@codespar/sdk 0.16.7 → 0.16.9

package/dist/generated/openapi.d.ts

@@ -835,7 +835,7 @@ export interface paths {
         put?: never;
         /**
          * Open a session
-         * @description A session is the unit an agent's tool calls, policy evaluations and audit entries hang off. `servers` names the connected MCP servers it may reach (1-20), and every id must be one `GET /v1/servers` returns for this project — an id that is not gets 400 `unknown_servers` with the offenders listed, which is a different body from the schema `invalid_body` above it.
+         * @description A session is the unit an agent's tool calls, policy evaluations and audit entries hang off. `servers` names the connected MCP servers it may reach (0–20), and every id must be one `GET /v1/servers` returns for this project — an id that is not gets 400 `unknown_servers` with the offenders listed, which is a different body from the schema `invalid_body` above it.
          *
          *     `mocks` and `chaos` are accepted only on a project whose environment is `test`: a live-environment project gets 403 mocks_not_permitted, a payload over 64 KiB gets 413, and a malformed one gets 400 with RFC 6901 pointers pointing at the offending field.
          */
@@ -851,6 +851,8 @@ export interface paths {
                     "application/json": {
                         servers: string[];
                         user_id?: string;
+                        /** @description The registered agent this session acts as (its handle). Approvals raised in the session are attributed to it. Must name an active agent of this org, or the request answers 422. */
+                        agent_id?: string;
                         mocks?: {
                             [key: string]: unknown;
                         };
@@ -1452,7 +1454,7 @@ export interface paths {
                 content: {
                     "application/json": {
                         name: string;
-                        /** @description The event type to subscribe to. Matching is EXACT string equality — there is no prefix and no wildcard, so `commerce.payment.succeeded` does not receive `commerce.payment.received`. A name outside the list below is accepted and recorded (`trigger.event_unknown`) rather than refused, so you can subscribe ahead of a release; until something emits it the subscription simply never fires. What this build emits: approval.decided, approval.pending, commerce.account_launch_in.received, commerce.account_launch_out.received, commerce.account_status.changed, commerce.cashout.confirmed, commerce.charge.cancelled, commerce.charge.created, commerce.charge.expired, commerce.charge.expiry_notified, commerce.charge.paid, commerce.charge.payment_notified, commerce.dict_claim.cancelled, commerce.dict_claim.completed, commerce.dict_claim.confirmed, commerce.dict_claim.opened, commerce.dict_claim.waiting, commerce.internal_transfer_in.received, commerce.internal_transfer_out.received, commerce.mandate.granted, commerce.mandate.paused, commerce.mandate.resumed, commerce.mandate.revoked, commerce.onboarding.backgroundcheck_approved, commerce.onboarding.backgroundcheck_pending, commerce.onboarding.backgroundcheck_rejected, commerce.onboarding.documentscopy_approved, commerce.onboarding.documentscopy_pending, commerce.onboarding.documentscopy_processing, commerce.onboarding.documentscopy_rejected, commerce.onboarding.proposal_approved, commerce.onboarding.proposal_processing_documentscopy, commerce.onboarding.proposal_rejected, commerce.payment.failed, commerce.payment.pending, commerce.payment.received, commerce.payment.refunded, commerce.payment.succeeded, commerce.payment.updated, commerce.pix_out.failed, commerce.pix_out.succeeded, commerce.pix_out.unconfirmed, commerce.pix_reversal_in.received, commerce.pix_reversal_out.received, commerce.rinne.observed, commerce.spend.failed, commerce.spend.settled, commerce.ted_in.succeeded, dda.boleto.registered, dda.subscription.activated, dda.subscription.failed, proxy_call.failed, proxy_call.succeeded, session.closed, system.health.degraded, system.health.recovered, tool_call.failed, tool_call.succeeded, trigger.paused_automatically, trigger.test_fire, user.signed_up. */
+                        /** @description The event type to subscribe to. Matching is EXACT string equality — there is no prefix and no wildcard, so `commerce.payment.succeeded` does not receive `commerce.payment.received`. A name outside the list below is accepted and recorded (`trigger.event_unknown`) rather than refused, so you can subscribe ahead of a release; until something emits it the subscription simply never fires. What this build emits: approval.decided, approval.pending, commerce.account_launch_in.received, commerce.account_launch_out.received, commerce.account_status.changed, commerce.cashout.confirmed, commerce.charge.cancelled, commerce.charge.created, commerce.charge.expired, commerce.charge.expiry_notified, commerce.charge.paid, commerce.charge.payment_notified, commerce.dict_claim.cancelled, commerce.dict_claim.completed, commerce.dict_claim.confirmed, commerce.dict_claim.opened, commerce.dict_claim.waiting, commerce.internal_transfer_in.received, commerce.internal_transfer_out.received, commerce.mandate.granted, commerce.mandate.paused, commerce.mandate.resumed, commerce.mandate.revoked, commerce.onboarding.backgroundcheck_approved, commerce.onboarding.backgroundcheck_pending, commerce.onboarding.backgroundcheck_rejected, commerce.onboarding.documentscopy_approved, commerce.onboarding.documentscopy_pending, commerce.onboarding.documentscopy_processing, commerce.onboarding.documentscopy_rejected, commerce.onboarding.proposal_approved, commerce.onboarding.proposal_processing_documentscopy, commerce.onboarding.proposal_rejected, commerce.organization.paused, commerce.organization.resumed, commerce.payment.failed, commerce.payment.pending, commerce.payment.received, commerce.payment.refunded, commerce.payment.succeeded, commerce.payment.updated, commerce.pix_out.failed, commerce.pix_out.succeeded, commerce.pix_out.unconfirmed, commerce.pix_reversal_in.received, commerce.pix_reversal_out.received, commerce.rinne.observed, commerce.spend.failed, commerce.spend.settled, commerce.ted_in.succeeded, dda.boleto.registered, dda.subscription.activated, dda.subscription.failed, proxy_call.failed, proxy_call.succeeded, session.closed, system.health.degraded, system.health.recovered, tool_call.failed, tool_call.succeeded, trigger.paused_automatically, trigger.test_fire, user.signed_up. */
                         event: string;
                         server_id?: string;
                         /** Format: uri */
@@ -1570,7 +1572,7 @@ export interface paths {
                 content: {
                     "application/json": {
                         name: string;
-                        /** @description The event type to subscribe to. Matching is EXACT string equality — there is no prefix and no wildcard, so `commerce.payment.succeeded` does not receive `commerce.payment.received`. A name outside the list below is accepted and recorded (`trigger.event_unknown`) rather than refused, so you can subscribe ahead of a release; until something emits it the subscription simply never fires. What this build emits: approval.decided, approval.pending, commerce.account_launch_in.received, commerce.account_launch_out.received, commerce.account_status.changed, commerce.cashout.confirmed, commerce.charge.cancelled, commerce.charge.created, commerce.charge.expired, commerce.charge.expiry_notified, commerce.charge.paid, commerce.charge.payment_notified, commerce.dict_claim.cancelled, commerce.dict_claim.completed, commerce.dict_claim.confirmed, commerce.dict_claim.opened, commerce.dict_claim.waiting, commerce.internal_transfer_in.received, commerce.internal_transfer_out.received, commerce.mandate.granted, commerce.mandate.paused, commerce.mandate.resumed, commerce.mandate.revoked, commerce.onboarding.backgroundcheck_approved, commerce.onboarding.backgroundcheck_pending, commerce.onboarding.backgroundcheck_rejected, commerce.onboarding.documentscopy_approved, commerce.onboarding.documentscopy_pending, commerce.onboarding.documentscopy_processing, commerce.onboarding.documentscopy_rejected, commerce.onboarding.proposal_approved, commerce.onboarding.proposal_processing_documentscopy, commerce.onboarding.proposal_rejected, commerce.payment.failed, commerce.payment.pending, commerce.payment.received, commerce.payment.refunded, commerce.payment.succeeded, commerce.payment.updated, commerce.pix_out.failed, commerce.pix_out.succeeded, commerce.pix_out.unconfirmed, commerce.pix_reversal_in.received, commerce.pix_reversal_out.received, commerce.rinne.observed, commerce.spend.failed, commerce.spend.settled, commerce.ted_in.succeeded, dda.boleto.registered, dda.subscription.activated, dda.subscription.failed, proxy_call.failed, proxy_call.succeeded, session.closed, system.health.degraded, system.health.recovered, tool_call.failed, tool_call.succeeded, trigger.paused_automatically, trigger.test_fire, user.signed_up. */
+                        /** @description The event type to subscribe to. Matching is EXACT string equality — there is no prefix and no wildcard, so `commerce.payment.succeeded` does not receive `commerce.payment.received`. A name outside the list below is accepted and recorded (`trigger.event_unknown`) rather than refused, so you can subscribe ahead of a release; until something emits it the subscription simply never fires. What this build emits: approval.decided, approval.pending, commerce.account_launch_in.received, commerce.account_launch_out.received, commerce.account_status.changed, commerce.cashout.confirmed, commerce.charge.cancelled, commerce.charge.created, commerce.charge.expired, commerce.charge.expiry_notified, commerce.charge.paid, commerce.charge.payment_notified, commerce.dict_claim.cancelled, commerce.dict_claim.completed, commerce.dict_claim.confirmed, commerce.dict_claim.opened, commerce.dict_claim.waiting, commerce.internal_transfer_in.received, commerce.internal_transfer_out.received, commerce.mandate.granted, commerce.mandate.paused, commerce.mandate.resumed, commerce.mandate.revoked, commerce.onboarding.backgroundcheck_approved, commerce.onboarding.backgroundcheck_pending, commerce.onboarding.backgroundcheck_rejected, commerce.onboarding.documentscopy_approved, commerce.onboarding.documentscopy_pending, commerce.onboarding.documentscopy_processing, commerce.onboarding.documentscopy_rejected, commerce.onboarding.proposal_approved, commerce.onboarding.proposal_processing_documentscopy, commerce.onboarding.proposal_rejected, commerce.organization.paused, commerce.organization.resumed, commerce.payment.failed, commerce.payment.pending, commerce.payment.received, commerce.payment.refunded, commerce.payment.succeeded, commerce.payment.updated, commerce.pix_out.failed, commerce.pix_out.succeeded, commerce.pix_out.unconfirmed, commerce.pix_reversal_in.received, commerce.pix_reversal_out.received, commerce.rinne.observed, commerce.spend.failed, commerce.spend.settled, commerce.ted_in.succeeded, dda.boleto.registered, dda.subscription.activated, dda.subscription.failed, proxy_call.failed, proxy_call.succeeded, session.closed, system.health.degraded, system.health.recovered, tool_call.failed, tool_call.succeeded, trigger.paused_automatically, trigger.test_fire, user.signed_up. */
                         event: string;
                         server_id?: string;
                         /** Format: uri */
@@ -2791,9 +2793,9 @@ export interface paths {
          *
          *     `revoked` is not `retired`. Retired is a graceful exit; revoked is authority withdrawn, possibly adversarial. Both are reachable states and this verb writes the second one.
          *
-         *     WHAT IT STOPS: the agent can no longer be paid as an `agent:<id>` payee, and can no longer mint a new KYA-bearing mandate.
+         *     WHAT IT STOPS: the agent can no longer be paid as an `agent:<id>` payee, can no longer mint a new KYA-bearing mandate, and can no longer spend under consumer mandates bound to its key: every consumer lane, card included, refuses them. The mandates themselves are not revoked -- the consumer signed them -- they stop clearing the spend-time check.
          *
-         *     WHAT IT DOES NOT STOP: spending under mandates already signed. Those were signed by the CONSUMER, and a tenant's administration verb does not revoke a third party's authorization. The consequence is that revoking does not by itself halt money already authorized — see ent#1067. If that is what you need, revoke the mandates.
+         *     WHAT IT DOES NOT STOP: spending under consumer mandates not bound to a key (issued before that binding existed, or while the agent was unregistered), because they name no key a revocation could reach. The deployment can refuse those for every agent (CONSUMER_MANDATE_AGENT_ENFORCE); otherwise, revoke those mandates.
          *
          *     A `{did}` belonging to another org returns 404, not 403: 403 would confirm that the identity exists, which is what a caller sweeping DIDs is asking.
          */
@@ -9331,7 +9333,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9345,6 +9347,8 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
@@ -9364,7 +9368,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9378,6 +9382,8 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
@@ -9392,7 +9398,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9406,10 +9412,12 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
-                /** @description `not_connected`. There is no usable credential to test: no active connection for this project and provider, or the vault returned nothing for the reference it holds. This body carries the extra `hint` / `alternative` steer. */
+                /** @description `not_connected`. There is no usable credential to test: no active connection for this project and provider, or the vault returned nothing for the reference it holds. This body carries the extra `hint` / `alternative` steer. Or `connection_expired`: the project has an authorization-code OAuth connection whose access token passed its expiry, and nothing refreshes it, so the fix is to reconnect. That body carries `expires_at` and no sandbox steer. */
                 424: {
                     headers: {
                         [name: string]: unknown;
@@ -9420,7 +9428,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9434,6 +9442,8 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
@@ -9448,7 +9458,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9462,6 +9472,8 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
@@ -9476,7 +9488,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9490,6 +9502,8 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
@@ -9504,7 +9518,7 @@ export interface paths {
                             ok: false;
                             provider: string;
                             /** @enum {string} */
-                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
+                            error: "server_unknown" | "verify_unsupported" | "not_connected" | "connection_expired" | "provider_rejected" | "provider_unreachable" | "redirect_not_followed" | "endpoint_missing" | "test_venue_unavailable";
                             /** @description Whose sentence this is depends on the code, and the difference matters. On `provider_rejected` and `provider_unreachable` it is up to 256 characters of the PROVIDER's own response body, or the transport error. On the others it is text we wrote, naming what is missing on our side. It is absent on `redirect_not_followed`, and on the `server_unknown` and `endpoint_missing` refusals that carry nothing but the code. On `test_venue_unavailable` it names the catalog file and the field to declare, and it is the one refusal here that is about the project's ENVIRONMENT rather than its connection: the identical request from a `live` project reaches the provider. */
                             detail?: string;
                             /** @description The provider's HTTP status, present only when a round trip completed: on `provider_rejected`, `redirect_not_followed`, and the `provider_unreachable` that came from a response rather than from a transport failure. Its ABSENCE on a 502 is the signal that nothing was reached at all. */
@@ -9518,6 +9532,8 @@ export interface paths {
                             alternative?: string;
                             /** @description Added only for a `cert` rail in the test environment, where the connect cannot be completed at all rather than merely being unfinished. */
                             caveat?: string;
+                            /** @description Present on `connection_expired` only: the ISO instant the connection's OAuth access token expired. */
+                            expires_at?: string;
                         };
                     };
                 };
@@ -9724,7 +9740,7 @@ export interface paths {
          * Read graded dependency health, as this credential's tenant sees it
          * @description Six dependency checks and the schema version, graded into one `status`. The checks run in parallel behind a three-second budget each; one that throws or times out is reported in its own failed shape with `message` carrying the reason, and the response still carries the other five. So the operation is expected back in under four seconds however badly the database is behaving.
          *
-         *     GRADE ON `status`, AND READ THE RULE BEFORE WRITING THE ALERT, because the rule is narrower than "anything off nominal". `down` means `db.ok` or `vault.ok` is false. `degraded` means one of exactly four things: `embeddings.status` is `empty`, `fx_rates.status` is anything other than `fresh`, `telemetry.status` is `stale`, or `connections.status` is `none`. Everything else grades `healthy`.
+         *     GRADE ON `status`, AND READ THE RULE BEFORE WRITING THE ALERT, because the rule is narrower than "anything off nominal". `down` means `db.ok` or `vault.ok` is false. `degraded` means one of exactly four things: `embeddings.status` is `empty`, `fx_rates.status` is anything other than `usable`, `telemetry.status` is `stale`, or `connections.status` is `none`. Everything else grades `healthy`.
          *
          *     THREE NON-NOMINAL VALUES DO NOT MOVE THE GRADE, and an alert that wants them has to read the field rather than the grade: `embeddings.status` `low` (fewer than half the tool rows carry an embedding), `connections.status` `partial` (one or two connections rather than three or more), and `telemetry.status` `idle` (a quiet hour that still had traffic inside the day). All three come back `healthy` at the top level, on purpose — none of them stops a call from being served.
          *
@@ -9751,7 +9767,7 @@ export interface paths {
                     content: {
                         "application/json": {
                             /**
-                             * @description `down` iff the database or the vault check failed. `degraded` iff embeddings are empty, FX is not fresh, telemetry is stale, or the tenant has no connection. `healthy` otherwise — which includes embeddings `low`, connections `partial` and telemetry `idle`.
+                             * @description `down` iff the database or the vault check failed. `degraded` iff embeddings are empty, the FX rate is not usable, telemetry is stale, or the tenant has no connection. `healthy` otherwise — which includes embeddings `low`, connections `partial` and telemetry `idle`.
                              * @enum {string}
                              */
                             status: "healthy" | "degraded" | "down";
@@ -9787,16 +9803,16 @@ export interface paths {
                                 fx_rates: {
                                     /**
                                      * Format: date-time
-                                     * @description When the USD/BRL rate was last fetched. Null when no rate has ever been stored, and null when the check itself failed.
+                                     * @description The market timestamp BCB stamped on the newest USD/BRL PTAX close we hold — NOT the time our fetcher last ran. BCB publishes Mon-Fri, so on a Monday this is routinely Friday. Null when no rate has ever been stored, and null when the check itself failed.
                                      */
                                     last_fetched_at: string | null;
-                                    /** @description Age of that fetch in hours, to one decimal. */
+                                    /** @description Age of that close in hours, to one decimal. */
                                     hours_old: number | null;
                                     /**
-                                     * @description `stale` past 72 hours, which is the age at which the router stops normalizing across currencies. `missing` when there is no row, or when the check failed. Anything other than `fresh` grades the response `degraded`.
+                                     * @description Whether the router will normalize on this rate, derived from `hours_old`: `usable` inside 72 hours, `stale` past it — which is the age at which the router stops normalizing across currencies. `missing` when there is no row, or when the check failed. Anything other than `usable` grades the response `degraded`. The value deliberately says nothing about recency: a `usable` rate can be three days old over a weekend, and nothing here reports whether the fetcher ran.
                                      * @enum {string}
                                      */
-                                    status: "fresh" | "stale" | "missing";
+                                    status: "usable" | "stale" | "missing";
                                     /** @description Present only when the check failed or timed out. */
                                     message?: string;
                                 };
@@ -9893,6 +9909,12 @@ export interface paths {
                             name: string;
                             /** Format: date-time */
                             created_at: string;
+                            /** @description Set while the organization's kill switch is pressed and every agent money door refuses `org_paused` (ent#1648); null otherwise. The full state, and pressing or releasing it, is `/v1/orgs/{orgId}/pause`. */
+                            spend_pause: {
+                                /** Format: date-time */
+                                paused_at: string | null;
+                                reason: string | null;
+                            } | null;
                         };
                     };
                 };
@@ -12972,7 +12994,10 @@ export interface paths {
                                 server_id: string;
                                 /** @description Mirrors the catalog's `auth_type` at connect time: api_key, path_secret, cert, hmac_signed, jwt_ecdsa, two_header, oauth, cdp or none. Left open because the column is plain text. */
                                 auth_type: string;
-                                /** @enum {string} */
+                                /**
+                                 * @description `expired` includes an OAuth connection whose access token passed `expires_at`: nothing refreshes it yet, calls through it answer `connection_expired`, and the fix is to reconnect. `?status=` filters on this same value.
+                                 * @enum {string}
+                                 */
                                 status: "pending" | "connected" | "revoked" | "expired";
                                 display_name: string | null;
                                 /** @description Provider metadata the OAuth callback wrote (scope, refresh ref) or the provisioning projection wrote (account_id). Always present; null for a key registered through POST /v1/connections, which never sets it. */
@@ -13065,7 +13090,10 @@ export interface paths {
                             server_id: string;
                             /** @description Mirrors the catalog's `auth_type` at connect time: api_key, path_secret, cert, hmac_signed, jwt_ecdsa, two_header, oauth, cdp or none. Left open because the column is plain text. */
                             auth_type: string;
-                            /** @enum {string} */
+                            /**
+                             * @description `expired` includes an OAuth connection whose access token passed `expires_at`: nothing refreshes it yet, calls through it answer `connection_expired`, and the fix is to reconnect. `?status=` filters on this same value.
+                             * @enum {string}
+                             */
                             status: "pending" | "connected" | "revoked" | "expired";
                             display_name: string | null;
                             /** @description Provider metadata the OAuth callback wrote (scope, refresh ref) or the provisioning projection wrote (account_id). Always present; null for a key registered through POST /v1/connections, which never sets it. */
@@ -13105,7 +13133,10 @@ export interface paths {
                             server_id: string;
                             /** @description Mirrors the catalog's `auth_type` at connect time: api_key, path_secret, cert, hmac_signed, jwt_ecdsa, two_header, oauth, cdp or none. Left open because the column is plain text. */
                             auth_type: string;
-                            /** @enum {string} */
+                            /**
+                             * @description `expired` includes an OAuth connection whose access token passed `expires_at`: nothing refreshes it yet, calls through it answer `connection_expired`, and the fix is to reconnect. `?status=` filters on this same value.
+                             * @enum {string}
+                             */
                             status: "pending" | "connected" | "revoked" | "expired";
                             display_name: string | null;
                             /** @description Provider metadata the OAuth callback wrote (scope, refresh ref) or the provisioning projection wrote (account_id). Always present; null for a key registered through POST /v1/connections, which never sets it. */
@@ -13292,7 +13323,10 @@ export interface paths {
                             server_id: string;
                             /** @description Mirrors the catalog's `auth_type` at connect time: api_key, path_secret, cert, hmac_signed, jwt_ecdsa, two_header, oauth, cdp or none. Left open because the column is plain text. */
                             auth_type: string;
-                            /** @enum {string} */
+                            /**
+                             * @description `expired` includes an OAuth connection whose access token passed `expires_at`: nothing refreshes it yet, calls through it answer `connection_expired`, and the fix is to reconnect. `?status=` filters on this same value.
+                             * @enum {string}
+                             */
                             status: "pending" | "connected" | "revoked" | "expired";
                             display_name: string | null;
                             /** @description Provider metadata the OAuth callback wrote (scope, refresh ref) or the provisioning projection wrote (account_id). Always present; null for a key registered through POST /v1/connections, which never sets it. */
@@ -13411,7 +13445,10 @@ export interface paths {
                             server_id: string;
                             /** @description Mirrors the catalog's `auth_type` at connect time: api_key, path_secret, cert, hmac_signed, jwt_ecdsa, two_header, oauth, cdp or none. Left open because the column is plain text. */
                             auth_type: string;
-                            /** @enum {string} */
+                            /**
+                             * @description `expired` includes an OAuth connection whose access token passed `expires_at`: nothing refreshes it yet, calls through it answer `connection_expired`, and the fix is to reconnect. `?status=` filters on this same value.
+                             * @enum {string}
+                             */
                             status: "pending" | "connected" | "revoked" | "expired";
                             display_name: string | null;
                             /** @description Provider metadata the OAuth callback wrote (scope, refresh ref) or the provisioning projection wrote (account_id). Always present; null for a key registered through POST /v1/connections, which never sets it. */
@@ -13555,7 +13592,10 @@ export interface paths {
                             server_id: string;
                             /** @description Mirrors the catalog's `auth_type` at connect time: api_key, path_secret, cert, hmac_signed, jwt_ecdsa, two_header, oauth, cdp or none. Left open because the column is plain text. */
                             auth_type: string;
-                            /** @enum {string} */
+                            /**
+                             * @description `expired` includes an OAuth connection whose access token passed `expires_at`: nothing refreshes it yet, calls through it answer `connection_expired`, and the fix is to reconnect. `?status=` filters on this same value.
+                             * @enum {string}
+                             */
                             status: "pending" | "connected" | "revoked" | "expired";
                             display_name: string | null;
                             /** @description Provider metadata the OAuth callback wrote (scope, refresh ref) or the provisioning projection wrote (account_id). Always present; null for a key registered through POST /v1/connections, which never sets it. */
@@ -14825,6 +14865,8 @@ export interface paths {
          *     The cumulative cap is checked and CONSUMED under an advisory lock, and the wallet hold is taken inside that same lock. The lock is released before the provider call, so a slow provider does not serialize everyone else.
          *
          *     **There is no read route for the outcome.** An `attempt_id` that answered `psp_dispatch_uncertain` has no endpoint to ask about afterwards. Keep the `attempt_id` and present it again: the lifecycle is idempotent on it and answers the state that attempt stopped in, instead of firing a second one. Do NOT restart the same intent under a fresh `attempt_id`. That is how a payment gets made twice. A retry of an attempt that already holds money is not evaluated against the organization's policy rules again, so a budget or a rate limit cannot refuse the retry that finds out what happened.
+         *
+         *     **A settled attempt answers its recorded response.** Presenting the `attempt_id` of an attempt that already settled, with the same amount, payee, mandate, rail and quote, returns the ORIGINAL 200 body verbatim (same `transactionId`, same receipt) with `idempotent_replay: true`, and nothing is dispatched, held, sealed or published. This holds on every rail and in test mode alike, and while the organization is paused, since the answer moves no money. Presenting it with any of those parameters changed is `attempt_id_conflict`. Idempotency is opt-in: a request without an `attempt_id` is its own payment and is never replayed, so two spends under one mandate are two payments. Send an `attempt_id` to make a retry safe.
          */
         post: {
             parameters: {
@@ -14922,7 +14964,7 @@ export interface paths {
                         };
                     };
                 };
-                /** @description Local state refuses. `psp_attempt_in_flight`: the same attempt is already in flight. `psp_attempt_uncertain`: an earlier attempt ended with an unknown outcome and this intent is PINNED to it, so present the same `attempt_id` again, never a new one. `psp_attempt_conflict`: the earlier attempt was already compensated. */
+                /** @description Local state refuses. `psp_attempt_in_flight`: the same attempt is already in flight; retry the SAME `attempt_id` once it has answered, never a new one. `psp_attempt_uncertain`: an earlier attempt ended with an unknown outcome and this intent is PINNED to it, so present the same `attempt_id` again, never a new one. `psp_attempt_conflict`: the earlier attempt was already compensated. `attempt_id_conflict`: this `attempt_id` was already used for a different payment (`mismatched_fields` names what differs); nothing was held or sent. `attempt_id_unavailable`: another project of this organization holds this `attempt_id`; use a new one. */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -14931,7 +14973,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict";
+                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict" | "attempt_id_conflict" | "attempt_id_unavailable";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -15052,6 +15094,8 @@ export interface paths {
          *     3. The destination must be NAMED in a signed list of the mandate, and a merchant-list wildcard `"*"` NEVER authorizes money out. Which list is accepted is mid-rollout, so read this one carefully: the target rule is `withdrawal_allowlist` alone, and while the rollout flag is off a destination named explicitly in the signed `merchant_allowlist` is ALSO accepted, with the stricter rule's refusal recorded rather than applied. Tolerance never widens what passes: a wildcard is refused on both paths, and a destination in neither list is refused with its own code. Build against `withdrawal_allowlist`: it is the list that keeps working when the flag turns on.
          *
          *     **There is no read route for the outcome.** An `attempt_id` that answered `psp_dispatch_uncertain` has no endpoint to ask about afterwards. Keep the `attempt_id` and present it again: the lifecycle is idempotent on it and answers the state that attempt stopped in, instead of firing a second one. Do NOT restart the same intent under a fresh `attempt_id`. That is how a payment gets made twice. A retry of an attempt that already holds money is not evaluated against the organization's policy rules again, so a budget or a rate limit cannot refuse the retry that finds out what happened.
+         *
+         *     **A settled attempt answers its recorded response.** Presenting the `attempt_id` of an attempt that already settled, with the same amount, payee, mandate, rail and quote, returns the ORIGINAL 200 body verbatim (same `transactionId`, same receipt) with `idempotent_replay: true`, and nothing is dispatched, held, sealed or published. This holds on every rail and in test mode alike, and while the organization is paused, since the answer moves no money. Presenting it with any of those parameters changed is `attempt_id_conflict`. Idempotency is opt-in: a request without an `attempt_id` is its own payment and is never replayed, so two spends under one mandate are two payments. Send an `attempt_id` to make a retry safe.
          */
         post: {
             parameters: {
@@ -15128,7 +15172,7 @@ export interface paths {
                         };
                     };
                 };
-                /** @description Local state refuses, on the same three conditions as the by-id route. */
+                /** @description Local state refuses, on the same five conditions as the by-id route. */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -15137,7 +15181,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict";
+                                code: "psp_attempt_in_flight" | "psp_attempt_uncertain" | "psp_attempt_conflict" | "attempt_id_conflict" | "attempt_id_unavailable";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -15232,6 +15276,8 @@ export interface paths {
          *     The outcome is the same object the sibling route returns, carried on the last event. A client that does not need to follow progress should use `/execute`: streaming does not make settlement faster, it makes it observable while it runs.
          *
          *     **There is no read route for the outcome.** An `attempt_id` that answered `psp_dispatch_uncertain` has no endpoint to ask about afterwards. Keep the `attempt_id` and present it again: the lifecycle is idempotent on it and answers the state that attempt stopped in, instead of firing a second one. Do NOT restart the same intent under a fresh `attempt_id`. That is how a payment gets made twice. A retry of an attempt that already holds money is not evaluated against the organization's policy rules again, so a budget or a rate limit cannot refuse the retry that finds out what happened.
+         *
+         *     **A settled attempt answers its recorded response.** Presenting the `attempt_id` of an attempt that already settled, with the same amount, payee, mandate, rail and quote, returns the ORIGINAL 200 body verbatim (same `transactionId`, same receipt) with `idempotent_replay: true`, and nothing is dispatched, held, sealed or published. This holds on every rail and in test mode alike, and while the organization is paused, since the answer moves no money. Presenting it with any of those parameters changed is `attempt_id_conflict`. Idempotency is opt-in: a request without an `attempt_id` is its own payment and is never replayed, so two spends under one mandate are two payments. Send an `attempt_id` to make a retry safe.
          */
         post: {
             parameters: {
@@ -20430,7 +20476,7 @@ export interface paths {
         };
         /**
          * Read one consumer allowance
-         * @description The same 14-field projection the listing returns, by id, from the same table and under the same organization predicate.
+         * @description The same 14-field projection the listing returns, by id, from the same table and under the same organization predicate, plus `org_paused` / `org_paused_at`: whether the organization's kill switch is pressed (ent#1648).
          *
          *     This path has NO alias. Its four siblings are registered twice each, under `/v1/mandates/...` and `/v1/consumers/mandates/...`; this one is registered once, because point reads of an allowance did not exist before it and there was no older spelling to keep alive.
          */
@@ -20481,6 +20527,13 @@ export interface paths {
                             expires_at: string;
                             /** Format: date-time */
                             created_at: string;
+                            /** @description True while the organization has paused ALL agent spend (the kill switch, ent#1648). `status` is still this allowance's own stored state: a pause changes no mandate. While this is true every spend under this allowance is refused `org_paused`, so a caller that checks before executing should treat it as "do not execute" whatever `status` says. */
+                            org_paused: boolean;
+                            /**
+                             * Format: date-time
+                             * @description When the organization paused. Null when `org_paused` is false.
+                             */
+                            org_paused_at: string | null;
                         };
                     };
                 };
@@ -20995,7 +21048,11 @@ export interface paths {
                         };
                     };
                 };
-                /** @description The consent's current status does not permit this transition. `details.from` and `details.to` carry the pair. `pending` may become `authorised`, `revoked` or `expired`; `authorised` may become `revoked`, `expired` or `consumed`; `revoked`, `expired` and `consumed` are terminal and permit nothing. */
+                /**
+                 * @description `illegal_transition`: the consent's current status does not permit authorisation. `details.from` and `details.to` carry the pair.
+                 *
+                 *     `consent_expired`: the consent is `pending` and its validity window (`details.expires_at`) has elapsed. TERMINAL: the grant can no longer be authorised. The status stays `pending` on the row and is read as expired by this route, so it still occupies this project's one open consent for the consumer at this bank: revoke it, then initiate a new consent. Another project is not blocked by it.
+                 */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -21004,7 +21061,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "illegal_transition";
+                                code: "illegal_transition" | "consent_expired";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -21161,7 +21218,13 @@ export interface paths {
                         };
                     };
                 };
-                /** @description `consent_not_authorised`: the consent is not in `authorised`. `details.status` carries what it is. */
+                /**
+                 * @description `consent_not_authorised`: the consent is not in `authorised`. `details.status` carries what it is.
+                 *
+                 *     `consent_expired`: the consent's validity window (`details.expires_at`) has elapsed. The consent is moved to `expired` by this same call and nothing is fetched. TERMINAL: initiate a new consent.
+                 *
+                 *     `consent_token_expired`: the consent is still valid but its access token (`details.token_expires_at`) has expired. NOT terminal: the consent stays `authorised`, because the grant is alive at the bank and the token is renewable. Nothing was fetched; do not initiate a new consent.
+                 */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -21170,7 +21233,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "consent_not_authorised";
+                                code: "consent_not_authorised" | "consent_expired" | "consent_token_expired";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -22137,7 +22200,11 @@ export interface paths {
                         };
                     };
                 };
-                /** @description The consent's current status does not permit this transition. `details.from` and `details.to` carry the pair. `pending` may become `authorised`, `revoked` or `expired`; `authorised` may become `revoked`, `expired` or `consumed`; `revoked`, `expired` and `consumed` are terminal and permit nothing. */
+                /**
+                 * @description `illegal_transition`: the consent's current status does not permit authorisation. `details.from` and `details.to` carry the pair.
+                 *
+                 *     `consent_expired`: the consent is `pending` and its validity window (`details.expires_at`) has elapsed. TERMINAL: the grant can no longer be authorised. The status stays `pending` on the row and is read as expired by this route, so it still occupies this project's one open consent for the consumer at this bank: revoke it, then initiate a new consent. Another project is not blocked by it.
+                 */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -22146,7 +22213,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "illegal_transition";
+                                code: "illegal_transition" | "consent_expired";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -22298,7 +22365,13 @@ export interface paths {
                         };
                     };
                 };
-                /** @description `consent_not_authorised`: the consent is not in `authorised`. `details.status` carries what it is. */
+                /**
+                 * @description `consent_not_authorised`: the consent is not in `authorised`. `details.status` carries what it is.
+                 *
+                 *     `consent_expired`: the consent's validity window (`details.expires_at`) has elapsed. The consent is moved to `expired` by this same call and nothing is fetched. TERMINAL: initiate a new consent.
+                 *
+                 *     `consent_token_expired`: the consent is still valid but its access token (`details.token_expires_at`) has expired. NOT terminal: the consent stays `authorised`, because the grant is alive at the bank and the token is renewable. Nothing was fetched; do not initiate a new consent.
+                 */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -22307,7 +22380,7 @@ export interface paths {
                         "application/json": {
                             error: {
                                 /** @enum {string} */
-                                code: "consent_not_authorised";
+                                code: "consent_not_authorised" | "consent_expired" | "consent_token_expired";
                                 message: string;
                                 details?: {
                                     [key: string]: unknown;
@@ -25236,7 +25309,7 @@ export interface paths {
          * Issue an org-side mandate (off by default, see the 501)
          * @description OFF BY DEFAULT, AND THE FIRST THING THIS ROUTE DOES IS CHECK THAT. Unless the deployment has explicitly enabled org-side issuance, every call is 501 `not_implemented` before any row is written. On a default deployment that 501 is the expected answer, not an outage.
          *
-         *     TAKE THE FLAG AS THE GATE, NOT THE 501's SENTENCE AS THE STATE. The message on that 501 says the aggregate spend cap 'is not yet enforced by any spend path'. That sentence is older than the wallet gate and no longer describes the system: `POST /v1/wallets/{id}/execute` charges a mandate before the payment is attempted, decrements `remaining_amount` under a guard that refuses an over-cap spend, and writes the consumption row this document returns from `GET /v1/orgs/{orgId}/mandates/{id}`. So a mandate issued here is enforceable; whether it can be issued at all is the deployment's flag.
+         *     The 501 is about offering issuance, not about enforcement: `POST /v1/wallets/{id}/execute` charges a mandate before the payment is attempted, decrements `remaining_amount` under a guard that refuses an over-cap spend, and writes the consumption row this document returns from `GET /v1/orgs/{orgId}/mandates/{id}`. So a mandate issued here is enforceable; whether it can be issued at all is the deployment's flag.
          *
          *     When enabled, issuance is gated by the org's policy rules for `codespar:mandate:issue`, evaluated before any write. The three non-allowed outcomes are distinct on purpose: 403 `policy_denied` is a rule refusing, 413 `payload_too_large` is an input too big to evaluate, and 503 `policy_engine_error` means the engine could NOT evaluate. The 503 is infrastructure and is retriable; the 403 is not.
          *
@@ -25640,6 +25713,194 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs/{orgId}/pause": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read the organization kill switch
+         * @description Whether the organization has paused ALL agent spend. While `paused` is true every agent money door of the organization refuses with `org_paused` (403): consumer payments and spends under a mandate, payment links, consumer withdrawals and transfers, card authorizations, the money-moving meta-tool actions, the org programmable wallet, an inbound Pix devolution, and raw tools the deny-list classifies as a fund transfer. Reads, inbound charges, mandate revoke/pause and x402-in keep running. `GET /v1/mandates/{id}` carries the same flag as `org_paused`.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    orgId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            org_id: string;
+                            paused: boolean;
+                            /** Format: date-time */
+                            paused_at: string | null;
+                            /** @description Why it was paused; null when not paused. */
+                            reason: string | null;
+                            /** @description The admin's user id, or `key:<id>` for a bearer key. Null when not paused. */
+                            paused_by: string | null;
+                            /** @enum {string|null} */
+                            paused_by_source: "bearer_key" | "user_token_verified" | "header_asserted" | null;
+                            /**
+                             * Format: date-time
+                             * @description The last resume, kept after a new pause.
+                             */
+                            resumed_at: string | null;
+                            /** @description Increases by one on every pause and every resume. */
+                            generation: number;
+                        };
+                    };
+                };
+                /** @description The `{orgId}` in the path is not the authenticated org. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Pause all agent spend of the organization (kill switch)
+         * @description Stops every agent money door of the organization, test and live projects alike, until a person resumes it. Once this call answers, no new reservation is taken: a spend that already reserved its funds finishes, like an in-flight hold on a frozen wallet.
+         *
+         *     A bearer key needs the `organizations:pause` scope; the dashboard path needs an admin. Idempotent: pausing a paused organization answers `changed: false` and keeps the original pause. Resuming is NOT an API-key operation: it is done from the dashboard by a verified admin. Publishes `commerce.organization.paused` to every project of the organization and appends `org_spend_paused` to its audit chain.
+         *
+         *     Card authorizations are refused at the issuer that waits for our answer (Pomelo). Bridge decides before we hear of it: freeze those cards at the issuer as well.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    orgId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        reason?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description OK */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @description False when the organization was already in the requested state. */
+                            changed: boolean;
+                            pause: {
+                                org_id: string;
+                                paused: boolean;
+                                /** Format: date-time */
+                                paused_at: string | null;
+                                /** @description Why it was paused; null when not paused. */
+                                reason: string | null;
+                                /** @description The admin's user id, or `key:<id>` for a bearer key. Null when not paused. */
+                                paused_by: string | null;
+                                /** @enum {string|null} */
+                                paused_by_source: "bearer_key" | "user_token_verified" | "header_asserted" | null;
+                                /**
+                                 * Format: date-time
+                                 * @description The last resume, kept after a new pause.
+                                 */
+                                resumed_at: string | null;
+                                /** @description Increases by one on every pause and every resume. */
+                                generation: number;
+                            };
+                        };
+                    };
+                };
+                /** @description The body did not parse. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "invalid_body";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+                /** @description The dashboard path named no admin, or a token that did not verify. Bare `{ error, remediation }` body. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: string;
+                            remediation?: string;
+                        };
+                    };
+                };
+                /** @description The `{orgId}` in the path is not the authenticated org. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            error: {
+                                /** @enum {string} */
+                                code: "not_found";
+                                message: string;
+                                details?: {
+                                    [key: string]: unknown;
+                                };
+                            };
+                            /** @description Echoes the `X-Request-Id` header when the request carried one. */
+                            request_id: string | null;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/paywalls": {
         parameters: {
             query?: never;
@@ -36377,6 +36638,10 @@ export interface components {
             } | null;
             /** @description The lifecycle steps, in order, each with a timestamp and an outcome. */
             audit: unknown[];
+            /** @description The attempt this payment settled under: the `attempt_id` sent, or the fresh one minted when none was. Presenting it again reads this outcome instead of paying again. */
+            attempt_id: string;
+            /** @description True when this `attempt_id` had already settled and this is its recorded outcome, answered again: every other field is the ORIGINAL response, verbatim, and nothing was sent, held, sealed or published by this call. False on the call that settled it. */
+            idempotent_replay: boolean;
         };
         /** @description The destination of a TED, the Brazilian same-day bank wire. Present this object on a spend to send a wire instead of a Pix: its presence is what switches the rail, and what makes the three TED requirements on those operations bind. Money leaves the consumer's own sub-account, never a pooled one. */
         TedDestination: {