
                                 kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                                /** @description Minor units. Stored as a 64 bit integer and rendered as a JSON number. Null unless `currency` is also set. */
+                                /** @description Minor units (cents). The row is STORED in the currency's native unit, BRL centavos and USDC 10^-6 (ent#1203), and rendered here in cents rounded away from zero, so a USDC row of 0.001 reads as 1 and never as 0. `amount_native` carries the exact figure. Null unless `currency` is also set. */
                                 amount_minor: number | null;
+                                /** @description The stored figure, exact, in the currency's NATIVE unit as a decimal string: BRL centavos, USDC 10^-6. This is the unit the wallet ledger holds, so it joins to `wallet_ledger.amount_minor` without conversion. Null when `amount_minor` is. */
+                                amount_native: string | null;
+                                /** @description The same figure in major units as a decimal string (`"0.001"`, `"19.99"`), for display. */
+                                amount: string | null;
                                 currency: string | null;
                                 /** Format: date-time */
                                 occurred_at: string;
@@ -8590,7 +8653,7 @@ export interface paths {
                         counterparty_id: string;
                         /** @enum {string} */
                         kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                        /** @description Minor units. Set it together with `currency` or omit both. */
+                        /** @description Minor units (cents). Stored in the currency's native unit (USDC x10^4, BRL as is), so this field cannot carry a sub-cent USDC figure. Set it together with `currency` or omit both. */
                         amount_minor?: number;
                         currency?: string;
                         /**
@@ -8628,8 +8691,12 @@ export interface paths {
                                 counterparty_id: string;
                                 /** @enum {string} */
                                 kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                                /** @description Minor units. Stored as a 64 bit integer and rendered as a JSON number. Null unless `currency` is also set. */
+                                /** @description Minor units (cents). The row is STORED in the currency's native unit, BRL centavos and USDC 10^-6 (ent#1203), and rendered here in cents rounded away from zero, so a USDC row of 0.001 reads as 1 and never as 0. `amount_native` carries the exact figure. Null unless `currency` is also set. */
                                 amount_minor: number | null;
+                                /** @description The stored figure, exact, in the currency's NATIVE unit as a decimal string: BRL centavos, USDC 10^-6. This is the unit the wallet ledger holds, so it joins to `wallet_ledger.amount_minor` without conversion. Null when `amount_minor` is. */
+                                amount_native: string | null;
+                                /** @description The same figure in major units as a decimal string (`"0.001"`, `"19.99"`), for display. */
+                                amount: string | null;
                                 currency: string | null;
                                 /** Format: date-time */
                                 occurred_at: string;
@@ -8657,8 +8724,12 @@ export interface paths {
                             counterparty_id: string;
                             /** @enum {string} */
                             kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                            /** @description Minor units. Stored as a 64 bit integer and rendered as a JSON number. Null unless `currency` is also set. */
+                            /** @description Minor units (cents). The row is STORED in the currency's native unit, BRL centavos and USDC 10^-6 (ent#1203), and rendered here in cents rounded away from zero, so a USDC row of 0.001 reads as 1 and never as 0. `amount_native` carries the exact figure. Null unless `currency` is also set. */
                             amount_minor: number | null;
+                            /** @description The stored figure, exact, in the currency's NATIVE unit as a decimal string: BRL centavos, USDC 10^-6. This is the unit the wallet ledger holds, so it joins to `wallet_ledger.amount_minor` without conversion. Null when `amount_minor` is. */
+                            amount_native: string | null;
+                            /** @description The same figure in major units as a decimal string (`"0.001"`, `"19.99"`), for display. */
+                            amount: string | null;
                             currency: string | null;
                             /** Format: date-time */
                             occurred_at: string;
@@ -9223,7 +9294,7 @@ export interface paths {
                                 interaction_count: number;
                                 /** @description Of those, the ones with `kind: payment`. */
                                 payment_count: number;
-                                /** @description Sum of `amount_minor` over the window's PAYMENT interactions only, ACROSS CURRENCIES. Read `currencies` before reading this as an amount. */
+                                /** @description Sum over the window's PAYMENT interactions only, ACROSS CURRENCIES, in cents: each row is converted from its currency's native unit before the sum and the total is rounded up once. Read `currencies` before reading this as an amount. */
                                 total_payment_minor: number;
                                 /** @description Distinct non null currencies over the window's interactions of EVERY kind, not only the payments the total is built from. It is therefore an UPPER BOUND on the currencies inside `total_payment_minor` and never a smaller set: an invoice priced in USD puts USD here while the total stays pure BRL. One entry (or none) does bound the total to a single currency; two or more do not prove it mixes. */
                                 currencies: string[];
@@ -9411,7 +9482,7 @@ export interface paths {
                                 /** @enum {string} */
                                 kind: "supplier" | "customer" | "agent_peer";
                                 payment_count: number;
-                                /** @description Sum of `amount_minor` over the window's payment interactions, ACROSS CURRENCIES. */
+                                /** @description Sum over the window's payment interactions, ACROSS CURRENCIES, in cents: each row converted from its currency's native unit before the sum, the total rounded up once. */
                                 total_payment_minor: number;
                                 /** @description The most frequent currency over ALL of this counterparty's payment interactions, ignoring `since` and `until`, so it can name a currency the window itself never saw. */
                                 dominant_currency: string | null;
@@ -10210,6 +10281,23 @@ export interface paths {
                         };
                     };
                 };
+                /** @description The project is in `environment="test"` and this provider has no test venue, so the flow is refused BEFORE a state token is minted — a refused start leaves no half-begun link behind. Sending a test project to the provider's LIVE consent screen would have it authorise a real account and vault a real token under a project that is not supposed to hold one (ent#722). Not retryable; the same call from a `live` project succeeds. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            server_id: string;
+                            /** @enum {string} */
+                            environment: "live" | "test";
+                            /** @description Names the catalog file and the field to declare. */
+                            detail: string;
+                        };
+                    };
+                };
                 /** @description The platform's OAuth client credential is not seeded for this provider. A configuration defect on our side. */
                 500: {
                     headers: {
@@ -10255,45 +10343,715 @@ export interface paths {
                 path: {
                     run_id: string;
                 };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description OK */
-                200: {
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "running" | "needs_verification" | "provisioned" | "failed";
+                            /** @description Present while the run waits on the customer. Fallback copy when the modal has none of its own. */
+                            prompt?: string;
+                            /** @description Resolved from the provider's public descriptor. Present only while `status` is `needs_verification`. */
+                            verification?: {
+                                /**
+                                 * @description `code` means the provider mailed a one-time code to type; `link` means it mailed an activation link to click.
+                                 * @enum {string}
+                                 */
+                                mechanism: "code" | "link";
+                                resend?: boolean;
+                            };
+                            /** @description Result of the post-provision reachability probe, when one ran. */
+                            probe_result?: unknown;
+                            /** @description The `ca_` id of the connection the run produced. Present once the run reaches `provisioned`. */
+                            connection_id?: string;
+                            /**
+                             * @description Why the run failed. A stored value outside this vocabulary is reported as absent rather than passed through, so a failed run can render as its status alone.
+                             * @enum {string}
+                             */
+                            code?: "flow_failed" | "capacity" | "no_credential_captured" | "probe_failed" | "drive_deadline_exceeded" | "provider_account_not_registered" | "drive_stalled" | "resume_inputs_unavailable";
+                            failed_step_id?: string;
+                        };
+                    };
+                };
+                /** @description No run with that id inside the caller's org and project. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description The paused run expired before it was resumed. */
+                410: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "run_stale";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/subaccount/{id}/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Revoke a provisioned subaccount and try to delete it upstream
+         * @description The revoke for accounts this platform minted on the customer's behalf. It is not `POST /v1/connections/{id}/revoke`: the generic purge targets the ref keyed on the server id, which is the wrong ref for a per-account subaccount credential, and it touches neither the provisioning record nor the account at the provider.
+         *
+         *     Local teardown first, atomically: the connection projection flips, the provisioning record flips, and the correct per-account vault ref is purged. A failure in that phase changes nothing and answers 503, so a retry is safe. Only then is a delete attempted at the provider.
+         *
+         *     READ `upstream` BEFORE TREATING THIS AS FINISHED. `deleted` means the account is gone at the provider. `not_applicable` means the lane has no delete to make. `delete_failed` and `orphaned` mean the credential is destroyed on our side but an account may still exist upstream, and closing it is a manual step. All four come back with 200, because the local teardown did succeed.
+         *
+         *     `{id}` is a connection id for the customer path, matched only inside the caller's own org and project. It is a provisioning record id for the operator-internal path, which additionally requires service auth. A customer credential can never reach an operator-internal record: it misses the connection lookup and gets 404, never a 403 that would confirm the id exists. A repeated revoke returns `already: true` and changes nothing.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "revoked";
+                            record_id: string;
+                            /** @description The connection projection's id, or the provisioning record's id when there is no projection. */
+                            connection_id: string;
+                            /**
+                             * @description What happened at the provider. `delete_failed` and `orphaned` mean an account may still exist there; the local credential is gone either way.
+                             * @enum {string}
+                             */
+                            upstream: "deleted" | "delete_failed" | "not_applicable" | "orphaned";
+                            /**
+                             * @description Present when the subaccount was already revoked. Nothing changed.
+                             * @enum {boolean}
+                             */
+                            already?: true;
+                        };
+                    };
+                };
+                /** @description This is a write, so it carries a role floor: a service-auth caller must send `x-codespar-user` and hold admin or above. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "insufficient_role";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description No connection or operator-internal record with that id is reachable by this caller. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description The revoke threw unexpectedly. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "revoke_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The internal phase failed and left nothing changed. Retry. */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "revoke_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/subaccount/{id}/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read whether a provisioned subaccount can transact yet
+         * @description Read-only, with one live call to the provider. It writes nothing and changes no state.
+         *
+         *     `charges_enabled` is what the provider says right now, not a cached flag, which is why a provider that is unreachable answers 502 rather than a stale `false`. The one exception is a revoked record: it short-circuits to `status: "revoked"` and `charges_enabled: false` without calling the provider at all, since there is nothing left to poll. A confirmed account that never reached an upstream account ref reports not-yet-chargeable for the same reason.
+         *
+         *     `capabilities` carries the provider's per-capability activation states when it reports them, and is absent when it does not. An account can be provisioned and still not chargeable; gate any money movement on `charges_enabled`, not on the existence of the connection.
+         *
+         *     Same dual-id resolution and same cross-tenant 404 as the revoke beside it, minus its admin floor: a read does not need one.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "provisioned" | "revoked";
+                            charges_enabled: boolean;
+                            /** @description Per-capability activation states as the provider reports them, for example `card_payments: "active"`. */
+                            capabilities?: {
+                                [key: string]: string;
+                            };
+                            /** @description The upstream account identifier. Empty string when the record never reached one. */
+                            account_ref: string;
+                        };
+                    };
+                };
+                /** @description No connection or operator-internal record with that id is reachable by this caller. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description The status read threw unexpectedly. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "status_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The provider read did not produce a status. Usually the live call failed or timed out, and a retry is the right response. TWO OF THE CASES BEHIND THIS CODE ARE NOT TRANSIENT and retrying never clears them: the provider has no subaccount descriptor in this deployment, and no platform account credential is registered for it. Both are configuration defects on our side; `error.message` distinguishes them from a provider outage. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "status_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consents": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a hosted consent
+         * @description Starts a hosted consent for a consumer mandate. The partner's backend calls this with its API key and gets a one-shot token carrying the intent the consumer is about to authorize (purpose, total and per-transaction caps, currency, mandate TTL and the merchant, withdrawal and DDA allowlists that will be signed into the mandate). The partner composes the URL of the hosted consent page from the token and hands it to the consumer.
+         *
+         *     The consumer signs on the hosted page. The mandate is created server-side when the consumer submits there: the consumer's secret is provisioned, the mandate is signed with it, the funding source and the consent record are written and the token is consumed, in one transaction. The API key never signs, and the page's own calls are not operations of this document: nothing a partner can call with a key produces a signed mandate.
+         *
+         *     `intent.merchant_allowlist` defaults to `["*"]`, an explicit wildcard bounded by the caps, purpose and expiry; pass concrete Pix keys to narrow it. `intent.withdrawal_allowlist` and `intent.dda_allowlist` are deliberately NOT defaulted: absent means the mandate authorizes no cash-out and no DDA registration, which is a different thing from a wildcard, and `"*"` is refused in both. `callback_url`, when given, is returned to the hosted page at submit time so the partner's backend can receive the signed mandate.
+         *
+         *     The token is stamped with the credential's project, and that stamp is what scopes the funding source the consumer's submission later creates.
+         *
+         *     Requires the `consents:write` scope.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        agent_id: string;
+                        /** Format: email */
+                        consumer_email_hint?: string;
+                        intent: {
+                            purpose: string;
+                            cap_minor: number;
+                            per_tx_cap_minor: number;
+                            /** @enum {string} */
+                            currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                            mandate_ttl_seconds: number;
+                            /**
+                             * @default [
+                             *       "*"
+                             *     ]
+                             */
+                            merchant_allowlist?: string[];
+                            /**
+                             * @default pix-key
+                             * @enum {string}
+                             */
+                            merchant_pin_kind?: "pix-key" | "merchant-id" | "mcc";
+                            withdrawal_allowlist?: string[];
+                            dda_allowlist?: string[];
+                            slots?: {
+                                /** @enum {string} */
+                                currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                                rail: string;
+                                cap_minor: number;
+                                per_tx_cap_minor: number;
+                            }[];
+                            display_name?: string;
+                            intent_note?: string;
+                            shipping?: {
+                                [key: string]: unknown;
+                            };
+                        };
+                        /** Format: uri */
+                        callback_url?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Created. The consent is pending until the consumer signs on the hosted page or the token expires. */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description One-shot, `ctk_`-prefixed, unguessable. Put it in the URL of the hosted consent page and hand that URL to the consumer. It is consumed by the consumer's submission and cannot be replayed. */
+                            token: string;
+                            /** @description ISO 8601. The token expires 24 hours after this call; a consumer opening the link after that sees an expired consent and nothing is created. This is the TOKEN's TTL, not the mandate's: the mandate's own TTL is `intent.mandate_ttl_seconds`, counted from the moment the consumer signs. */
+                            expires_at: string;
+                        };
+                    };
+                };
+                /** @description The body did not match the schema. `details.issues` carries the Zod issues; the refusals with their own message are a `"*"` entry in `intent.withdrawal_allowlist` and a `intent.dda_allowlist` entry that is not a CPF (11 digits) or a CNPJ (14 digits). */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consents/init": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a hosted consent
+         * @deprecated
+         * @description DEPRECATED alias of `POST /v1/consents` (ent#979), kept for two releases. Same handler, same required scope, same request and same responses; switch the path and nothing else changes. The canonical path is described in this document too.
+         *
+         *     Starts a hosted consent for a consumer mandate. The partner's backend calls this with its API key and gets a one-shot token carrying the intent the consumer is about to authorize (purpose, total and per-transaction caps, currency, mandate TTL and the merchant, withdrawal and DDA allowlists that will be signed into the mandate). The partner composes the URL of the hosted consent page from the token and hands it to the consumer.
+         *
+         *     The consumer signs on the hosted page. The mandate is created server-side when the consumer submits there: the consumer's secret is provisioned, the mandate is signed with it, the funding source and the consent record are written and the token is consumed, in one transaction. The API key never signs, and the page's own calls are not operations of this document: nothing a partner can call with a key produces a signed mandate.
+         *
+         *     `intent.merchant_allowlist` defaults to `["*"]`, an explicit wildcard bounded by the caps, purpose and expiry; pass concrete Pix keys to narrow it. `intent.withdrawal_allowlist` and `intent.dda_allowlist` are deliberately NOT defaulted: absent means the mandate authorizes no cash-out and no DDA registration, which is a different thing from a wildcard, and `"*"` is refused in both. `callback_url`, when given, is returned to the hosted page at submit time so the partner's backend can receive the signed mandate.
+         *
+         *     The token is stamped with the credential's project, and that stamp is what scopes the funding source the consumer's submission later creates.
+         *
+         *     Requires the `consents:write` scope.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        agent_id: string;
+                        /** Format: email */
+                        consumer_email_hint?: string;
+                        intent: {
+                            purpose: string;
+                            cap_minor: number;
+                            per_tx_cap_minor: number;
+                            /** @enum {string} */
+                            currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                            mandate_ttl_seconds: number;
+                            /**
+                             * @default [
+                             *       "*"
+                             *     ]
+                             */
+                            merchant_allowlist?: string[];
+                            /**
+                             * @default pix-key
+                             * @enum {string}
+                             */
+                            merchant_pin_kind?: "pix-key" | "merchant-id" | "mcc";
+                            withdrawal_allowlist?: string[];
+                            dda_allowlist?: string[];
+                            slots?: {
+                                /** @enum {string} */
+                                currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                                rail: string;
+                                cap_minor: number;
+                                per_tx_cap_minor: number;
+                            }[];
+                            display_name?: string;
+                            intent_note?: string;
+                            shipping?: {
+                                [key: string]: unknown;
+                            };
+                        };
+                        /** Format: uri */
+                        callback_url?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Created. The consent is pending until the consumer signs on the hosted page or the token expires. */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description One-shot, `ctk_`-prefixed, unguessable. Put it in the URL of the hosted consent page and hand that URL to the consumer. It is consumed by the consumer's submission and cannot be replayed. */
+                            token: string;
+                            /** @description ISO 8601. The token expires 24 hours after this call; a consumer opening the link after that sees an expired consent and nothing is created. This is the TOKEN's TTL, not the mandate's: the mandate's own TTL is `intent.mandate_ttl_seconds`, counted from the moment the consumer signs. */
+                            expires_at: string;
+                        };
+                    };
+                };
+                /** @description The body did not match the schema. `details.issues` carries the Zod issues; the refusals with their own message are a `"*"` entry in `intent.withdrawal_allowlist` and a `intent.dda_allowlist` entry that is not a CPF (11 digits) or a CNPJ (14 digits). */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consumers/mandates/{id}/spend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Gastar sob um mandato já projetado
+         * @description Executa uma saída de dinheiro sob um mandato que já está projetado nesta organização, identificado por id. É o caminho que o meta-tool `codespar_pay` usa por dentro, então o comportamento aqui é o mesmo que um agente obtém — esta rota existe para quem não usa o SDK chegar ao mesmo lugar.
+         *
+         *     Com `ted` presente, a perna do provedor é uma transferência bancária de verdade, debitada da sub-conta do próprio consumidor. Sem `ted`, `payee` é uma chave Pix ou um copia-e-cola.
+         *
+         *     **TED tem três exigências que as outras formas de pagamento não têm, e as três vinculam ANTES de qualquer passo de dinheiro:**
+         *
+         *     1. `attempt_id` é OBRIGATÓRIO. Uma TED não tem copia-e-cola nem nonce de onde derivar correlação, e duas TEDs sob o mesmo mandato nunca podem colidir num id derivado.
+         *     2. `payee` tem que ser IGUAL à string canônica do destino, `ted:<ispb>:<agência>:<conta>`, só alfanuméricos e em maiúsculas. A comparação normaliza apenas espaços em branco, então uma entrada com ponto ou hífen NÃO casa. Esta regra existe para o pin da lista assinada e o fio nomearem o MESMO destino: sem ela, um recebedor aprovado serviria de fachada para outra conta bancária.
+         *     3. O destino tem que estar na `withdrawal_allowlist` ASSINADA do mandato. Um curinga `"*"` de lista de comerciante NUNCA autoriza saída de dinheiro, nem no caminho legado.
+         *
+         *     O teto cumulativo é conferido e CONSUMIDO sob trava de advisory lock, e a reserva na carteira é tomada dentro da mesma trava. A trava é liberada antes da chamada ao provedor, então uma chamada lenta não serializa as outras.
+         *
+         *     **Não existe rota de leitura do desfecho.** Um `attempt_id` que respondeu `psp_dispatch_uncertain` não tem endpoint para consultar depois. Guarde o `attempt_id` e reapresente-o: o ciclo é idempotente por ele e responde o estado em que aquela tentativa parou, em vez de disparar uma segunda. NÃO reinicie a mesma intenção com um `attempt_id` novo — é assim que se paga duas vezes.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description Id do mandato. */
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description Valor em centavos. */
+                        amount_minor: number;
+                        /** @description Chave Pix, copia-e-cola, ou — para TED — a string canônica do destino. O limite de 1024 acomoda um copia-e-cola. */
+                        payee: string;
+                        agent_id?: string;
+                        /** @description Obrigatório quando `ted` está presente. Reapresente-o em toda retentativa. */
+                        attempt_id?: string;
+                        ted?: components["schemas"]["TedDestination"];
+                        quote?: components["schemas"]["SpendQuote"];
+                    };
+                };
+            };
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SpendOutcome"];
+                    };
+                };
+                /** @description O corpo não casou com o schema. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description O destino não está na lista de saque assinada do mandato. Nada foi enviado ao provedor. A resposta traz o próximo passo de consentimento. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "withdrawal_pin";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description Não existe mandato com esse id nesta organização. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_not_found";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description O estado local impede. `psp_attempt_in_flight`: a mesma tentativa está em voo. `psp_attempt_uncertain`: uma tentativa anterior ficou com desfecho desconhecido e esta intenção está PINADA nela — reapresente o mesmo `attempt_id`, nunca um novo. `psp_attempt_conflict`: a tentativa anterior já foi compensada. */
+                409: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "running" | "needs_verification" | "provisioned" | "failed";
-                            /** @description Present while the run waits on the customer. Fallback copy when the modal has none of its own. */
-                            prompt?: string;
-                            /** @description Resolved from the provider's public descriptor. Present only while `status` is `needs_verification`. */
-                            verification?: {
-                                /**
-                                 * @description `code` means the provider mailed a one-time code to type; `link` means it mailed an activation link to click.
-                                 * @enum {string}
-                                 */
-                                mechanism: "code" | "link";
-                                resend?: boolean;
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
-                            /** @description Result of the post-provision reachability probe, when one ran. */
-                            probe_result?: unknown;
-                            /** @description The `ca_` id of the connection the run produced. Present once the run reaches `provisioned`. */
-                            connection_id?: string;
-                            /**
-                             * @description Why the run failed. A stored value outside this vocabulary is reported as absent rather than passed through, so a failed run can render as its status alone.
-                             * @enum {string}
-                             */
-                            code?: "flow_failed" | "capacity" | "no_credential_captured" | "probe_failed" | "drive_deadline_exceeded" | "provider_account_not_registered" | "drive_stalled" | "resume_inputs_unavailable";
-                            failed_step_id?: string;
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description No run with that id inside the caller's org and project. */
-                404: {
+                /** @description O mandato recusa. `mandate_verify`: assinatura, agente, propósito ou recebedor não conferem. `mandate_projection_mismatch`: a assinatura apresentada difere da armazenada, ou o mandato não está ativo. `no_funding_source`: o consumidor não tem fonte de recursos que sirva a este rail — para TED, exige conta bancária registrada. */
+                422: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10301,14 +11059,19 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "not_found";
+                                code: "mandate_verify" | "mandate_projection_mismatch" | "no_funding_source";
                                 message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description The paused run expired before it was resumed. */
-                410: {
+                /** @description O verificador respondeu sem resolver o teto cumulativo, então a recheca sob trava não teria limite com que comparar. Recusa deliberada: nada é debitado. */
+                500: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10316,7 +11079,27 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "run_stale";
+                                code: "mandate_cap_unresolved";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description O provedor recusou ou não respondeu. `psp_dispatch_failed`: recusa conhecida, nada saiu. `psp_dispatch_uncertain`: NÃO se sabe se saiu — a reserva permanece e a tentativa fica pinada. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_dispatch_failed" | "psp_dispatch_uncertain";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10329,15 +11112,13 @@ export interface paths {
                 };
             };
         };
-        put?: never;
-        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/connections/subaccount/{id}/revoke": {
+    "/v1/consumer-payments/execute": {
         parameters: {
             query?: never;
             header?: never;
@@ -10347,53 +11128,74 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Revoke a provisioned subaccount and try to delete it upstream
-         * @description The revoke for accounts this platform minted on the customer's behalf. It is not `POST /v1/connections/{id}/revoke`: the generic purge targets the ref keyed on the server id, which is the wrong ref for a per-account subaccount credential, and it touches neither the provisioning record nor the account at the provider.
+         * Gastar apresentando o mandato assinado
+         * @description O mesmo ciclo da rota por id, para quem carrega o envelope assinado em vez de um mandato já projetado. Use esta quando o mandato vem do consumidor no momento da chamada; use a `/consumers/mandates/{id}/spend` quando ele já está registrado aqui.
          *
-         *     Local teardown first, atomically: the connection projection flips, the provisioning record flips, and the correct per-account vault ref is purged. A failure in that phase changes nothing and answers 503, so a retry is safe. Only then is a delete attempted at the provider.
+         *     `signature` é o HMAC de 64 caracteres hexadecimais sobre o mandato canônico. O `agent_id` do corpo é conferido contra o ASSINADO: a atribuição do gasto pertence ao mandato, não a quem chama.
          *
-         *     READ `upstream` BEFORE TREATING THIS AS FINISHED. `deleted` means the account is gone at the provider. `not_applicable` means the lane has no delete to make. `delete_failed` and `orphaned` mean the credential is destroyed on our side but an account may still exist upstream, and closing it is a manual step. All four come back with 200, because the local teardown did succeed.
+         *     **TED tem três exigências que as outras formas de pagamento não têm, e as três vinculam ANTES de qualquer passo de dinheiro:**
          *
-         *     `{id}` is a connection id for the customer path, matched only inside the caller's own org and project. It is a provisioning record id for the operator-internal path, which additionally requires service auth. A customer credential can never reach an operator-internal record: it misses the connection lookup and gets 404, never a 403 that would confirm the id exists. A repeated revoke returns `already: true` and changes nothing.
+         *     1. `attempt_id` é OBRIGATÓRIO. Uma TED não tem copia-e-cola nem nonce de onde derivar correlação, e duas TEDs sob o mesmo mandato nunca podem colidir num id derivado.
+         *     2. `payee` tem que ser IGUAL à string canônica do destino, `ted:<ispb>:<agência>:<conta>`, só alfanuméricos e em maiúsculas. A comparação normaliza apenas espaços em branco, então uma entrada com ponto ou hífen NÃO casa. Esta regra existe para o pin da lista assinada e o fio nomearem o MESMO destino: sem ela, um recebedor aprovado serviria de fachada para outra conta bancária.
+         *     3. O destino tem que estar na `withdrawal_allowlist` ASSINADA do mandato. Um curinga `"*"` de lista de comerciante NUNCA autoriza saída de dinheiro, nem no caminho legado.
+         *
+         *     **Não existe rota de leitura do desfecho.** Um `attempt_id` que respondeu `psp_dispatch_uncertain` não tem endpoint para consultar depois. Guarde o `attempt_id` e reapresente-o: o ciclo é idempotente por ele e responde o estado em que aquela tentativa parou, em vez de disparar uma segunda. NÃO reinicie a mesma intenção com um `attempt_id` novo — é assim que se paga duas vezes.
          */
         post: {
             parameters: {
                 query?: never;
                 header?: never;
-                path: {
-                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
-                    id: string;
-                };
+                path?: never;
                 cookie?: never;
             };
-            requestBody?: never;
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description O mandato canônico, na forma em que foi assinado. */
+                        mandate?: unknown;
+                        /** @description HMAC em hexadecimal, 64 caracteres. */
+                        signature: string;
+                        amount_minor: number;
+                        purpose: string;
+                        agent_id: string;
+                        payee: string;
+                        attempt_id?: string;
+                        ted?: components["schemas"]["TedDestination"];
+                        quote?: components["schemas"]["SpendQuote"];
+                    };
+                };
+            };
             responses: {
                 /** @description OK */
                 200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SpendOutcome"];
+                    };
+                };
+                /** @description O corpo não casou com o schema. */
+                400: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "revoked";
-                            record_id: string;
-                            /** @description The connection projection's id, or the provisioning record's id when there is no projection. */
-                            connection_id: string;
-                            /**
-                             * @description What happened at the provider. `delete_failed` and `orphaned` mean an account may still exist there; the local credential is gone either way.
-                             * @enum {string}
-                             */
-                            upstream: "deleted" | "delete_failed" | "not_applicable" | "orphaned";
-                            /**
-                             * @description Present when the subaccount was already revoked. Nothing changed.
-                             * @enum {boolean}
-                             */
-                            already?: true;
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description This is a write, so it carries a role floor: a service-auth caller must send `x-codespar-user` and hold admin or above. */
+                /** @description O destino não está na lista de saque assinada. Nada foi enviado ao provedor. */
                 403: {
                     headers: {
                         [name: string]: unknown;
@@ -10402,7 +11204,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "insufficient_role";
+                                code: "withdrawal_pin";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10413,8 +11215,8 @@ export interface paths {
                         };
                     };
                 };
-                /** @description No connection or operator-internal record with that id is reachable by this caller. */
-                404: {
+                /** @description O estado local impede — mesmas três condições da rota por id. */
+                409: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10422,13 +11224,38 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "not_found";
+                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict";
                                 message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description The revoke threw unexpectedly. */
+                /** @description O mandato recusa, ou o consumidor não tem fonte de recursos para este rail. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_verify" | "mandate_projection_mismatch" | "no_funding_source";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description O teto cumulativo não foi resolvido pelo verificador. Nada é debitado. */
                 500: {
                     headers: {
                         [name: string]: unknown;
@@ -10437,7 +11264,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "revoke_failed";
+                                code: "mandate_cap_unresolved";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10448,8 +11275,8 @@ export interface paths {
                         };
                     };
                 };
-                /** @description The internal phase failed and left nothing changed. Retry. */
-                503: {
+                /** @description O provedor recusou, ou o desfecho é desconhecido. */
+                502: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10457,7 +11284,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "revoke_failed";
+                                code: "psp_dispatch_failed" | "psp_dispatch_uncertain";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10476,56 +11303,77 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/connections/subaccount/{id}/status": {
+    "/v1/consumer-payments/execute-stream": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
+        get?: never;
+        put?: never;
         /**
-         * Read whether a provisioned subaccount can transact yet
-         * @description Read-only, with one live call to the provider. It writes nothing and changes no state.
-         *
-         *     `charges_enabled` is what the provider says right now, not a cached flag, which is why a provider that is unreachable answers 502 rather than a stale `false`. The one exception is a revoked record: it short-circuits to `status: "revoked"` and `charges_enabled: false` without calling the provider at all, since there is nothing left to poll. A confirmed account that never reached an upstream account ref reports not-yet-chargeable for the same reason.
+         * Gastar apresentando o mandato, com os passos em streaming
+         * @description Mesmo corpo e mesmos gates da `/v1/consumer-payments/execute`. A diferença é só o transporte da resposta: os passos do ciclo (verificação do mandato, roteamento da fonte, reserva, débito no provedor, selo do recibo) chegam como eventos `text/event-stream` à medida que acontecem, em vez de um único JSON no fim.
          *
-         *     `capabilities` carries the provider's per-capability activation states when it reports them, and is absent when it does not. An account can be provisioned and still not chargeable; gate any money movement on `charges_enabled`, not on the existence of the connection.
+         *     O desfecho é o mesmo objeto da rota irmã, no último evento. Um cliente que não precisa acompanhar o progresso deve usar a `/execute`: streaming não torna a liquidação mais rápida, só a torna observável enquanto corre.
          *
-         *     Same dual-id resolution and same cross-tenant 404 as the revoke beside it, minus its admin floor: a read does not need one.
+         *     **Não existe rota de leitura do desfecho.** Um `attempt_id` que respondeu `psp_dispatch_uncertain` não tem endpoint para consultar depois. Guarde o `attempt_id` e reapresente-o: o ciclo é idempotente por ele e responde o estado em que aquela tentativa parou, em vez de disparar uma segunda. NÃO reinicie a mesma intenção com um `attempt_id` novo — é assim que se paga duas vezes.
          */
-        get: {
+        post: {
             parameters: {
                 query?: never;
                 header?: never;
-                path: {
-                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
-                    id: string;
-                };
+                path?: never;
                 cookie?: never;
             };
-            requestBody?: never;
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        mandate?: unknown;
+                        signature: string;
+                        amount_minor: number;
+                        purpose: string;
+                        agent_id: string;
+                        payee: string;
+                        attempt_id?: string;
+                        ted?: components["schemas"]["TedDestination"];
+                        quote?: components["schemas"]["SpendQuote"];
+                    };
+                };
+            };
             responses: {
-                /** @description OK */
+                /** @description Fluxo de eventos. Cada evento é um passo do ciclo; o último carrega o mesmo objeto de desfecho que a `/execute` devolve. */
                 200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "text/event-stream": string;
+                    };
+                };
+                /** @description O corpo não casou com o schema. */
+                400: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "provisioned" | "revoked";
-                            charges_enabled: boolean;
-                            /** @description Per-capability activation states as the provider reports them, for example `card_payments: "active"`. */
-                            capabilities?: {
-                                [key: string]: string;
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
-                            /** @description The upstream account identifier. Empty string when the record never reached one. */
-                            account_ref: string;
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description No connection or operator-internal record with that id is reachable by this caller. */
-                404: {
+                /** @description O destino não está na lista de saque assinada. */
+                403: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10533,14 +11381,19 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "not_found";
+                                code: "withdrawal_pin";
                                 message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description The status read threw unexpectedly. */
-                500: {
+                /** @description O mandato recusa, ou não há fonte de recursos para este rail. */
+                422: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10548,7 +11401,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "status_failed";
+                                code: "mandate_verify" | "mandate_projection_mismatch" | "no_funding_source";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10559,7 +11412,7 @@ export interface paths {
                         };
                     };
                 };
-                /** @description The provider read did not produce a status. Usually the live call failed or timed out, and a retry is the right response. TWO OF THE CASES BEHIND THIS CODE ARE NOT TRANSIENT and retrying never clears them: the provider has no subaccount descriptor in this deployment, and no platform account credential is registered for it. Both are configuration defects on our side; `error.message` distinguishes them from a provider outage. */
+                /** @description O provedor recusou, ou o desfecho é desconhecido. */
                 502: {
                     headers: {
                         [name: string]: unknown;
@@ -10568,7 +11421,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "status_failed";
+                                code: "psp_dispatch_failed" | "psp_dispatch_uncertain";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10581,8 +11434,6 @@ export interface paths {
                 };
             };
         };
-        put?: never;
-        post?: never;
         delete?: never;
         options?: never;
         head?: never;
@@ -19685,6 +20536,23 @@ export interface paths {
                         };
                     };
                 };
+                /** @description Unprocessable — the project is in `environment="test"` and this server cannot be exercised there. `reason` is the provider's `test_venue` classification: `none` means the provider runs no test environment at all, so the call would land on production with a real effect (a Z-API WhatsApp message goes to a real number); `unclassified` means nobody has established what it does in test. Answered whether or not `PROXY_REQUIRE_CONNECTION` is set, because it is about the environment and not about a missing connection, and not retryable — the same call from a `live` project reaches the provider (ent#722). */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            /** @enum {string} */
+                            reason: "none" | "unclassified" | "separate_host";
+                            server: string;
+                            /** @description Names the catalog file and the field to declare. */
+                            message: string;
+                        };
+                    };
+                };
                 /** @description Failed Dependency — no usable credential for this server. `reason` is the resolver's own outcome. */
                 424: {
                     headers: {
@@ -21992,6 +22860,76 @@ export interface components {
              */
             engine_status: "none" | "available" | "quarantined";
         };
+        SpendOutcome: {
+            /** @enum {string} */
+            status: "completed";
+            requestId: string;
+            mandate: {
+                consumer_id: string;
+                purpose: string;
+                currency: string;
+            };
+            payment: {
+                transactionId: string;
+                /** @description O endToEndId do Pix quando o rail produz um. Null para rails que não têm, TED incluída. */
+                endToEndId: string | null;
+                amountMinor: number;
+                rail: string;
+                provider: string;
+                /** @description False quando o adaptador é mock ou stub de staging. True quando dinheiro real saiu. */
+                moneyMoved: boolean;
+                adapter: string;
+            };
+            wallet: {
+                walletId: string;
+                holdEntryId: string;
+                fundEntryId: string | null;
+                debitEntryId: string | null;
+            };
+            /** @description O Control Record selado. Null quando não havia segredo do consumidor para assiná-lo. */
+            receipt: {
+                id: string;
+                /** @enum {string} */
+                state: "paid" | "exception" | "delivered";
+                chain: string;
+                exceptions: unknown[];
+            } | null;
+            /** @description Os passos do ciclo, em ordem, com carimbo de tempo e desfecho. */
+            audit: unknown[];
+        };
+        TedDestination: {
+            /** @description ISPB da instituição de destino, só dígitos. */
+            bank: string;
+            /** @description Agência, sem dígito verificador separado. */
+            branch: string;
+            /** @description Conta, incluindo o dígito. */
+            account: string;
+            /** @description CPF ou CNPJ do titular do destino. */
+            tax_id: string;
+            /** @description Nome do titular do destino. */
+            name: string;
+            /**
+             * @description Corrente, investimento, pagamento ou poupança. Enum do produto de TED, DIFERENTE do enum de conta do Pix (CACC|SLRY|SVGS|TRAN) — são endpoints e produtos distintos no provedor.
+             * @enum {string}
+             */
+            account_type?: "CC" | "CI" | "PG" | "PP";
+            /**
+             * @description Pessoa física ou jurídica.
+             * @enum {string}
+             */
+            person_type?: "F" | "J";
+            /** @description Código de finalidade do parceiro bancário. Default `1` (transferência genérica). */
+            client_finality?: string;
+        };
+        /** @description A oferta que o agente aprovou. Quando presente, é assinada dentro do recibo, e no fechamento o preço e o recebedor são comparados com o que de fato liquidou. Divergência é REGISTRADA no recibo; ela não aborta a liquidação. */
+        SpendQuote: {
+            seller: string;
+            resource: string;
+            price_minor: number;
+            payee: string;
+            session_id?: string;
+            at?: string;
+        };
     };
     responses: never;
     parameters: never;