@codespar/sdk 0.12.0 → 0.14.0

package/dist/generated/openapi.d.ts

@@ -427,6 +427,114 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/meta-tools.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The tool catalogue the execute operation dispatches
+         * @description THE LEGAL VALUES OF `tool`, and what each one accepts. `POST /v1/sessions/{id}/execute` names a tool by string; this is the document that gives those strings meaning, one entry per tool with a JSON Schema for its input.
+         *
+         *     Served with no credential, `Access-Control-Allow-Origin: *`, cached for five minutes. It carries no tenant data: names, descriptions and schemas, identical for every caller. `/meta-tools.json` and `/v1/meta-tools.json` return the same bytes.
+         *
+         *     READ IT BEFORE CONCLUDING A CAPABILITY IS MISSING. The tool descriptions and their schemas carry contracts this OpenAPI document does not repeat — which `action` values exist, which arguments are mandatory for which combination, and what a create answers when the instrument is not ready yet. A capability can be fully implemented and still read as absent to someone holding only this document.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Names the source so the reader does not have to take the document's word for it: this is the same output the MCP transport answers `tools/list` with, not a second reading of the catalogue that could drift from it.
+                             * @enum {string}
+                             */
+                            generated_from: "tools/list";
+                            tools: {
+                                /** @description The value to send as `tool` on the execute operation. */
+                                name: string;
+                                description: string;
+                                /** @description JSON Schema for that tool's input, which is what goes in `params`. */
+                                inputSchema: Record<string, never>;
+                            }[];
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/meta-tools.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The tool catalogue, under the /v1 mount
+         * @description Identical to `/meta-tools.json`, for a caller already pointed at the versioned prefix. Same bytes, same absence of a credential.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description Names the source so the reader does not have to take the document's word for it: this is the same output the MCP transport answers `tools/list` with, not a second reading of the catalogue that could drift from it.
+                             * @enum {string}
+                             */
+                            generated_from: "tools/list";
+                            tools: {
+                                /** @description The value to send as `tool` on the execute operation. */
+                                name: string;
+                                description: string;
+                                /** @description JSON Schema for that tool's input, which is what goes in `params`. */
+                                inputSchema: Record<string, never>;
+                            }[];
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/providers": {
         parameters: {
             query?: never;
@@ -2759,7 +2867,7 @@ export interface paths {
          *
          *     `tool_input` IS NOT THE CALL. It is what the lane that raised the hold recorded, and two things happen to it on the way in. A hold raised on the session execute path carries `{}`, because that path hands the policy engine no tool input at all and the engine stores an empty object when it gets none. A hold raised on the proxy path carries `{ server, method, endpoint, body, params, headers }`, with the `authorization` and `cookie` request headers removed before the row is written. So an empty object here means 'this lane records nothing', not 'the agent sent nothing'.
          *
-         *     `tool_name` HAS NO SINGLE FORMAT, because four lanes write it. The proxy path writes `<server>:<method>:<endpoint>` with the leading slash dropped and the remaining slashes turned into colons (`asaas`, `POST`, `/payments/create` becomes `asaas:post:payments:create`). The session execute path writes the caller's own `tool` string verbatim, which is any non-empty string that caller chose. The over-cap settlement lane writes `codespar_pay`. The operator account-status lane writes `admin:account_status_set`. Match on it only knowing which lane you are reading.
+         *     `tool_name` HAS NO SINGLE FORMAT, because four lanes write it. The proxy path writes `<server>:<method>:<endpoint>` with the leading slash dropped and the remaining slashes turned into colons (`asaas`, `POST`, `/payments/create` becomes `asaas:post:payments:create`). The session execute path writes the caller's own `tool` string verbatim, which is any non-empty string that caller chose. The over-cap settlement lane writes `codespar_pay`. The operator account-status lane writes `admin:account_status_set` and the operator withdrawal-resolution lane `admin:withdrawal_resolve`. Match on it only knowing which lane you are reading.
          *
          *     `expires_at` is the end of the hold, not a display hint: once it passes, the row stops being decidable and the expiry sweep moves it to `expired`.
          *
@@ -3907,7 +4015,7 @@ export interface paths {
          * Which rate-card lanes are measured and charged for this org
          * @description The public rate card has four lanes, told apart by the direction of the money: MOVIMENTAR (money leaving under a mandate, 10 bps), FATURAR (money being born in the receiver's account, 1%), GOVERNAR (account governance, per governed account) and OPERAR (non-monetary outcomes). A published price is not the same thing as a measured one, and this answer keeps the two apart per lane so a client never shows a figure the platform is not computing.
          *
-         *     `computed` says whether this build measures the lane from the organization's own ledger; `charging` says whether the organization is actually invoiced for it; `latest` is the last computed period and is only ever non-null on a computed lane (its shape is the one `GET /v1/fees/movimentar` returns). Today MOVIMENTAR is the only computed lane. `period` is the current calendar month in Sao Paulo time.
+         *     `computed` says whether this build measures the lane from the organization's own ledger; `charging` says whether the organization is actually invoiced for it; `latest` is the last computed period and is only ever non-null on a computed lane (its shape is the one the lane's own read returns: `GET /v1/fees/movimentar`, `GET /v1/fees/governar`). Today MOVIMENTAR and GOVERNAR are the computed lanes; FATURAR and OPERAR are not measured and always answer `latest: null`. `charging` is each lane's own switch: an organization can be charged for one lane and not the other. `period` is the current calendar month in Sao Paulo time.
          *
          *     Scope: `fees:read`.
          */
@@ -3951,36 +4059,16 @@ export interface paths {
                                 faturar: {
                                     computed: boolean;
                                     charging: boolean;
-                                    latest: {
-                                        period: string;
-                                        consumerCount: number;
-                                        movedMinor: number;
-                                        freeTierAppliedMinor: number;
-                                        billableMinor: number;
-                                        refundCreditMinor: number;
-                                        refundedCount: number;
-                                        feeMinor: number;
-                                        /** @enum {string} */
-                                        rateTier: "self_serve" | "commit_8bps" | "commit_6bps";
-                                        /** Format: date-time */
-                                        computedAt: string;
-                                        invoiced: boolean;
-                                    } | null;
+                                    latest: null;
                                 };
                                 governar: {
                                     computed: boolean;
                                     charging: boolean;
                                     latest: {
                                         period: string;
-                                        consumerCount: number;
-                                        movedMinor: number;
-                                        freeTierAppliedMinor: number;
-                                        billableMinor: number;
-                                        refundCreditMinor: number;
-                                        refundedCount: number;
+                                        governedAccountsCount: number;
+                                        consumerIdsSha256: string;
                                         feeMinor: number;
-                                        /** @enum {string} */
-                                        rateTier: "self_serve" | "commit_8bps" | "commit_6bps";
                                         /** Format: date-time */
                                         computedAt: string;
                                         invoiced: boolean;
@@ -3989,21 +4077,7 @@ export interface paths {
                                 operar: {
                                     computed: boolean;
                                     charging: boolean;
-                                    latest: {
-                                        period: string;
-                                        consumerCount: number;
-                                        movedMinor: number;
-                                        freeTierAppliedMinor: number;
-                                        billableMinor: number;
-                                        refundCreditMinor: number;
-                                        refundedCount: number;
-                                        feeMinor: number;
-                                        /** @enum {string} */
-                                        rateTier: "self_serve" | "commit_8bps" | "commit_6bps";
-                                        /** Format: date-time */
-                                        computedAt: string;
-                                        invoiced: boolean;
-                                    } | null;
+                                    latest: null;
                                 };
                             };
                         };
@@ -4078,6 +4152,61 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/fees/governar": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The org's latest GOVERNAR-lane fee period (rate card v1)
+         * @description What the calling credential's organization owes CodeSpar for the most recently computed calendar month (Sao Paulo time) under the GOVERNAR lane of the public rate card (Account governance): R$4,90 per governed account active in the month. A governed account active in the month is a holder that had a consumer mandate active at some instant of the month AND at least one outcome settled under one of their mandates in the month (a debit in the wallet ledger, or a receipt sealed). A holder with mandates and no settled outcome in the month costs nothing; a holder with three mandates is one account; the population resets every month.
+         *
+         *     This lane prices the ACCOUNT, not the outcome. The same debit that pays 10 bps under MOVIMENTAR is what shows the account was alive in the month; it is not priced twice, because the two lines price two different things.
+         *
+         *     HOW TO READ THE NUMBERS. `governedAccountsCount` is how many holders were counted; `feeMinor` is that count times R$4,90, in centavos; `consumerIdsSha256` is the SHA-256 (hex) of the counted consumer ids sorted and joined by a newline, so a client can verify its own list of accounts against the figure; the ids themselves stay on the platform's row for audit. `invoiced` says whether the period has been invoiced; a period is invoiced at most once.
+         *
+         *     `null` (200) when no period has been computed for the organization yet. The period is computed by the platform, not on this read; `computedAt` says when.
+         *
+         *     Scope: `fees:read`.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            period: string;
+                            governedAccountsCount: number;
+                            consumerIdsSha256: string;
+                            feeMinor: number;
+                            /** Format: date-time */
+                            computedAt: string;
+                            invoiced: boolean;
+                        } | null;
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/cart/meli/connect/start": {
         parameters: {
             query?: never;
@@ -4502,9 +4631,10 @@ export interface paths {
         };
         /**
          * Read the credential form a provider needs, without reading any credential
+         * @deprecated
          * @description What to ask an operator for before connecting this provider, and where the request will go once connected. It NEVER returns a stored secret: the vault is write-only from this side, and `fields` describes inputs to collect, not values that exist.
          *
-         *     AN EMPTY `fields` DOES NOT MEAN NOTHING TO DO, and four auth types produce one. `oauth` collects nothing here because the browser leg starts at `POST /v1/connections/start` instead. `none` needs no credential. And `jwt_ecdsa` and `cdp` reach no field-building branch at all, so they come back empty while still needing operator-issued material: read that pair as unsupported by this form rather than as ready to connect. The other five all return at least one field, `cert` included.
+         *     AN EMPTY `fields` DOES NOT MEAN NOTHING TO DO, and four of the auth types produce one. `oauth` collects nothing here because the browser leg starts at `POST /v1/connections/start` instead. `none` needs no credential. And `jwt_ecdsa` and `cdp` reach no field-building branch at all, so they come back empty while still needing operator-issued material: read that pair as unsupported by this form rather than as ready to connect. The rest all return at least one field, `cert` included.
          *
          *     `base_url` IS ENVIRONMENT-RESOLVED against the credential in hand: a test key sees the provider's test host when the catalog declares one, and the live host otherwise. It is the empty string when the provider has no endpoint row, which is a catalog gap rather than a value to dial.
          *
@@ -4664,6 +4794,7 @@ export interface paths {
         put?: never;
         /**
          * Ask the provider whether this project's stored credential still works
+         * @deprecated
          * @description Issues ONE safe read against the provider using the credential this project has stored for it, and reports what came back. POST because it leaves the process and spends a provider call, not because it changes anything here: no state of yours is altered by it. It takes NO REQUEST BODY, and anything sent is ignored.
          *
          *     WHICH READ depends on the provider. A handful ship a bespoke recipe, and those are the ones that can return an `account` summary. Everything else re-runs the provider's declared functional probe, the same authenticated read used to confirm a sandbox works when it is first set up; that path returns no `account`. A provider with neither answers 501.
@@ -4778,6 +4909,24 @@ export interface paths {
                         };
                     };
                 };
+                /** @description `test_venue_unavailable`. The project is in `environment="test"` and this provider cannot be exercised there: its catalog entry classifies `test_venue` as `none` (the provider runs no test environment, so a call would land on production with a real effect) or `unclassified` (nobody has established what it does in test). Not a verdict on the credential and not retryable — the identical request from a `live` project reaches the provider (ent#722). */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {boolean} */
+                            ok: false;
+                            /** @description The provider id from the path. */
+                            provider: string;
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            /** @description A CodeSpar-authored sentence naming the catalog file and the field to declare. Never provider text — no round trip was made. */
+                            detail: string;
+                        };
+                    };
+                };
                 /** @description `not_connected`. There is nothing to verify: either no active connection exists for this project and provider, or one exists and its stored credential did not resolve to a value. Connect the provider, or reconnect it. */
                 424: {
                     headers: {
@@ -5967,8 +6116,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6000,8 +6149,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6028,8 +6177,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6056,8 +6205,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6084,8 +6233,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6112,8 +6261,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6140,8 +6289,8 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing";
-                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. */
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
                             status?: number;
@@ -6875,6 +7024,23 @@ export interface paths {
                         };
                     };
                 };
+                /** @description The project is in `environment="test"` and this provider has no test venue, so the flow is refused BEFORE a state token is minted — a refused start leaves no half-begun link behind. Sending a test project to the provider's LIVE consent screen would have it authorise a real account and vault a real token under a project that is not supposed to hold one (ent#722). Not retryable; the same call from a `live` project succeeds. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            server_id: string;
+                            /** @enum {string} */
+                            environment: "live" | "test";
+                            /** @description Names the catalog file and the field to declare. */
+                            detail: string;
+                        };
+                    };
+                };
                 /** @description The platform's OAuth client credential is not seeded for this provider. A configuration defect on our side. */
                 500: {
                     headers: {
@@ -7968,6 +8134,7 @@ export interface paths {
         };
         /**
          * Browse the audit chain (alias path)
+         * @deprecated
          * @description A read-only page of the caller's own tamper-evident chain, newest first.
          *
          *     THIS IS AN ALIAS OF `GET /v1/audit-events`, NOT A SECOND RESOURCE. One handler serves both paths, so the query, the body and every refusal are identical and there is nothing to choose between them. It is described separately only because a generated client sees two operations; pick one spelling and stay on it. Note that the OTHER audit operations — the chain's health report, its incidents, its configuration — have no twin under this prefix and live only under `/v1/audit-events`.
@@ -8525,8 +8692,12 @@ export interface paths {
                                 counterparty_id: string;
                                 /** @enum {string} */
                                 kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                                /** @description Minor units. Stored as a 64 bit integer and rendered as a JSON number. Null unless `currency` is also set. */
+                                /** @description Minor units (cents). The row is STORED in the currency's native unit, BRL centavos and USDC 10^-6 (ent#1203), and rendered here in cents rounded away from zero, so a USDC row of 0.001 reads as 1 and never as 0. `amount_native` carries the exact figure. Null unless `currency` is also set. */
                                 amount_minor: number | null;
+                                /** @description The stored figure, exact, in the currency's NATIVE unit as a decimal string: BRL centavos, USDC 10^-6. This is the unit the wallet ledger holds, so it joins to `wallet_ledger.amount_minor` without conversion. Null when `amount_minor` is. */
+                                amount_native: string | null;
+                                /** @description The same figure in major units as a decimal string (`"0.001"`, `"19.99"`), for display. */
+                                amount: string | null;
                                 currency: string | null;
                                 /** Format: date-time */
                                 occurred_at: string;
@@ -8590,7 +8761,7 @@ export interface paths {
                         counterparty_id: string;
                         /** @enum {string} */
                         kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                        /** @description Minor units. Set it together with `currency` or omit both. */
+                        /** @description Minor units (cents). Stored in the currency's native unit (USDC x10^4, BRL as is), so this field cannot carry a sub-cent USDC figure. Set it together with `currency` or omit both. */
                         amount_minor?: number;
                         currency?: string;
                         /**
@@ -8628,8 +8799,12 @@ export interface paths {
                                 counterparty_id: string;
                                 /** @enum {string} */
                                 kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                                /** @description Minor units. Stored as a 64 bit integer and rendered as a JSON number. Null unless `currency` is also set. */
+                                /** @description Minor units (cents). The row is STORED in the currency's native unit, BRL centavos and USDC 10^-6 (ent#1203), and rendered here in cents rounded away from zero, so a USDC row of 0.001 reads as 1 and never as 0. `amount_native` carries the exact figure. Null unless `currency` is also set. */
                                 amount_minor: number | null;
+                                /** @description The stored figure, exact, in the currency's NATIVE unit as a decimal string: BRL centavos, USDC 10^-6. This is the unit the wallet ledger holds, so it joins to `wallet_ledger.amount_minor` without conversion. Null when `amount_minor` is. */
+                                amount_native: string | null;
+                                /** @description The same figure in major units as a decimal string (`"0.001"`, `"19.99"`), for display. */
+                                amount: string | null;
                                 currency: string | null;
                                 /** Format: date-time */
                                 occurred_at: string;
@@ -8657,8 +8832,12 @@ export interface paths {
                             counterparty_id: string;
                             /** @enum {string} */
                             kind: "quote" | "negotiation" | "order" | "invoice" | "payment" | "shipment" | "message" | "other";
-                            /** @description Minor units. Stored as a 64 bit integer and rendered as a JSON number. Null unless `currency` is also set. */
+                            /** @description Minor units (cents). The row is STORED in the currency's native unit, BRL centavos and USDC 10^-6 (ent#1203), and rendered here in cents rounded away from zero, so a USDC row of 0.001 reads as 1 and never as 0. `amount_native` carries the exact figure. Null unless `currency` is also set. */
                             amount_minor: number | null;
+                            /** @description The stored figure, exact, in the currency's NATIVE unit as a decimal string: BRL centavos, USDC 10^-6. This is the unit the wallet ledger holds, so it joins to `wallet_ledger.amount_minor` without conversion. Null when `amount_minor` is. */
+                            amount_native: string | null;
+                            /** @description The same figure in major units as a decimal string (`"0.001"`, `"19.99"`), for display. */
+                            amount: string | null;
                             currency: string | null;
                             /** Format: date-time */
                             occurred_at: string;
@@ -9223,7 +9402,7 @@ export interface paths {
                                 interaction_count: number;
                                 /** @description Of those, the ones with `kind: payment`. */
                                 payment_count: number;
-                                /** @description Sum of `amount_minor` over the window's PAYMENT interactions only, ACROSS CURRENCIES. Read `currencies` before reading this as an amount. */
+                                /** @description Sum over the window's PAYMENT interactions only, ACROSS CURRENCIES, in cents: each row is converted from its currency's native unit before the sum and the total is rounded up once. Read `currencies` before reading this as an amount. */
                                 total_payment_minor: number;
                                 /** @description Distinct non null currencies over the window's interactions of EVERY kind, not only the payments the total is built from. It is therefore an UPPER BOUND on the currencies inside `total_payment_minor` and never a smaller set: an invoice priced in USD puts USD here while the total stays pure BRL. One entry (or none) does bound the total to a single currency; two or more do not prove it mixes. */
                                 currencies: string[];
@@ -9411,7 +9590,7 @@ export interface paths {
                                 /** @enum {string} */
                                 kind: "supplier" | "customer" | "agent_peer";
                                 payment_count: number;
-                                /** @description Sum of `amount_minor` over the window's payment interactions, ACROSS CURRENCIES. */
+                                /** @description Sum over the window's payment interactions, ACROSS CURRENCIES, in cents: each row converted from its currency's native unit before the sum, the total rounded up once. */
                                 total_payment_minor: number;
                                 /** @description The most frequent currency over ALL of this counterparty's payment interactions, ignoring `since` and `until`, so it can name a currency the window itself never saw. */
                                 dominant_currency: string | null;
@@ -10210,6 +10389,23 @@ export interface paths {
                         };
                     };
                 };
+                /** @description The project is in `environment="test"` and this provider has no test venue, so the flow is refused BEFORE a state token is minted — a refused start leaves no half-begun link behind. Sending a test project to the provider's LIVE consent screen would have it authorise a real account and vault a real token under a project that is not supposed to hold one (ent#722). Not retryable; the same call from a `live` project succeeds. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            server_id: string;
+                            /** @enum {string} */
+                            environment: "live" | "test";
+                            /** @description Names the catalog file and the field to declare. */
+                            detail: string;
+                        };
+                    };
+                };
                 /** @description The platform's OAuth client credential is not seeded for this provider. A configuration defect on our side. */
                 500: {
                     headers: {
@@ -10225,39 +10421,1269 @@ export interface paths {
                 };
             };
         };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/connections/engine/{run_id}/status": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/engine/{run_id}/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Poll a browser-driven signup run
+         * @description Read-only. The run resolves only inside the calling credential's org and project, so a run id from another tenant is 404 rather than 403.
+         *
+         *     Poll this while `status` is `running`. When it becomes `needs_verification` the customer has to clear the provider's email gate, and `verification.mechanism` says how: `code` means a one-time code to relay, `link` means a link to click in their own inbox. Branch on the mechanism, never on the provider name. A paused run that has expired answers 410 `run_stale` and cannot be resumed.
+         *
+         *     On `provisioned`, `connection_id` names the connection the run produced, which then behaves like any other row on this resource. On `failed`, `code` is drawn from a closed first-party vocabulary and `failed_step_id` names the step, when the run recorded one; a failed run that recorded no reason reports its status alone. The bounded failure detail, the page URL and the screenshot references are deliberately not selected by this query, so they cannot leak from it.
+         *
+         *     The 404 body here is `{ error: { code, message } }` with no `request_id`, unlike the 410 beside it.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    run_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "running" | "needs_verification" | "provisioned" | "failed";
+                            /** @description Present while the run waits on the customer. Fallback copy when the modal has none of its own. */
+                            prompt?: string;
+                            /** @description Resolved from the provider's public descriptor. Present only while `status` is `needs_verification`. */
+                            verification?: {
+                                /**
+                                 * @description `code` means the provider mailed a one-time code to type; `link` means it mailed an activation link to click.
+                                 * @enum {string}
+                                 */
+                                mechanism: "code" | "link";
+                                resend?: boolean;
+                            };
+                            /** @description Result of the post-provision reachability probe, when one ran. */
+                            probe_result?: unknown;
+                            /** @description The `ca_` id of the connection the run produced. Present once the run reaches `provisioned`. */
+                            connection_id?: string;
+                            /**
+                             * @description Why the run failed. A stored value outside this vocabulary is reported as absent rather than passed through, so a failed run can render as its status alone.
+                             * @enum {string}
+                             */
+                            code?: "flow_failed" | "capacity" | "no_credential_captured" | "probe_failed" | "drive_deadline_exceeded" | "provider_account_not_registered" | "drive_stalled" | "resume_inputs_unavailable";
+                            failed_step_id?: string;
+                        };
+                    };
+                };
+                /** @description No run with that id inside the caller's org and project. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description The paused run expired before it was resumed. */
+                410: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "run_stale";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/subaccount/{id}/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Revoke a provisioned subaccount and try to delete it upstream
+         * @description The revoke for accounts this platform minted on the customer's behalf. It is not `POST /v1/connections/{id}/revoke`: the generic purge targets the ref keyed on the server id, which is the wrong ref for a per-account subaccount credential, and it touches neither the provisioning record nor the account at the provider.
+         *
+         *     Local teardown first, atomically: the connection projection flips, the provisioning record flips, and the correct per-account vault ref is purged. A failure in that phase changes nothing and answers 503, so a retry is safe. Only then is a delete attempted at the provider.
+         *
+         *     READ `upstream` BEFORE TREATING THIS AS FINISHED. `deleted` means the account is gone at the provider. `not_applicable` means the lane has no delete to make. `delete_failed` and `orphaned` mean the credential is destroyed on our side but an account may still exist upstream, and closing it is a manual step. All four come back with 200, because the local teardown did succeed.
+         *
+         *     `{id}` is a connection id for the customer path, matched only inside the caller's own org and project. It is a provisioning record id for the operator-internal path, which additionally requires service auth. A customer credential can never reach an operator-internal record: it misses the connection lookup and gets 404, never a 403 that would confirm the id exists. A repeated revoke returns `already: true` and changes nothing.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "revoked";
+                            record_id: string;
+                            /** @description The connection projection's id, or the provisioning record's id when there is no projection. */
+                            connection_id: string;
+                            /**
+                             * @description What happened at the provider. `delete_failed` and `orphaned` mean an account may still exist there; the local credential is gone either way.
+                             * @enum {string}
+                             */
+                            upstream: "deleted" | "delete_failed" | "not_applicable" | "orphaned";
+                            /**
+                             * @description Present when the subaccount was already revoked. Nothing changed.
+                             * @enum {boolean}
+                             */
+                            already?: true;
+                        };
+                    };
+                };
+                /** @description This is a write, so it carries a role floor: a service-auth caller must send `x-codespar-user` and hold admin or above. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "insufficient_role";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description No connection or operator-internal record with that id is reachable by this caller. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description The revoke threw unexpectedly. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "revoke_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The internal phase failed and left nothing changed. Retry. */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "revoke_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/subaccount/{id}/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read whether a provisioned subaccount can transact yet
+         * @description Read-only, with one live call to the provider. It writes nothing and changes no state.
+         *
+         *     `charges_enabled` is what the provider says right now, not a cached flag, which is why a provider that is unreachable answers 502 rather than a stale `false`. The one exception is a revoked record: it short-circuits to `status: "revoked"` and `charges_enabled: false` without calling the provider at all, since there is nothing left to poll. A confirmed account that never reached an upstream account ref reports not-yet-chargeable for the same reason.
+         *
+         *     `capabilities` carries the provider's per-capability activation states when it reports them, and is absent when it does not. An account can be provisioned and still not chargeable; gate any money movement on `charges_enabled`, not on the existence of the connection.
+         *
+         *     Same dual-id resolution and same cross-tenant 404 as the revoke beside it, minus its admin floor: a read does not need one.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            status: "provisioned" | "revoked";
+                            charges_enabled: boolean;
+                            /** @description Per-capability activation states as the provider reports them, for example `card_payments: "active"`. */
+                            capabilities?: {
+                                [key: string]: string;
+                            };
+                            /** @description The upstream account identifier. Empty string when the record never reached one. */
+                            account_ref: string;
+                        };
+                    };
+                };
+                /** @description No connection or operator-internal record with that id is reachable by this caller. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                            };
+                        };
+                    };
+                };
+                /** @description The status read threw unexpectedly. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "status_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The provider read did not produce a status. Usually the live call failed or timed out, and a retry is the right response. TWO OF THE CASES BEHIND THIS CODE ARE NOT TRANSIENT and retrying never clears them: the provider has no subaccount descriptor in this deployment, and no platform account credential is registered for it. Both are configuration defects on our side; `error.message` distinguishes them from a provider outage. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "status_failed";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consents": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a hosted consent
+         * @description Starts a hosted consent for a consumer mandate. The partner's backend calls this with its API key and gets a one-shot token carrying the intent the consumer is about to authorize (purpose, total and per-transaction caps, currency, mandate TTL and the merchant, withdrawal and DDA allowlists that will be signed into the mandate). The partner composes the URL of the hosted consent page from the token and hands it to the consumer.
+         *
+         *     The consumer signs on the hosted page. The mandate is created server-side when the consumer submits there: the consumer's secret is provisioned, the mandate is signed with it, the funding source and the consent record are written and the token is consumed, in one transaction. The API key never signs, and the page's own calls are not operations of this document: nothing a partner can call with a key produces a signed mandate.
+         *
+         *     `intent.merchant_allowlist` defaults to `["*"]`, an explicit wildcard bounded by the caps, purpose and expiry; pass concrete Pix keys to narrow it. `intent.withdrawal_allowlist` and `intent.dda_allowlist` are deliberately NOT defaulted: absent means the mandate authorizes no cash-out and no DDA registration, which is a different thing from a wildcard, and `"*"` is refused in both. `callback_url`, when given, is returned to the hosted page at submit time so the partner's backend can receive the signed mandate.
+         *
+         *     The token is stamped with the credential's project, and that stamp is what scopes the funding source the consumer's submission later creates.
+         *
+         *     Requires the `consents:write` scope.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        agent_id: string;
+                        /** Format: email */
+                        consumer_email_hint?: string;
+                        intent: {
+                            purpose: string;
+                            cap_minor: number;
+                            per_tx_cap_minor: number;
+                            /** @enum {string} */
+                            currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                            mandate_ttl_seconds: number;
+                            /**
+                             * @default [
+                             *       "*"
+                             *     ]
+                             */
+                            merchant_allowlist?: string[];
+                            /**
+                             * @default pix-key
+                             * @enum {string}
+                             */
+                            merchant_pin_kind?: "pix-key" | "merchant-id" | "mcc";
+                            withdrawal_allowlist?: string[];
+                            dda_allowlist?: string[];
+                            slots?: {
+                                /** @enum {string} */
+                                currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                                rail: string;
+                                cap_minor: number;
+                                per_tx_cap_minor: number;
+                            }[];
+                            display_name?: string;
+                            intent_note?: string;
+                            shipping?: {
+                                [key: string]: unknown;
+                            };
+                        };
+                        /** Format: uri */
+                        callback_url?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Created. The consent is pending until the consumer signs on the hosted page or the token expires. */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description One-shot, `ctk_`-prefixed, unguessable. Put it in the URL of the hosted consent page and hand that URL to the consumer. It is consumed by the consumer's submission and cannot be replayed. */
+                            token: string;
+                            /** @description ISO 8601. The token expires 24 hours after this call; a consumer opening the link after that sees an expired consent and nothing is created. This is the TOKEN's TTL, not the mandate's: the mandate's own TTL is `intent.mandate_ttl_seconds`, counted from the moment the consumer signs. */
+                            expires_at: string;
+                        };
+                    };
+                };
+                /** @description The body did not match the schema. `details.issues` carries the Zod issues; the refusals with their own message are a `"*"` entry in `intent.withdrawal_allowlist` and a `intent.dda_allowlist` entry that is not a CPF (11 digits) or a CNPJ (14 digits). */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consents/init": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start a hosted consent
+         * @deprecated
+         * @description DEPRECATED alias of `POST /v1/consents` (ent#979), kept for two releases. Same handler, same required scope, same request and same responses; switch the path and nothing else changes. The canonical path is described in this document too.
+         *
+         *     Starts a hosted consent for a consumer mandate. The partner's backend calls this with its API key and gets a one-shot token carrying the intent the consumer is about to authorize (purpose, total and per-transaction caps, currency, mandate TTL and the merchant, withdrawal and DDA allowlists that will be signed into the mandate). The partner composes the URL of the hosted consent page from the token and hands it to the consumer.
+         *
+         *     The consumer signs on the hosted page. The mandate is created server-side when the consumer submits there: the consumer's secret is provisioned, the mandate is signed with it, the funding source and the consent record are written and the token is consumed, in one transaction. The API key never signs, and the page's own calls are not operations of this document: nothing a partner can call with a key produces a signed mandate.
+         *
+         *     `intent.merchant_allowlist` defaults to `["*"]`, an explicit wildcard bounded by the caps, purpose and expiry; pass concrete Pix keys to narrow it. `intent.withdrawal_allowlist` and `intent.dda_allowlist` are deliberately NOT defaulted: absent means the mandate authorizes no cash-out and no DDA registration, which is a different thing from a wildcard, and `"*"` is refused in both. `callback_url`, when given, is returned to the hosted page at submit time so the partner's backend can receive the signed mandate.
+         *
+         *     The token is stamped with the credential's project, and that stamp is what scopes the funding source the consumer's submission later creates.
+         *
+         *     Requires the `consents:write` scope.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        agent_id: string;
+                        /** Format: email */
+                        consumer_email_hint?: string;
+                        intent: {
+                            purpose: string;
+                            cap_minor: number;
+                            per_tx_cap_minor: number;
+                            /** @enum {string} */
+                            currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                            mandate_ttl_seconds: number;
+                            /**
+                             * @default [
+                             *       "*"
+                             *     ]
+                             */
+                            merchant_allowlist?: string[];
+                            /**
+                             * @default pix-key
+                             * @enum {string}
+                             */
+                            merchant_pin_kind?: "pix-key" | "merchant-id" | "mcc";
+                            withdrawal_allowlist?: string[];
+                            dda_allowlist?: string[];
+                            slots?: {
+                                /** @enum {string} */
+                                currency: "BRL" | "USD" | "MXN" | "COP" | "ARS" | "USDC" | "BRLA";
+                                rail: string;
+                                cap_minor: number;
+                                per_tx_cap_minor: number;
+                            }[];
+                            display_name?: string;
+                            intent_note?: string;
+                            shipping?: {
+                                [key: string]: unknown;
+                            };
+                        };
+                        /** Format: uri */
+                        callback_url?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Created. The consent is pending until the consumer signs on the hosted page or the token expires. */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description One-shot, `ctk_`-prefixed, unguessable. Put it in the URL of the hosted consent page and hand that URL to the consumer. It is consumed by the consumer's submission and cannot be replayed. */
+                            token: string;
+                            /** @description ISO 8601. The token expires 24 hours after this call; a consumer opening the link after that sees an expired consent and nothing is created. This is the TOKEN's TTL, not the mandate's: the mandate's own TTL is `intent.mandate_ttl_seconds`, counted from the moment the consumer signs. */
+                            expires_at: string;
+                        };
+                    };
+                };
+                /** @description The body did not match the schema. `details.issues` carries the Zod issues; the refusals with their own message are a `"*"` entry in `intent.withdrawal_allowlist` and a `intent.dda_allowlist` entry that is not a CPF (11 digits) or a CNPJ (14 digits). */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consumers/mandates/{id}/spend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Spend under a mandate already projected here
+         * @description Moves money out under a mandate already projected into this organization, addressed by id. This is the path the `codespar_pay` meta-tool takes internally, so the behaviour here is the behaviour an agent gets; the route exists so a caller who does not use the SDK reaches the same place.
+         *
+         *     With `ted` present the provider leg is a real bank transfer, debited from the consumer's own sub-account. Without `ted`, `payee` is a Pix key or a copy-and-paste string.
+         *
+         *     **TED carries three requirements the other payment methods do not, and all three bind BEFORE any money step:**
+         *
+         *     1. `attempt_id` is MANDATORY. A TED has no copy-and-paste string and no nonce to derive correlation from, and two TEDs under the same mandate must never collide on a derived id.
+         *     2. `payee` must EQUAL the destination's canonical string, `ted:<ispb>:<branch>:<account>`, alphanumerics only and upper-cased. The comparison normalizes whitespace and nothing else, so an entry carrying a dot or a hyphen does NOT match. The rule is what makes the signed-allowlist pin and the wire name the SAME destination: without it, an approved payee fronts for a different bank account.
+         *     3. The destination must be NAMED in a signed list of the mandate, and a merchant-list wildcard `"*"` NEVER authorizes money out. Which list is accepted is mid-rollout, so read this one carefully: the target rule is `withdrawal_allowlist` alone, and while the rollout flag is off a destination named explicitly in the signed `merchant_allowlist` is ALSO accepted, with the stricter rule's refusal recorded rather than applied. Tolerance never widens what passes: a wildcard is refused on both paths, and a destination in neither list is refused with its own code. Build against `withdrawal_allowlist`: it is the list that keeps working when the flag turns on.
+         *
+         *     The cumulative cap is checked and CONSUMED under an advisory lock, and the wallet hold is taken inside that same lock. The lock is released before the provider call, so a slow provider does not serialize everyone else.
+         *
+         *     **There is no read route for the outcome.** An `attempt_id` that answered `psp_dispatch_uncertain` has no endpoint to ask about afterwards. Keep the `attempt_id` and present it again: the lifecycle is idempotent on it and answers the state that attempt stopped in, instead of firing a second one. Do NOT restart the same intent under a fresh `attempt_id`. That is how a payment gets made twice.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    /** @description The mandate's id. */
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description Amount in minor units. */
+                        amount_minor: number;
+                        /** @description A Pix key, a copy-and-paste string, or, for TED, the destination's canonical string. The 1024 limit is there to fit a copy-and-paste string. */
+                        payee: string;
+                        agent_id?: string;
+                        /** @description Mandatory when `ted` is present. Present the same one again on every retry. */
+                        attempt_id?: string;
+                        ted?: components["schemas"]["TedDestination"];
+                        quote?: components["schemas"]["SpendQuote"];
+                    };
+                };
+            };
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SpendOutcome"];
+                    };
+                };
+                /** @description The body did not match the schema. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The destination is not on the mandate's signed withdrawal allowlist. Nothing was sent to the provider. The response carries the next consent step. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "withdrawal_pin";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description No mandate with that id exists in this organization. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_not_found";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description Local state refuses. `psp_attempt_in_flight`: the same attempt is already in flight. `psp_attempt_uncertain`: an earlier attempt ended with an unknown outcome and this intent is PINNED to it, so present the same `attempt_id` again, never a new one. `psp_attempt_conflict`: the earlier attempt was already compensated. */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The mandate refuses. `mandate_verify`: signature, agent, purpose or payee do not check out. `mandate_projection_mismatch`: the signature presented differs from the stored one, or the mandate is not active. `no_funding_source`: the consumer has no funding source that serves this rail; TED requires a registered bank account. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_verify" | "mandate_projection_mismatch" | "no_funding_source";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The verifier answered without resolving the cumulative cap, so the re-check under the lock would have no limit to compare against. A deliberate refusal: nothing is debited. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_cap_unresolved";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The provider refused or did not answer. `psp_dispatch_failed`: a known refusal, nothing left. `psp_dispatch_uncertain`: it is NOT known whether anything left, so the hold stands and the attempt stays pinned. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_dispatch_failed" | "psp_dispatch_uncertain";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consumer-payments/execute": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Spend by presenting the signed mandate
+         * @description The same lifecycle as the by-id route, for a caller who carries the signed envelope instead of a mandate already projected here. Use this one when the mandate arrives from the consumer at call time; use `/consumers/mandates/{id}/spend` when it is already registered here.
+         *
+         *     `signature` is the 64-character hexadecimal HMAC over the canonical mandate. The body's `agent_id` is checked against the SIGNED one: attribution of the spend belongs to the mandate, not to the caller.
+         *
+         *     **TED carries three requirements the other payment methods do not, and all three bind BEFORE any money step:**
+         *
+         *     1. `attempt_id` is MANDATORY. A TED has no copy-and-paste string and no nonce to derive correlation from, and two TEDs under the same mandate must never collide on a derived id.
+         *     2. `payee` must EQUAL the destination's canonical string, `ted:<ispb>:<branch>:<account>`, alphanumerics only and upper-cased. The comparison normalizes whitespace and nothing else, so an entry carrying a dot or a hyphen does NOT match. The rule is what makes the signed-allowlist pin and the wire name the SAME destination: without it, an approved payee fronts for a different bank account.
+         *     3. The destination must be NAMED in a signed list of the mandate, and a merchant-list wildcard `"*"` NEVER authorizes money out. Which list is accepted is mid-rollout, so read this one carefully: the target rule is `withdrawal_allowlist` alone, and while the rollout flag is off a destination named explicitly in the signed `merchant_allowlist` is ALSO accepted, with the stricter rule's refusal recorded rather than applied. Tolerance never widens what passes: a wildcard is refused on both paths, and a destination in neither list is refused with its own code. Build against `withdrawal_allowlist`: it is the list that keeps working when the flag turns on.
+         *
+         *     **There is no read route for the outcome.** An `attempt_id` that answered `psp_dispatch_uncertain` has no endpoint to ask about afterwards. Keep the `attempt_id` and present it again: the lifecycle is idempotent on it and answers the state that attempt stopped in, instead of firing a second one. Do NOT restart the same intent under a fresh `attempt_id`. That is how a payment gets made twice.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description The canonical mandate, in the form it was signed in. */
+                        mandate?: unknown;
+                        /** @description HMAC in hexadecimal, 64 characters. */
+                        signature: string;
+                        amount_minor: number;
+                        purpose: string;
+                        agent_id: string;
+                        payee: string;
+                        attempt_id?: string;
+                        ted?: components["schemas"]["TedDestination"];
+                        quote?: components["schemas"]["SpendQuote"];
+                    };
+                };
+            };
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["SpendOutcome"];
+                    };
+                };
+                /** @description The body did not match the schema. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The destination is not on the signed withdrawal allowlist. Nothing was sent to the provider. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "withdrawal_pin";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description Local state refuses, on the same three conditions as the by-id route. */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The mandate refuses, or the consumer has no funding source for this rail. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_verify" | "mandate_projection_mismatch" | "no_funding_source";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The cumulative cap was not resolved by the verifier. Nothing is debited. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_cap_unresolved";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The provider refused, or the outcome is unknown. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_dispatch_failed" | "psp_dispatch_uncertain";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/consumer-payments/execute-stream": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Spend by presenting the mandate, with the steps streamed
+         * @description Same body and same gates as `/v1/consumer-payments/execute`. Only the response transport differs: the lifecycle steps (mandate verification, funding-source routing, hold, provider debit, receipt seal) arrive as `text/event-stream` events as they happen, instead of one JSON at the end.
+         *
+         *     The outcome is the same object the sibling route returns, carried on the last event. A client that does not need to follow progress should use `/execute`: streaming does not make settlement faster, it makes it observable while it runs.
+         *
+         *     **There is no read route for the outcome.** An `attempt_id` that answered `psp_dispatch_uncertain` has no endpoint to ask about afterwards. Keep the `attempt_id` and present it again: the lifecycle is idempotent on it and answers the state that attempt stopped in, instead of firing a second one. Do NOT restart the same intent under a fresh `attempt_id`. That is how a payment gets made twice.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        mandate?: unknown;
+                        signature: string;
+                        amount_minor: number;
+                        purpose: string;
+                        agent_id: string;
+                        payee: string;
+                        attempt_id?: string;
+                        ted?: components["schemas"]["TedDestination"];
+                        quote?: components["schemas"]["SpendQuote"];
+                    };
+                };
+            };
+            responses: {
+                /** @description An event stream. Each event is one lifecycle step; the last one carries the same outcome object `/execute` returns. */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "text/event-stream": string;
+                    };
+                };
+                /** @description The body did not match the schema. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The destination is not on the signed withdrawal allowlist. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "withdrawal_pin";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The mandate refuses, or there is no funding source for this rail. */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "mandate_verify" | "mandate_projection_mismatch" | "no_funding_source";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The provider refused, or the outcome is unknown. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "psp_dispatch_failed" | "psp_dispatch_uncertain";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/charges": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List charges
+         * @description The charges this project issued, newest first. Page with `limit` (1 to 200, default 50) and `cursor`, which is the `created_at` of the last row you saw; `next_cursor` comes back null when the page is the last one.
+         *
+         *     **The `settlement` here is the LAST KNOWN, and the one on the by-id read is the one from now.** The by-id read calls the issuer and compares; a list cannot do that per row, because 200 rows would be 200 provider calls and paging would become a flood. So every item carries `settlement_as_of`: when we last knew the issuer's state for that charge, or null if we never did.
+         *
+         *     The same charge can therefore answer a different `settlement` here and there. That is the age of the data, not a defect, which is why the freshness field is required rather than optional. A charge we never read carries `settlement_as_of: null` and can never be `unconfirmable` on this list, because there is nothing to conflict with.
+         *
+         *     `settlement=none` selects the charge with no settlement to report: nobody paid it, so there is no pending settlement, only an open receivable. It is not the same as omitting the filter.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    /** @description Our own row status: `pending`, `settled`, `expired`. */
+                    status?: string;
+                    /** @description Filters on the same three facts the field is derived from, in SQL. */
+                    settlement?: "confirmed" | "pending" | "unconfirmable" | "none";
+                    limit?: string;
+                    cursor?: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            data: {
+                                id: string | null;
+                                status: string;
+                                local_status: string;
+                                status_conflict: boolean;
+                                currency: string;
+                                amount_minor: number;
+                                due_date: string | null;
+                                created_at: string;
+                                /** @enum {string|null} */
+                                settlement: "confirmed" | "pending" | "unconfirmable" | null;
+                                /** @description When we last knew the issuer's state. Null means we never did. */
+                                settlement_as_of: string | null;
+                            }[];
+                            next_cursor: string | null;
+                        };
+                    };
+                };
+                /** @description The query is malformed, or the credential names no project. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "project_scope_missing" | "invalid_settlement_filter" | "invalid_limit";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
         /**
-         * Poll a browser-driven signup run
-         * @description Read-only. The run resolves only inside the calling credential's org and project, so a run id from another tenant is 404 rather than 403.
+         * Issue a charge
+         * @description Issues an inbound charge: the buyer pays the merchant. The RAIL IS A FIELD, not a path. `method: "pix"` mints an immediate Pix that hands back its copy-and-paste string right away and expires in about an hour. `method: "boleto"` WITH a `due_date` issues a cobrança com vencimento: ONE receivable the payer settles either as a boleto (barcode and linha digitável) or by Pix. One debt, two payable legs, never two documents.
          *
-         *     Poll this while `status` is `running`. When it becomes `needs_verification` the customer has to clear the provider's email gate, and `verification.mechanism` says how: `code` means a one-time code to relay, `link` means a link to click in their own inbox. Branch on the mechanism, never on the provider name. A paused run that has expired answers 410 `run_stale` and cannot be resumed.
+         *     **The cobrança com vencimento answers `PROCESSING` with `payable: false` and no document.** The instrument registers with the clearing house first. Subscribe to `commerce.charge.created` rather than polling for a barcode that is not late, only not made yet. `commerce.charge.paid` is the event that means the funds arrived, by either leg.
          *
-         *     On `provisioned`, `connection_id` names the connection the run produced, which then behaves like any other row on this resource. On `failed`, `code` is drawn from a closed first-party vocabulary and `failed_step_id` names the step, when the run recorded one; a failed run that recorded no reason reports its status alone. The bounded failure detail, the page URL and the screenshot references are deliberately not selected by this query, so they cannot leak from it.
+         *     **`idempotency_key` is REQUIRED for that combination**, and it is checked before anything reaches the issuer. A repeat with the same key returns the charge already issued, or its still-open reservation, instead of a second receivable the same debtor could pay twice. Send it as the `Idempotency-Key` header, as the body's `idempotency_key`, or as both with the SAME value; two different values are refused rather than one silently winning.
          *
-         *     The 404 body here is `{ error: { code, message } }` with no `request_id`, unlike the 410 beside it.
+         *     An agreement in N instalments is N cobranças, one per parcela, each with its own `due_date` and its own key. There is no single instalment charge.
+         *
+         *     **Each refusal names a `reason`, and the reason is what to branch on.** The two error `code` values (`invalid_args`, `provider_error`) are too coarse: they cover six different situations, and reading them as one would turn `not found` into `bad request`.
+         *
+         *     | reason | status | what it means |
+         *     |---|---|---|
+         *     | `charge_id_missing` | 400 | the call named no charge |
+         *     | `project_scope_missing` | 400 | the credential is not project-scoped, and a charge belongs to one project |
+         *     | `charge_not_found` | 404 | no charge under that id FOR THIS TENANT |
+         *     | `issuance_unconfirmed` | 409 | the key holds a reservation whose create never got an answer |
+         *     | `already_payment_notified` | 409 | the clearing house already notified a payment |
+         *     | `not_cancellable_in_this_state` | 409 | the issuer accepts a cancellation only in some states |
+         *     | `provider_status_unreadable` | 502 | the issuer did not answer the read |
+         *     | `provider_cancel_failed` | 502 | the issuer refused the withdrawal |
+         *
+         *     `charge_not_found` is deliberately the SAME answer for an id that belongs to another project and for an id that exists nowhere. Telling those apart would be an oracle about another tenant over a string anyone can guess.
          */
-        get: {
+        post: {
             parameters: {
                 query?: never;
                 header?: never;
-                path: {
-                    run_id: string;
-                };
+                path?: never;
                 cookie?: never;
             };
-            requestBody?: never;
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description In minor units. */
+                        amount: number;
+                        currency: string;
+                        /** @description `pix`, `boleto`, `card` or `wallet`. */
+                        method: string;
+                        description?: string;
+                        buyer?: {
+                            [key: string]: unknown;
+                        };
+                        /** @description `YYYY-MM-DD`. With `method: "boleto"` this is what makes it a cobrança com vencimento; an immediate Pix has no due date and refuses one. */
+                        due_date?: string;
+                        /** @description Required for a cobrança com vencimento. Stable per debt: it is what makes a retry the SAME charge instead of a second one. */
+                        idempotency_key?: string;
+                        country?: string;
+                        metadata?: {
+                            [key: string]: unknown;
+                        };
+                    };
+                };
+            };
             responses: {
                 /** @description OK */
                 200: {
@@ -10266,34 +11692,45 @@ export interface paths {
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "running" | "needs_verification" | "provisioned" | "failed";
-                            /** @description Present while the run waits on the customer. Fallback copy when the modal has none of its own. */
-                            prompt?: string;
-                            /** @description Resolved from the provider's public descriptor. Present only while `status` is `needs_verification`. */
-                            verification?: {
-                                /**
-                                 * @description `code` means the provider mailed a one-time code to type; `link` means it mailed an activation link to click.
-                                 * @enum {string}
-                                 */
-                                mechanism: "code" | "link";
-                                resend?: boolean;
-                            };
-                            /** @description Result of the post-provision reachability probe, when one ran. */
-                            probe_result?: unknown;
-                            /** @description The `ca_` id of the connection the run produced. Present once the run reaches `provisioned`. */
-                            connection_id?: string;
+                            /** @description The issuer's charge id. Null while the issuance is unconfirmed. */
+                            id: string | null;
+                            /** @description The provider's state as far as we know it, normalized. Forced to PROCESSING until the issuance is confirmed. */
+                            status: string;
+                            /** @description What CodeSpar recorded, which is a different question from `status`. */
+                            local_status: string;
+                            /** @description True when the two disagree terminally, instead of one of them silently winning. */
+                            status_conflict: boolean;
+                            method: string;
+                            currency: string;
+                            /** @description In units. */
+                            amount: number;
+                            /** @description In minor units. */
+                            amount_minor: number;
+                            due_date: string | null;
+                            /** @description True only when all four hold: the issuance is confirmed, our row is still open, the provider says PENDING, and at least one document exists. This is the field to branch on, not `status`. */
+                            payable: boolean;
+                            boleto_bar_code: string | null;
+                            boleto_bank_line: string | null;
+                            /** @description The Pix leg of the same debt. One receivable, two payable legs. */
+                            pix_copy_paste: string | null;
+                            /** @description Whether an inbound Pix on this charge's Pix leg can resolve a wallet on its own. False until registration hands us the leg's identifier. */
+                            credit_correlation_armed: boolean;
+                            /** @description True when a payment was notified and the receivable is still open. Read this before you write anything off: the issuer can answer EXPIRED for a boleto it already told us was paid, because the baixa happened before the due date and the credit lands on the next business day. */
+                            payment_in_flight: boolean;
                             /**
-                             * @description Why the run failed. A stored value outside this vocabulary is reported as absent rather than passed through, so a failed run can render as its status alone.
-                             * @enum {string}
+                             * @description The settlement tri-state (decision 10b of the canonical matrix). `confirmed`: the money is in the account. `pending`: the clearing house notified a payment and the credit has not landed, which is the D+1 window. `unconfirmable`: our terminal state disagrees with the issuer's, so settlement cannot be established.
+                             *
+                             *     NULL MEANS NOT APPLICABLE, never `pending`. A charge nobody paid has no pending settlement: it has an open receivable. Reading null as pending would tell you money is on its way.
+                             * @enum {string|null}
                              */
-                            code?: "flow_failed" | "capacity" | "no_credential_captured" | "probe_failed" | "drive_deadline_exceeded" | "provider_account_not_registered" | "drive_stalled" | "resume_inputs_unavailable";
-                            failed_step_id?: string;
+                            settlement: "confirmed" | "pending" | "unconfirmable" | null;
+                            /** @description True while the row is a reservation with no charge id: the issuer's answer to the create was lost, or a create is in flight elsewhere under the same key. Nothing is payable and nothing was duplicated. */
+                            issuance_unconfirmed: boolean;
                         };
                     };
                 };
-                /** @description No run with that id inside the caller's org and project. */
-                404: {
+                /** @description The call is malformed, or the two idempotency keys disagree. */
+                400: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10301,14 +11738,19 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "not_found";
+                                code: "charge_idempotency_key_required" | "idempotency_key_conflict";
                                 message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description The paused run expired before it was resumed. */
-                410: {
+                /** @description The idempotency slot is held by a row this project cannot read. */
+                409: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10316,7 +11758,27 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "run_stale";
+                                code: "charge_idempotency_slot_unreadable";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The slot could not be reserved, or the issuer refused. Nothing was sent. */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "charge_idempotency_reserve_failed";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10329,40 +11791,48 @@ export interface paths {
                 };
             };
         };
-        put?: never;
-        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/connections/subaccount/{id}/revoke": {
+    "/v1/charges/{chargeId}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        put?: never;
         /**
-         * Revoke a provisioned subaccount and try to delete it upstream
-         * @description The revoke for accounts this platform minted on the customer's behalf. It is not `POST /v1/connections/{id}/revoke`: the generic purge targets the ref keyed on the server id, which is the wrong ref for a per-account subaccount credential, and it touches neither the provisioning record nor the account at the provider.
+         * Read a charge
+         * @description Reads a charge this project issued. `chargeId` accepts EITHER the id the create returned OR the caller's own `idempotency_key` — the row is resolved under this credential's org and project, which is what makes another tenant's id simply not found.
          *
-         *     Local teardown first, atomically: the connection projection flips, the provisioning record flips, and the correct per-account vault ref is purged. A failure in that phase changes nothing and answers 503, so a retry is safe. Only then is a delete attempted at the provider.
+         *     **Branch on `payable`, not on `status`.** `payable` is true only when the issuance is confirmed, our row is still open, the provider says PENDING, and at least one payable document exists. A cobrança com vencimento answers PROCESSING with `payable: false` and no document at first, because the instrument registers with the clearing house before it can be paid.
          *
-         *     READ `upstream` BEFORE TREATING THIS AS FINISHED. `deleted` means the account is gone at the provider. `not_applicable` means the lane has no delete to make. `delete_failed` and `orphaned` mean the credential is destroyed on our side but an account may still exist upstream, and closing it is a manual step. All four come back with 200, because the local teardown did succeed.
+         *     This read also ARMS the Pix leg's correlation when the provider's answer carries it, which is why `credit_correlation_armed` can flip from a read. Nothing else about it writes: no ledger row, no money.
          *
-         *     `{id}` is a connection id for the customer path, matched only inside the caller's own org and project. It is a provisioning record id for the operator-internal path, which additionally requires service auth. A customer credential can never reach an operator-internal record: it misses the connection lookup and gets 404, never a 403 that would confirm the id exists. A repeated revoke returns `already: true` and changes nothing.
+         *     **Each refusal names a `reason`, and the reason is what to branch on.** The two error `code` values (`invalid_args`, `provider_error`) are too coarse: they cover six different situations, and reading them as one would turn `not found` into `bad request`.
+         *
+         *     | reason | status | what it means |
+         *     |---|---|---|
+         *     | `charge_id_missing` | 400 | the call named no charge |
+         *     | `project_scope_missing` | 400 | the credential is not project-scoped, and a charge belongs to one project |
+         *     | `charge_not_found` | 404 | no charge under that id FOR THIS TENANT |
+         *     | `issuance_unconfirmed` | 409 | the key holds a reservation whose create never got an answer |
+         *     | `already_payment_notified` | 409 | the clearing house already notified a payment |
+         *     | `not_cancellable_in_this_state` | 409 | the issuer accepts a cancellation only in some states |
+         *     | `provider_status_unreadable` | 502 | the issuer did not answer the read |
+         *     | `provider_cancel_failed` | 502 | the issuer refused the withdrawal |
+         *
+         *     `charge_not_found` is deliberately the SAME answer for an id that belongs to another project and for an id that exists nowhere. Telling those apart would be an oracle about another tenant over a string anyone can guess.
          */
-        post: {
+        get: {
             parameters: {
                 query?: never;
                 header?: never;
                 path: {
-                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
-                    id: string;
+                    chargeId: string;
                 };
                 cookie?: never;
             };
@@ -10375,26 +11845,45 @@ export interface paths {
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "revoked";
-                            record_id: string;
-                            /** @description The connection projection's id, or the provisioning record's id when there is no projection. */
-                            connection_id: string;
-                            /**
-                             * @description What happened at the provider. `delete_failed` and `orphaned` mean an account may still exist there; the local credential is gone either way.
-                             * @enum {string}
-                             */
-                            upstream: "deleted" | "delete_failed" | "not_applicable" | "orphaned";
+                            /** @description The issuer's charge id. Null while the issuance is unconfirmed. */
+                            id: string | null;
+                            /** @description The provider's state as far as we know it, normalized. Forced to PROCESSING until the issuance is confirmed. */
+                            status: string;
+                            /** @description What CodeSpar recorded, which is a different question from `status`. */
+                            local_status: string;
+                            /** @description True when the two disagree terminally, instead of one of them silently winning. */
+                            status_conflict: boolean;
+                            method: string;
+                            currency: string;
+                            /** @description In units. */
+                            amount: number;
+                            /** @description In minor units. */
+                            amount_minor: number;
+                            due_date: string | null;
+                            /** @description True only when all four hold: the issuance is confirmed, our row is still open, the provider says PENDING, and at least one document exists. This is the field to branch on, not `status`. */
+                            payable: boolean;
+                            boleto_bar_code: string | null;
+                            boleto_bank_line: string | null;
+                            /** @description The Pix leg of the same debt. One receivable, two payable legs. */
+                            pix_copy_paste: string | null;
+                            /** @description Whether an inbound Pix on this charge's Pix leg can resolve a wallet on its own. False until registration hands us the leg's identifier. */
+                            credit_correlation_armed: boolean;
+                            /** @description True when a payment was notified and the receivable is still open. Read this before you write anything off: the issuer can answer EXPIRED for a boleto it already told us was paid, because the baixa happened before the due date and the credit lands on the next business day. */
+                            payment_in_flight: boolean;
                             /**
-                             * @description Present when the subaccount was already revoked. Nothing changed.
-                             * @enum {boolean}
+                             * @description The settlement tri-state (decision 10b of the canonical matrix). `confirmed`: the money is in the account. `pending`: the clearing house notified a payment and the credit has not landed, which is the D+1 window. `unconfirmable`: our terminal state disagrees with the issuer's, so settlement cannot be established.
+                             *
+                             *     NULL MEANS NOT APPLICABLE, never `pending`. A charge nobody paid has no pending settlement: it has an open receivable. Reading null as pending would tell you money is on its way.
+                             * @enum {string|null}
                              */
-                            already?: true;
+                            settlement: "confirmed" | "pending" | "unconfirmable" | null;
+                            /** @description True while the row is a reservation with no charge id: the issuer's answer to the create was lost, or a create is in flight elsewhere under the same key. Nothing is payable and nothing was duplicated. */
+                            issuance_unconfirmed: boolean;
                         };
                     };
                 };
-                /** @description This is a write, so it carries a role floor: a service-auth caller must send `x-codespar-user` and hold admin or above. */
-                403: {
+                /** @description The call is malformed. `reason` says which half. */
+                400: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10402,7 +11891,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "insufficient_role";
+                                code: "charge_id_missing" | "project_scope_missing";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10413,7 +11902,7 @@ export interface paths {
                         };
                     };
                 };
-                /** @description No connection or operator-internal record with that id is reachable by this caller. */
+                /** @description No charge under that id for this tenant. */
                 404: {
                     headers: {
                         [name: string]: unknown;
@@ -10422,14 +11911,19 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "not_found";
+                                code: "charge_not_found";
                                 message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description The revoke threw unexpectedly. */
-                500: {
+                /** @description The charge exists and is not readable in this state. */
+                409: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10437,7 +11931,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "revoke_failed";
+                                code: "issuance_unconfirmed";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10448,8 +11942,8 @@ export interface paths {
                         };
                     };
                 };
-                /** @description The internal phase failed and left nothing changed. Retry. */
-                503: {
+                /** @description The issuer did not answer. */
+                502: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10457,7 +11951,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "revoke_failed";
+                                code: "provider_status_unreadable";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10470,36 +11964,52 @@ export interface paths {
                 };
             };
         };
+        put?: never;
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/connections/subaccount/{id}/status": {
+    "/v1/charges/{chargeId}/cancel": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
+        get?: never;
+        put?: never;
         /**
-         * Read whether a provisioned subaccount can transact yet
-         * @description Read-only, with one live call to the provider. It writes nothing and changes no state.
+         * Withdraw a charge
+         * @description Withdraws a charge that has not been paid. Takes no body: the id is the whole request, and it accepts the same two forms the read does.
          *
-         *     `charges_enabled` is what the provider says right now, not a cached flag, which is why a provider that is unreachable answers 502 rather than a stale `false`. The one exception is a revoked record: it short-circuits to `status: "revoked"` and `charges_enabled: false` without calling the provider at all, since there is nothing left to poll. A confirmed account that never reached an upstream account ref reports not-yet-chargeable for the same reason.
+         *     **This never moves money.** It is not a refund: an unpaid receivable is withdrawn, and a charge whose payment the clearing house already notified is REFUSED with `already_payment_notified` rather than withdrawn. That refusal is the D+1 guard: a boleto paid after the convênio's cut-off is notified on one day and credited on the next business day, so the due date can fall between the two, and withdrawing there would write off a receivable somebody paid.
          *
-         *     `capabilities` carries the provider's per-capability activation states when it reports them, and is absent when it does not. An account can be provisioned and still not chargeable; gate any money movement on `charges_enabled`, not on the existence of the connection.
+         *     A charge the issuer already reports as cancelled is a no-op that closes our row, not a second withdrawal.
          *
-         *     Same dual-id resolution and same cross-tenant 404 as the revoke beside it, minus its admin floor: a read does not need one.
+         *     **Each refusal names a `reason`, and the reason is what to branch on.** The two error `code` values (`invalid_args`, `provider_error`) are too coarse: they cover six different situations, and reading them as one would turn `not found` into `bad request`.
+         *
+         *     | reason | status | what it means |
+         *     |---|---|---|
+         *     | `charge_id_missing` | 400 | the call named no charge |
+         *     | `project_scope_missing` | 400 | the credential is not project-scoped, and a charge belongs to one project |
+         *     | `charge_not_found` | 404 | no charge under that id FOR THIS TENANT |
+         *     | `issuance_unconfirmed` | 409 | the key holds a reservation whose create never got an answer |
+         *     | `already_payment_notified` | 409 | the clearing house already notified a payment |
+         *     | `not_cancellable_in_this_state` | 409 | the issuer accepts a cancellation only in some states |
+         *     | `provider_status_unreadable` | 502 | the issuer did not answer the read |
+         *     | `provider_cancel_failed` | 502 | the issuer refused the withdrawal |
+         *
+         *     `charge_not_found` is deliberately the SAME answer for an id that belongs to another project and for an id that exists nowhere. Telling those apart would be an oracle about another tenant over a string anyone can guess.
          */
-        get: {
+        post: {
             parameters: {
                 query?: never;
                 header?: never;
                 path: {
-                    /** @description A `ca_` connection id, or a `pr_` provisioning record id on the operator-internal path. */
-                    id: string;
+                    chargeId: string;
                 };
                 cookie?: never;
             };
@@ -10512,19 +12022,64 @@ export interface paths {
                     };
                     content: {
                         "application/json": {
-                            /** @enum {string} */
-                            status: "provisioned" | "revoked";
-                            charges_enabled: boolean;
-                            /** @description Per-capability activation states as the provider reports them, for example `card_payments: "active"`. */
-                            capabilities?: {
-                                [key: string]: string;
+                            /** @description The issuer's charge id. Null while the issuance is unconfirmed. */
+                            id: string | null;
+                            /** @description The provider's state as far as we know it, normalized. Forced to PROCESSING until the issuance is confirmed. */
+                            status: string;
+                            /** @description What CodeSpar recorded, which is a different question from `status`. */
+                            local_status: string;
+                            /** @description True when the two disagree terminally, instead of one of them silently winning. */
+                            status_conflict: boolean;
+                            method: string;
+                            currency: string;
+                            /** @description In units. */
+                            amount: number;
+                            /** @description In minor units. */
+                            amount_minor: number;
+                            due_date: string | null;
+                            /** @description True only when all four hold: the issuance is confirmed, our row is still open, the provider says PENDING, and at least one document exists. This is the field to branch on, not `status`. */
+                            payable: boolean;
+                            boleto_bar_code: string | null;
+                            boleto_bank_line: string | null;
+                            /** @description The Pix leg of the same debt. One receivable, two payable legs. */
+                            pix_copy_paste: string | null;
+                            /** @description Whether an inbound Pix on this charge's Pix leg can resolve a wallet on its own. False until registration hands us the leg's identifier. */
+                            credit_correlation_armed: boolean;
+                            /** @description True when a payment was notified and the receivable is still open. Read this before you write anything off: the issuer can answer EXPIRED for a boleto it already told us was paid, because the baixa happened before the due date and the credit lands on the next business day. */
+                            payment_in_flight: boolean;
+                            /**
+                             * @description The settlement tri-state (decision 10b of the canonical matrix). `confirmed`: the money is in the account. `pending`: the clearing house notified a payment and the credit has not landed, which is the D+1 window. `unconfirmable`: our terminal state disagrees with the issuer's, so settlement cannot be established.
+                             *
+                             *     NULL MEANS NOT APPLICABLE, never `pending`. A charge nobody paid has no pending settlement: it has an open receivable. Reading null as pending would tell you money is on its way.
+                             * @enum {string|null}
+                             */
+                            settlement: "confirmed" | "pending" | "unconfirmable" | null;
+                            /** @description True while the row is a reservation with no charge id: the issuer's answer to the create was lost, or a create is in flight elsewhere under the same key. Nothing is payable and nothing was duplicated. */
+                            issuance_unconfirmed: boolean;
+                        };
+                    };
+                };
+                /** @description The call is malformed. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "charge_id_missing" | "project_scope_missing";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
-                            /** @description The upstream account identifier. Empty string when the record never reached one. */
-                            account_ref: string;
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description No connection or operator-internal record with that id is reachable by this caller. */
+                /** @description No charge under that id for this tenant. */
                 404: {
                     headers: {
                         [name: string]: unknown;
@@ -10533,14 +12088,19 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "not_found";
+                                code: "charge_not_found";
                                 message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
                             };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
                         };
                     };
                 };
-                /** @description The status read threw unexpectedly. */
-                500: {
+                /** @description The charge exists and this state does not accept a withdrawal. `already_payment_notified` is the D+1 guard and is never a retry case. */
+                409: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -10548,7 +12108,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "status_failed";
+                                code: "issuance_unconfirmed" | "already_payment_notified" | "not_cancellable_in_this_state";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10559,7 +12119,7 @@ export interface paths {
                         };
                     };
                 };
-                /** @description The provider read did not produce a status. Usually the live call failed or timed out, and a retry is the right response. TWO OF THE CASES BEHIND THIS CODE ARE NOT TRANSIENT and retrying never clears them: the provider has no subaccount descriptor in this deployment, and no platform account credential is registered for it. Both are configuration defects on our side; `error.message` distinguishes them from a provider outage. */
+                /** @description The issuer refused the withdrawal, or did not answer. */
                 502: {
                     headers: {
                         [name: string]: unknown;
@@ -10568,7 +12128,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "status_failed";
+                                code: "provider_cancel_failed" | "provider_status_unreadable";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -10581,8 +12141,6 @@ export interface paths {
                 };
             };
         };
-        put?: never;
-        post?: never;
         delete?: never;
         options?: never;
         head?: never;
@@ -17972,7 +19530,7 @@ export interface paths {
          *
          *     `linked_consumer_id` is set on first write and then kept: a later call that sends a different one does not overwrite it. The other KYB fields are overwritten by the re-POST.
          *
-         *     `document_number` is stored with every non-digit stripped. A value that survives the schema but contains no digits at all leaves nothing to store, and that surfaces as 502 `seller_document_required`, not as 400: the check lives in the provisioning flow, past the point where the body was validated.
+         *     `document_number` must be a CPF (11 digits) or a CNPJ (14 characters, letters allowed in the twelve base positions per IN RFB 2229/2024) whose check digits verify, and `document_type` / `document_tax_type` must agree with it (CPF ↔ PF, CNPJ ↔ PJ | MEI | ME); any of those failing is 400 `invalid_body` with the offending field in `issues[].path`, before Rinne is reached. It is then stored with every non-digit stripped. A value that survives the schema but contains no digits at all leaves nothing to store, and that surfaces as 502 `seller_document_required`, not as 400: the check lives in the provisioning flow, past the point where the body was validated.
          *
          *     The response is the seller row, not Rinne's. `status` and `affiliation_status` reflect whatever the affiliation was at that instant, which for a fresh onboarding is normally pending rather than active.
          */
@@ -19376,6 +20934,18 @@ export interface paths {
          *     Three refusals arrive IN BAND on the catalog branch, as a 200 whose `error` starts with `policy_denied: `, `approval_required: ` or `policy_engine_error: `. The policy 403 and the policy 503 below are the same decisions taken one layer earlier, by the route's guard, before the handler runs. A caller that only checks the status code will read an in-band refusal as a successful request.
          *
          *     413 is absent from this operation on purpose: the guard here does not hand the caller's tool input to the policy engine, so the engine's payload cap cannot fire. `POST /v1/sessions/{id}/proxy_execute` does hand it over, and does answer 413.
+         *
+         *     WHICH STRINGS ARE LEGAL IN `tool`. This operation takes the name opaquely and this document does not enumerate it. `GET /v1/meta-tools.json` does: one entry per tool, each with a JSON Schema for what goes in `params`, served with no credential. Read that before hardcoding a name or concluding a capability is missing, because the per-tool contracts live there and not here.
+         *
+         *     SEVERAL OF THOSE TOOLS MOVE MONEY, and the envelope above shows none of what they require. `codespar_pay` spends outbound under a mandate; `codespar_charge` issues an inbound receivable. Both answer in this same 200 envelope, so `success` is the field that says whether the money instruction was accepted, and a refusal that starts with `policy_denied: ` or `approval_required: ` is a refusal even though the status is 200.
+         *
+         *     THE COBRANÇA COM VENCIMENTO IS THE ONE THAT SURPRISES CALLERS. `codespar_charge` with `action: "create"`, `method: "boleto"` and a `due_date` issues ONE receivable the payer settles EITHER as a boleto (barcode and linha digitável) OR by Pix — one debt, two payable legs, never two documents. Three properties of it are not visible from this envelope and each one costs money to learn late:
+         *
+         *     1. `idempotency_key` is REQUIRED for that combination. A create without one is refused before anything reaches the provider, and a repeat with the same key returns the charge already issued rather than a second document for the same debt. An agent that retries on a timeout without it bills the payer twice.
+         *     2. The create answers `status: "PROCESSING"` with `payable: false` and NO document. The instrument registers with the clearing house first. Subscribe to `commerce.charge.created` instead of polling for a barcode that is not late, only not made yet.
+         *     3. `commerce.charge.paid` is the event that means the funds arrived, by either leg. A boleto payment can be preceded by `commerce.charge.payment_notified`, which is the clearing house posting its operational baixa and which the issuer states is not proof of payment; every convênio has a daily cut-off, so a boleto paid after it is notified on one day and credited on the next business day. Ship on `paid`.
+         *
+         *     An agreement in N instalments is N cobranças, one per parcela, each with its own `due_date` and its own `idempotency_key`. There is no single instalment charge.
          */
         post: {
             parameters: {
@@ -19685,6 +21255,23 @@ export interface paths {
                         };
                     };
                 };
+                /** @description Unprocessable — the project is in `environment="test"` and this server cannot be exercised there. `reason` is the provider's `test_venue` classification: `none` means the provider runs no test environment at all, so the call would land on production with a real effect (a Z-API WhatsApp message goes to a real number); `unclassified` means nobody has established what it does in test. Answered whether or not `PROXY_REQUIRE_CONNECTION` is set, because it is about the environment and not about a missing connection, and not retryable — the same call from a `live` project reaches the provider (ent#722). */
+                422: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @enum {string} */
+                            error: "test_venue_unavailable";
+                            /** @enum {string} */
+                            reason: "none" | "unclassified" | "separate_host";
+                            server: string;
+                            /** @description Names the catalog file and the field to declare. */
+                            message: string;
+                        };
+                    };
+                };
                 /** @description Failed Dependency — no usable credential for this server. `reason` is the resolver's own outcome. */
                 424: {
                     headers: {
@@ -21992,6 +23579,77 @@ export interface components {
              */
             engine_status: "none" | "available" | "quarantined";
         };
+        SpendOutcome: {
+            /** @enum {string} */
+            status: "completed";
+            requestId: string;
+            mandate: {
+                consumer_id: string;
+                purpose: string;
+                currency: string;
+            };
+            payment: {
+                transactionId: string;
+                /** @description The Pix endToEndId when the rail produces one. Null for rails that have none, TED included. */
+                endToEndId: string | null;
+                amountMinor: number;
+                rail: string;
+                provider: string;
+                /** @description False when the adapter is a mock or a staging stub. True when real money left. */
+                moneyMoved: boolean;
+                adapter: string;
+            };
+            wallet: {
+                walletId: string;
+                holdEntryId: string;
+                fundEntryId: string | null;
+                debitEntryId: string | null;
+            };
+            /** @description The sealed Control Record. Null when there was no consumer secret to sign it with. */
+            receipt: {
+                id: string;
+                /** @enum {string} */
+                state: "paid" | "exception" | "delivered";
+                chain: string;
+                exceptions: unknown[];
+            } | null;
+            /** @description The lifecycle steps, in order, each with a timestamp and an outcome. */
+            audit: unknown[];
+        };
+        /** @description The destination of a TED, the Brazilian same-day bank wire. Present this object on a spend to send a wire instead of a Pix: its presence is what switches the rail, and what makes the three TED requirements on those operations bind. Money leaves the consumer's own sub-account, never a pooled one. */
+        TedDestination: {
+            /** @description ISPB of the destination institution, digits only. */
+            bank: string;
+            /** @description Branch, with no separate check digit. */
+            branch: string;
+            /** @description Account, including the check digit. */
+            account: string;
+            /** @description CPF or CNPJ of the destination account holder. */
+            tax_id: string;
+            /** @description Name of the destination account holder. */
+            name: string;
+            /**
+             * @description Checking, investment, payment or savings. This is the TED product's OWN enum, different from the Pix account enum (`CACC`, `SLRY`, `SVGS`, `TRAN`): they are distinct endpoints and distinct products at the provider.
+             * @enum {string}
+             */
+            account_type?: "CC" | "CI" | "PG" | "PP";
+            /**
+             * @description A natural person or a legal entity.
+             * @enum {string}
+             */
+            person_type?: "F" | "J";
+            /** @description The banking partner's purpose code. Defaults to `1`, a generic transfer. */
+            client_finality?: string;
+        };
+        /** @description The offer the agent approved. When present it is signed into the receipt, and at close the price and the payee are compared against what actually settled. A divergence is RECORDED on the receipt; it does not abort settlement. */
+        SpendQuote: {
+            seller: string;
+            resource: string;
+            price_minor: number;
+            payee: string;
+            session_id?: string;
+            at?: string;
+        };
     };
     responses: never;
     parameters: never;