@credibledata/cred-cli 0.0.105 → 0.0.107

package/dist/client/api.js

@@ -25,10 +25,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PackagePermissionInheritedPermissionEnum = exports.PackagePermissionPermissionEnum = exports.OrganizationPermissionPermissionEnum = exports.MaterializationFreshnessFallbackEnum = exports.MaterializationScopeEnum = exports.MaterializationStatusEnum = exports.MaterializationOriginEnum = exports.LiveWorkItemStatusEnum = exports.IntegrationTemplateAuthEnum = exports.IntegrationSecretFieldShapeEnum = exports.IndexStatus = exports.IndexFreshnessFallbackEnum = exports.IndexScopeEnum = exports.IndexStatusEnum = exports.GroupMemberStatusEnum = exports.GetOrganizationResponseUserPermissionEnum = exports.EnvironmentPermissionPermissionEnum = exports.EnvironmentUserPermissionEnum = exports.DraftTreeEntryTypeEnum = exports.DraftPullRequestStateEnum = exports.DraftFileDiffStatusEnum = exports.DraftDocumentChangeStatusEnum = exports.DraftDocumentChangeSincePublicationEnum = exports.DraftDocumentStatusEnum = exports.DraftDocumentKindEnum = exports.DraftDocumentTypeEnum = exports.DraftCompileVerdictStatusEnum = exports.DraftCheckpointStatusEnum = exports.DraftBackingEnum = exports.DocumentTypeEnum = exports.DatabaseTableUploadMethodEnum = exports.DatabaseTableSourceKindEnum = exports.DatabaseTableFileFormatEnum = exports.DatabaseTableStatusEnum = exports.DatabaseTableSchemaEnum = exports.DatabaseIndexingStatusEnum = exports.DatabaseStatusEnum = exports.CredentialCheckOutcome = exports.ConnectionS3ConnectionProviderEnum = exports.ConnectionPostgresConnectionSslmodeEnum = exports.ConnectionAllOfProxyTypeEnum = exports.ConnectionAllOfDucklakeConnectionStorageS3ConnectionProviderEnum = exports.ConnectionAllOfDuckdbConnectionPostgresConnectionSslmodeEnum = exports.ConnectionAllOfDuckdbConnectionAzureConnectionAuthTypeEnum = exports.ConnectionAllOfDuckdbConnectionAttachedDatabasesTypeEnum = exports.ConnectionIndexingStatusEnum = exports.ConnectionTemplateEnum = exports.ConnectionTypeEnum = exports.BookmarkType = exports.AttributeValueEntryScopeEnum = void 0;
-exports.DraftsApiAxiosParamCreator = exports.UpdateDocumentUpdateMaskEnum = exports.DocumentsApi = exports.DocumentsApiFactory = exports.DocumentsApiFp = exports.DocumentsApiAxiosParamCreator = exports.DemoApi = exports.DemoApiFactory = exports.DemoApiFp = exports.DemoApiAxiosParamCreator = exports.DatabasesApi = exports.DatabasesApiFactory = exports.DatabasesApiFp = exports.DatabasesApiAxiosParamCreator = exports.CredentialsApi = exports.CredentialsApiFactory = exports.CredentialsApiFp = exports.CredentialsApiAxiosParamCreator = exports.ConnectionsApi = exports.ConnectionsApiFactory = exports.ConnectionsApiFp = exports.ConnectionsApiAxiosParamCreator = exports.BookmarksApi = exports.BookmarksApiFactory = exports.BookmarksApiFp = exports.BookmarksApiAxiosParamCreator = exports.AttributesApi = exports.AttributesApiFactory = exports.AttributesApiFp = exports.AttributesApiAxiosParamCreator = exports.WorkspacePermissionPermissionEnum = exports.WorkspaceWorkspaceTypeEnum = exports.VersionScopeEnum = exports.VersionBuildStatusEnum = exports.VersionArchiveStatusEnum = exports.UpdateGroupMemberStatusRequestStatusEnum = exports.UpdateDatabaseTableRequestUploadStatusEnum = exports.SystemPermissionPermissionEnum = exports.StalenessReason = exports.SourceEntityFieldTypeEnum = exports.SharedItemTypeEnum = exports.RunBuildPlanNodeArtifactEnum = exports.RunBuildPlanNodeStatusEnum = exports.RunBuildPlanNodeNodeTypeEnum = exports.RunStatusEnum = exports.RunTriggerEnum = exports.PreaggregateFreshnessFallbackEnum = exports.PreaggregateScopeEnum = exports.PreaggregateStatusEnum = exports.PackageWarningSeverityEnum = void 0;
-exports.PackagePermissionsApiFp = exports.PackagePermissionsApiAxiosParamCreator = exports.ListOrganizationsUserPermissionEnum = exports.OrganizationsApi = exports.OrganizationsApiFactory = exports.OrganizationsApiFp = exports.OrganizationsApiAxiosParamCreator = exports.OrganizationPermissionsApi = exports.OrganizationPermissionsApiFactory = exports.OrganizationPermissionsApiFp = exports.OrganizationPermissionsApiAxiosParamCreator = exports.MaterializationsApi = exports.MaterializationsApiFactory = exports.MaterializationsApiFp = exports.MaterializationsApiAxiosParamCreator = exports.InvitesApi = exports.InvitesApiFactory = exports.InvitesApiFp = exports.InvitesApiAxiosParamCreator = exports.IntegrationTemplatesApi = exports.IntegrationTemplatesApiFactory = exports.IntegrationTemplatesApiFp = exports.IntegrationTemplatesApiAxiosParamCreator = exports.IndexesApi = exports.IndexesApiFactory = exports.IndexesApiFp = exports.IndexesApiAxiosParamCreator = exports.GroupsApi = exports.GroupsApiFactory = exports.GroupsApiFp = exports.GroupsApiAxiosParamCreator = exports.GitRepositoryRegistrationsApi = exports.GitRepositoryRegistrationsApiFactory = exports.GitRepositoryRegistrationsApiFp = exports.GitRepositoryRegistrationsApiAxiosParamCreator = exports.EnvironmentsApi = exports.EnvironmentsApiFactory = exports.EnvironmentsApiFp = exports.EnvironmentsApiAxiosParamCreator = exports.EnvironmentPermissionsApi = exports.EnvironmentPermissionsApiFactory = exports.EnvironmentPermissionsApiFp = exports.EnvironmentPermissionsApiAxiosParamCreator = exports.EntitiesApi = exports.EntitiesApiFactory = exports.EntitiesApiFp = exports.EntitiesApiAxiosParamCreator = exports.DraftsApi = exports.DraftsApiFactory = exports.DraftsApiFp = void 0;
-exports.WorkspacesApi = exports.WorkspacesApiFactory = exports.WorkspacesApiFp = exports.WorkspacesApiAxiosParamCreator = exports.WorkspacePermissionsApi = exports.WorkspacePermissionsApiFactory = exports.WorkspacePermissionsApiFp = exports.WorkspacePermissionsApiAxiosParamCreator = exports.WebhooksApi = exports.WebhooksApiFactory = exports.WebhooksApiFp = exports.WebhooksApiAxiosParamCreator = exports.VersionsApi = exports.VersionsApiFactory = exports.VersionsApiFp = exports.VersionsApiAxiosParamCreator = exports.UsersApi = exports.UsersApiFactory = exports.UsersApiFp = exports.UsersApiAxiosParamCreator = exports.RunActionActionEnum = exports.RunsApi = exports.RunsApiFactory = exports.RunsApiFp = exports.RunsApiAxiosParamCreator = exports.PreaggregatesApi = exports.PreaggregatesApiFactory = exports.PreaggregatesApiFp = exports.PreaggregatesApiAxiosParamCreator = exports.PermissionsApi = exports.PermissionsApiFactory = exports.PermissionsApiFp = exports.PermissionsApiAxiosParamCreator = exports.PackagesApi = exports.PackagesApiFactory = exports.PackagesApiFp = exports.PackagesApiAxiosParamCreator = exports.PackagePermissionsApi = exports.PackagePermissionsApiFactory = void 0;
+exports.PreaggregateStatusEnum = exports.PackageWarningSeverityEnum = exports.PackagePermissionInheritedPermissionEnum = exports.PackagePermissionPermissionEnum = exports.OrganizationPermissionPermissionEnum = exports.MaterializationFreshnessFallbackEnum = exports.MaterializationScopeEnum = exports.MaterializationStatusEnum = exports.MaterializationOriginEnum = exports.LiveWorkItemStatusEnum = exports.IntegrationTemplateAuthEnum = exports.IntegrationSecretFieldShapeEnum = exports.IndexStatus = exports.IndexFreshnessFallbackEnum = exports.IndexScopeEnum = exports.IndexStatusEnum = exports.GroupMemberStatusEnum = exports.GetOrganizationResponseUserPermissionEnum = exports.EnvironmentPermissionPermissionEnum = exports.EnvironmentUserPermissionEnum = exports.DraftPullRequestStateEnum = exports.DraftDocumentChangeSincePublicationEnum = exports.DraftDocumentStatusEnum = exports.DraftDocumentKindEnum = exports.DraftDocumentTypeEnum = exports.DraftCompileVerdictStatusEnum = exports.DraftCheckpointStatusEnum = exports.DraftCapabilitiesPublishModesEnum = exports.DraftBackingEnum = exports.DocumentTypeEnum = exports.DatabaseTableUploadMethodEnum = exports.DatabaseTableSourceKindEnum = exports.DatabaseTableFileFormatEnum = exports.DatabaseTableStatusEnum = exports.DatabaseTableSchemaEnum = exports.DatabaseIndexingStatusEnum = exports.DatabaseStatusEnum = exports.CredentialCheckOutcome = exports.ConnectionS3ConnectionProviderEnum = exports.ConnectionPostgresConnectionSslmodeEnum = exports.ConnectionAllOfProxyTypeEnum = exports.ConnectionAllOfDucklakeConnectionStorageS3ConnectionProviderEnum = exports.ConnectionAllOfDuckdbConnectionPostgresConnectionSslmodeEnum = exports.ConnectionAllOfDuckdbConnectionAzureConnectionAuthTypeEnum = exports.ConnectionAllOfDuckdbConnectionAttachedDatabasesTypeEnum = exports.ConnectionIndexingStatusEnum = exports.ConnectionTemplateEnum = exports.ConnectionTypeEnum = exports.BookmarkType = exports.AttributeValueEntryScopeEnum = void 0;
+exports.DocumentsApi = exports.DocumentsApiFactory = exports.DocumentsApiFp = exports.DocumentsApiAxiosParamCreator = exports.DemoApi = exports.DemoApiFactory = exports.DemoApiFp = exports.DemoApiAxiosParamCreator = exports.DatabasesApi = exports.DatabasesApiFactory = exports.DatabasesApiFp = exports.DatabasesApiAxiosParamCreator = exports.CredentialsApi = exports.CredentialsApiFactory = exports.CredentialsApiFp = exports.CredentialsApiAxiosParamCreator = exports.ConnectionsApi = exports.ConnectionsApiFactory = exports.ConnectionsApiFp = exports.ConnectionsApiAxiosParamCreator = exports.BookmarksApi = exports.BookmarksApiFactory = exports.BookmarksApiFp = exports.BookmarksApiAxiosParamCreator = exports.AttributesApi = exports.AttributesApiFactory = exports.AttributesApiFp = exports.AttributesApiAxiosParamCreator = exports.AgentSchedulesApi = exports.AgentSchedulesApiFactory = exports.AgentSchedulesApiFp = exports.AgentSchedulesApiAxiosParamCreator = exports.WorkspacePermissionPermissionEnum = exports.WorkspaceWorkspaceTypeEnum = exports.VersionScopeEnum = exports.VersionBuildStatusEnum = exports.VersionArchiveStatusEnum = exports.UpdateGroupMemberStatusRequestStatusEnum = exports.UpdateDatabaseTableRequestUploadStatusEnum = exports.SystemPermissionPermissionEnum = exports.StalenessReason = exports.SourceEntityFieldTypeEnum = exports.SharedItemTypeEnum = exports.RunBuildPlanNodeArtifactEnum = exports.RunBuildPlanNodeStatusEnum = exports.RunBuildPlanNodeNodeTypeEnum = exports.RunStatusEnum = exports.RunTriggerEnum = exports.PreaggregateFreshnessFallbackEnum = exports.PreaggregateScopeEnum = void 0;
+exports.OrganizationPermissionsApiAxiosParamCreator = exports.MaterializationsApi = exports.MaterializationsApiFactory = exports.MaterializationsApiFp = exports.MaterializationsApiAxiosParamCreator = exports.MarketplaceSubscriptionsApi = exports.MarketplaceSubscriptionsApiFactory = exports.MarketplaceSubscriptionsApiFp = exports.MarketplaceSubscriptionsApiAxiosParamCreator = exports.MarketplaceSignupsApi = exports.MarketplaceSignupsApiFactory = exports.MarketplaceSignupsApiFp = exports.MarketplaceSignupsApiAxiosParamCreator = exports.InvitesApi = exports.InvitesApiFactory = exports.InvitesApiFp = exports.InvitesApiAxiosParamCreator = exports.IntegrationTemplatesApi = exports.IntegrationTemplatesApiFactory = exports.IntegrationTemplatesApiFp = exports.IntegrationTemplatesApiAxiosParamCreator = exports.IndexesApi = exports.IndexesApiFactory = exports.IndexesApiFp = exports.IndexesApiAxiosParamCreator = exports.GroupsApi = exports.GroupsApiFactory = exports.GroupsApiFp = exports.GroupsApiAxiosParamCreator = exports.GitRepositoryRegistrationsApi = exports.GitRepositoryRegistrationsApiFactory = exports.GitRepositoryRegistrationsApiFp = exports.GitRepositoryRegistrationsApiAxiosParamCreator = exports.EnvironmentsApi = exports.EnvironmentsApiFactory = exports.EnvironmentsApiFp = exports.EnvironmentsApiAxiosParamCreator = exports.EnvironmentPermissionsApi = exports.EnvironmentPermissionsApiFactory = exports.EnvironmentPermissionsApiFp = exports.EnvironmentPermissionsApiAxiosParamCreator = exports.EntitiesApi = exports.EntitiesApiFactory = exports.EntitiesApiFp = exports.EntitiesApiAxiosParamCreator = exports.DraftsApi = exports.DraftsApiFactory = exports.DraftsApiFp = exports.DraftsApiAxiosParamCreator = exports.UpdateDocumentUpdateMaskEnum = void 0;
+exports.WorkspacesApi = exports.WorkspacesApiFactory = exports.WorkspacesApiFp = exports.WorkspacesApiAxiosParamCreator = exports.WorkspacePermissionsApi = exports.WorkspacePermissionsApiFactory = exports.WorkspacePermissionsApiFp = exports.WorkspacePermissionsApiAxiosParamCreator = exports.WebhooksApi = exports.WebhooksApiFactory = exports.WebhooksApiFp = exports.WebhooksApiAxiosParamCreator = exports.VersionsApi = exports.VersionsApiFactory = exports.VersionsApiFp = exports.VersionsApiAxiosParamCreator = exports.UsersApi = exports.UsersApiFactory = exports.UsersApiFp = exports.UsersApiAxiosParamCreator = exports.RunActionActionEnum = exports.RunsApi = exports.RunsApiFactory = exports.RunsApiFp = exports.RunsApiAxiosParamCreator = exports.PreaggregatesApi = exports.PreaggregatesApiFactory = exports.PreaggregatesApiFp = exports.PreaggregatesApiAxiosParamCreator = exports.PermissionsApi = exports.PermissionsApiFactory = exports.PermissionsApiFp = exports.PermissionsApiAxiosParamCreator = exports.PackagesApi = exports.PackagesApiFactory = exports.PackagesApiFp = exports.PackagesApiAxiosParamCreator = exports.PackagePermissionsApi = exports.PackagePermissionsApiFactory = exports.PackagePermissionsApiFp = exports.PackagePermissionsApiAxiosParamCreator = exports.ListOrganizationsUserPermissionEnum = exports.OrganizationsApi = exports.OrganizationsApiFactory = exports.OrganizationsApiFp = exports.OrganizationsApiAxiosParamCreator = exports.OrganizationPermissionsApi = exports.OrganizationPermissionsApiFactory = exports.OrganizationPermissionsApiFp = void 0;
 const axios_1 = __importDefault(require("axios"));
 // Some imports not used depending on template conditions
 // @ts-ignore
@@ -179,6 +179,10 @@ exports.DraftBackingEnum = {
     Git: 'git',
     Provisioning: 'provisioning'
 };
+exports.DraftCapabilitiesPublishModesEnum = {
+    Direct: 'direct',
+    PullRequest: 'pullRequest'
+};
 exports.DraftCheckpointStatusEnum = {
     None: 'none',
     Pending: 'pending',
@@ -211,28 +215,12 @@ exports.DraftDocumentChangeSincePublicationEnum = {
     Modified: 'modified',
     Removed: 'removed'
 };
-exports.DraftDocumentChangeStatusEnum = {
-    Added: 'added',
-    Modified: 'modified',
-    Removed: 'removed',
-    Renamed: 'renamed'
-};
-exports.DraftFileDiffStatusEnum = {
-    Added: 'added',
-    Modified: 'modified',
-    Removed: 'removed',
-    Renamed: 'renamed'
-};
 exports.DraftPullRequestStateEnum = {
     None: 'none',
     Open: 'open',
     Closed: 'closed',
     Merged: 'merged'
 };
-exports.DraftTreeEntryTypeEnum = {
-    Blob: 'blob',
-    Tree: 'tree'
-};
 exports.EnvironmentUserPermissionEnum = {
     Admin: 'admin',
     Modeler: 'modeler',
@@ -428,6 +416,292 @@ exports.WorkspacePermissionPermissionEnum = {
     Manager: 'manager',
     Viewer: 'viewer'
 };
+/**
+ * AgentSchedulesApi - axios parameter creator
+ * @export
+ */
+const AgentSchedulesApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * Runs one task of a package agent on a cron schedule, at the package\'s latest version. Each fire is the turn the app\'s Run button sends, run as the person who created the schedule: the same access, budget and chat as if they had pressed it.  **Authorization**: Requires membership of the organization, managing the workspace (`can_update_workspace`) and the caller\'s own read access to the package (`can_read_package`).  **Cron**: exactly five whitespace-separated fields, evaluated in UTC, no `@nicknames`. The cron must have a future fire. There is no minimum interval and no limit per workspace; a run\'s cost is bounded by the organization\'s LLM budget and the agent\'s run caps.  **Refused** with `400`: an invalid `cron` (`invalid-cron`), an `agentName` that is not a lowercase hyphenated name of at most 64 characters (`VALIDATION_ERROR`), a `taskPath` or `taskTitle` that is empty or over 255 characters (`VALIDATION_ERROR`), a `taskPath` that is not `/`-separated segments of letters, digits, `.`, `_` and `-`, or that has a `.` or `..` segment (`VALIDATION_ERROR`), a `taskTitle` that is blank or holds a control character (`invalid-task-title`), and an environment draft package (`draft-package`). `403` from a caller that is not a person.
+         * @summary Schedule a package agent\'s task in a workspace
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {CreateAgentScheduleRequest} createAgentScheduleRequest
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createAgentSchedule: (organizationName_1, workspaceName_1, createAgentScheduleRequest_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, createAgentScheduleRequest_1, ...args_1], void 0, function* (organizationName, workspaceName, createAgentScheduleRequest, options = {}) {
+            // verify required parameter 'organizationName' is not null or undefined
+            (0, common_1.assertParamExists)('createAgentSchedule', 'organizationName', organizationName);
+            // verify required parameter 'workspaceName' is not null or undefined
+            (0, common_1.assertParamExists)('createAgentSchedule', 'workspaceName', workspaceName);
+            // verify required parameter 'createAgentScheduleRequest' is not null or undefined
+            (0, common_1.assertParamExists)('createAgentSchedule', 'createAgentScheduleRequest', createAgentScheduleRequest);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/agent-schedules`
+                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
+                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(createAgentScheduleRequest, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+        /**
+         * Deletes the schedule: it never fires again. A run already started is its creator\'s chat and carries on, and the chats it produced are kept.  **Authorization**: Requires reading the workspace, and either being the schedule\'s creator, managing the workspace (`can_update_workspace`) or administering the organization (`can_update_organization`).
+         * @summary Delete an agent schedule
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {string} scheduleId The unique identifier of the schedule
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteAgentSchedule: (organizationName_1, workspaceName_1, scheduleId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, scheduleId_1, ...args_1], void 0, function* (organizationName, workspaceName, scheduleId, options = {}) {
+            // verify required parameter 'organizationName' is not null or undefined
+            (0, common_1.assertParamExists)('deleteAgentSchedule', 'organizationName', organizationName);
+            // verify required parameter 'workspaceName' is not null or undefined
+            (0, common_1.assertParamExists)('deleteAgentSchedule', 'workspaceName', workspaceName);
+            // verify required parameter 'scheduleId' is not null or undefined
+            (0, common_1.assertParamExists)('deleteAgentSchedule', 'scheduleId', scheduleId);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/agent-schedules/{scheduleId}`
+                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
+                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
+                .replace(`{${"scheduleId"}}`, encodeURIComponent(String(scheduleId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'DELETE' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+        /**
+         * Lists the workspace\'s schedules, oldest first, each with its last fire\'s session id as `lastSessionId`.  **Authorization**: Requires read access to the workspace.  **Pagination**: `limit` / `offset` with `Total-Count` and `Link`.
+         * @summary List a workspace\'s agent schedules
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
+         * @param {number} [offset] Number of items to skip before starting to return results
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAgentSchedules: (organizationName_1, workspaceName_1, limit_1, offset_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, limit_1, offset_1, ...args_1], void 0, function* (organizationName, workspaceName, limit, offset, options = {}) {
+            // verify required parameter 'organizationName' is not null or undefined
+            (0, common_1.assertParamExists)('listAgentSchedules', 'organizationName', organizationName);
+            // verify required parameter 'workspaceName' is not null or undefined
+            (0, common_1.assertParamExists)('listAgentSchedules', 'workspaceName', workspaceName);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/agent-schedules`
+                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
+                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            if (limit !== undefined) {
+                localVarQueryParameter['limit'] = limit;
+            }
+            if (offset !== undefined) {
+                localVarQueryParameter['offset'] = offset;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+    };
+};
+exports.AgentSchedulesApiAxiosParamCreator = AgentSchedulesApiAxiosParamCreator;
+/**
+ * AgentSchedulesApi - functional programming interface
+ * @export
+ */
+const AgentSchedulesApiFp = function (configuration) {
+    const localVarAxiosParamCreator = (0, exports.AgentSchedulesApiAxiosParamCreator)(configuration);
+    return {
+        /**
+         * Runs one task of a package agent on a cron schedule, at the package\'s latest version. Each fire is the turn the app\'s Run button sends, run as the person who created the schedule: the same access, budget and chat as if they had pressed it.  **Authorization**: Requires membership of the organization, managing the workspace (`can_update_workspace`) and the caller\'s own read access to the package (`can_read_package`).  **Cron**: exactly five whitespace-separated fields, evaluated in UTC, no `@nicknames`. The cron must have a future fire. There is no minimum interval and no limit per workspace; a run\'s cost is bounded by the organization\'s LLM budget and the agent\'s run caps.  **Refused** with `400`: an invalid `cron` (`invalid-cron`), an `agentName` that is not a lowercase hyphenated name of at most 64 characters (`VALIDATION_ERROR`), a `taskPath` or `taskTitle` that is empty or over 255 characters (`VALIDATION_ERROR`), a `taskPath` that is not `/`-separated segments of letters, digits, `.`, `_` and `-`, or that has a `.` or `..` segment (`VALIDATION_ERROR`), a `taskTitle` that is blank or holds a control character (`invalid-task-title`), and an environment draft package (`draft-package`). `403` from a caller that is not a person.
+         * @summary Schedule a package agent\'s task in a workspace
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {CreateAgentScheduleRequest} createAgentScheduleRequest
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createAgentSchedule(organizationName, workspaceName, createAgentScheduleRequest, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.createAgentSchedule(organizationName, workspaceName, createAgentScheduleRequest, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['AgentSchedulesApi.createAgentSchedule']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+        /**
+         * Deletes the schedule: it never fires again. A run already started is its creator\'s chat and carries on, and the chats it produced are kept.  **Authorization**: Requires reading the workspace, and either being the schedule\'s creator, managing the workspace (`can_update_workspace`) or administering the organization (`can_update_organization`).
+         * @summary Delete an agent schedule
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {string} scheduleId The unique identifier of the schedule
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteAgentSchedule(organizationName, workspaceName, scheduleId, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.deleteAgentSchedule(organizationName, workspaceName, scheduleId, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['AgentSchedulesApi.deleteAgentSchedule']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+        /**
+         * Lists the workspace\'s schedules, oldest first, each with its last fire\'s session id as `lastSessionId`.  **Authorization**: Requires read access to the workspace.  **Pagination**: `limit` / `offset` with `Total-Count` and `Link`.
+         * @summary List a workspace\'s agent schedules
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
+         * @param {number} [offset] Number of items to skip before starting to return results
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAgentSchedules(organizationName, workspaceName, limit, offset, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.listAgentSchedules(organizationName, workspaceName, limit, offset, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['AgentSchedulesApi.listAgentSchedules']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+    };
+};
+exports.AgentSchedulesApiFp = AgentSchedulesApiFp;
+/**
+ * AgentSchedulesApi - factory interface
+ * @export
+ */
+const AgentSchedulesApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = (0, exports.AgentSchedulesApiFp)(configuration);
+    return {
+        /**
+         * Runs one task of a package agent on a cron schedule, at the package\'s latest version. Each fire is the turn the app\'s Run button sends, run as the person who created the schedule: the same access, budget and chat as if they had pressed it.  **Authorization**: Requires membership of the organization, managing the workspace (`can_update_workspace`) and the caller\'s own read access to the package (`can_read_package`).  **Cron**: exactly five whitespace-separated fields, evaluated in UTC, no `@nicknames`. The cron must have a future fire. There is no minimum interval and no limit per workspace; a run\'s cost is bounded by the organization\'s LLM budget and the agent\'s run caps.  **Refused** with `400`: an invalid `cron` (`invalid-cron`), an `agentName` that is not a lowercase hyphenated name of at most 64 characters (`VALIDATION_ERROR`), a `taskPath` or `taskTitle` that is empty or over 255 characters (`VALIDATION_ERROR`), a `taskPath` that is not `/`-separated segments of letters, digits, `.`, `_` and `-`, or that has a `.` or `..` segment (`VALIDATION_ERROR`), a `taskTitle` that is blank or holds a control character (`invalid-task-title`), and an environment draft package (`draft-package`). `403` from a caller that is not a person.
+         * @summary Schedule a package agent\'s task in a workspace
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {CreateAgentScheduleRequest} createAgentScheduleRequest
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createAgentSchedule(organizationName, workspaceName, createAgentScheduleRequest, options) {
+            return localVarFp.createAgentSchedule(organizationName, workspaceName, createAgentScheduleRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Deletes the schedule: it never fires again. A run already started is its creator\'s chat and carries on, and the chats it produced are kept.  **Authorization**: Requires reading the workspace, and either being the schedule\'s creator, managing the workspace (`can_update_workspace`) or administering the organization (`can_update_organization`).
+         * @summary Delete an agent schedule
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {string} scheduleId The unique identifier of the schedule
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        deleteAgentSchedule(organizationName, workspaceName, scheduleId, options) {
+            return localVarFp.deleteAgentSchedule(organizationName, workspaceName, scheduleId, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Lists the workspace\'s schedules, oldest first, each with its last fire\'s session id as `lastSessionId`.  **Authorization**: Requires read access to the workspace.  **Pagination**: `limit` / `offset` with `Total-Count` and `Link`.
+         * @summary List a workspace\'s agent schedules
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
+         * @param {number} [offset] Number of items to skip before starting to return results
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAgentSchedules(organizationName, workspaceName, limit, offset, options) {
+            return localVarFp.listAgentSchedules(organizationName, workspaceName, limit, offset, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+exports.AgentSchedulesApiFactory = AgentSchedulesApiFactory;
+/**
+ * AgentSchedulesApi - object-oriented interface
+ * @export
+ * @class AgentSchedulesApi
+ * @extends {BaseAPI}
+ */
+class AgentSchedulesApi extends base_1.BaseAPI {
+    /**
+     * Runs one task of a package agent on a cron schedule, at the package\'s latest version. Each fire is the turn the app\'s Run button sends, run as the person who created the schedule: the same access, budget and chat as if they had pressed it.  **Authorization**: Requires membership of the organization, managing the workspace (`can_update_workspace`) and the caller\'s own read access to the package (`can_read_package`).  **Cron**: exactly five whitespace-separated fields, evaluated in UTC, no `@nicknames`. The cron must have a future fire. There is no minimum interval and no limit per workspace; a run\'s cost is bounded by the organization\'s LLM budget and the agent\'s run caps.  **Refused** with `400`: an invalid `cron` (`invalid-cron`), an `agentName` that is not a lowercase hyphenated name of at most 64 characters (`VALIDATION_ERROR`), a `taskPath` or `taskTitle` that is empty or over 255 characters (`VALIDATION_ERROR`), a `taskPath` that is not `/`-separated segments of letters, digits, `.`, `_` and `-`, or that has a `.` or `..` segment (`VALIDATION_ERROR`), a `taskTitle` that is blank or holds a control character (`invalid-task-title`), and an environment draft package (`draft-package`). `403` from a caller that is not a person.
+     * @summary Schedule a package agent\'s task in a workspace
+     * @param {string} organizationName The unique identifier of the organization
+     * @param {string} workspaceName The unique identifier of the workspace
+     * @param {CreateAgentScheduleRequest} createAgentScheduleRequest
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AgentSchedulesApi
+     */
+    createAgentSchedule(organizationName, workspaceName, createAgentScheduleRequest, options) {
+        return (0, exports.AgentSchedulesApiFp)(this.configuration).createAgentSchedule(organizationName, workspaceName, createAgentScheduleRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Deletes the schedule: it never fires again. A run already started is its creator\'s chat and carries on, and the chats it produced are kept.  **Authorization**: Requires reading the workspace, and either being the schedule\'s creator, managing the workspace (`can_update_workspace`) or administering the organization (`can_update_organization`).
+     * @summary Delete an agent schedule
+     * @param {string} organizationName The unique identifier of the organization
+     * @param {string} workspaceName The unique identifier of the workspace
+     * @param {string} scheduleId The unique identifier of the schedule
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AgentSchedulesApi
+     */
+    deleteAgentSchedule(organizationName, workspaceName, scheduleId, options) {
+        return (0, exports.AgentSchedulesApiFp)(this.configuration).deleteAgentSchedule(organizationName, workspaceName, scheduleId, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Lists the workspace\'s schedules, oldest first, each with its last fire\'s session id as `lastSessionId`.  **Authorization**: Requires read access to the workspace.  **Pagination**: `limit` / `offset` with `Total-Count` and `Link`.
+     * @summary List a workspace\'s agent schedules
+     * @param {string} organizationName The unique identifier of the organization
+     * @param {string} workspaceName The unique identifier of the workspace
+     * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
+     * @param {number} [offset] Number of items to skip before starting to return results
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AgentSchedulesApi
+     */
+    listAgentSchedules(organizationName, workspaceName, limit, offset, options) {
+        return (0, exports.AgentSchedulesApiFp)(this.configuration).listAgentSchedules(organizationName, workspaceName, limit, offset, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+exports.AgentSchedulesApi = AgentSchedulesApi;
 /**
  * AttributesApi - axios parameter creator
  * @export
@@ -3617,10 +3891,11 @@ const DocumentsApiAxiosParamCreator = function (configuration) {
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {boolean} [retrieveContent] If true, include the document content in the response. Defaults to false.
+         * @param {string} [pathPrefix] List only the documents whose path starts with this string, matched literally (`%` and `_` are not wildcards). A draft\'s files are `drafts/{draftId}/`, so a caller that wants one draft\'s files reads those rather than the whole workspace. Omitted, every document is listed.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDocuments: (organizationName_1, workspaceName_1, retrieveContent_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, retrieveContent_1, ...args_1], void 0, function* (organizationName, workspaceName, retrieveContent, options = {}) {
+        listDocuments: (organizationName_1, workspaceName_1, retrieveContent_1, pathPrefix_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, retrieveContent_1, pathPrefix_1, ...args_1], void 0, function* (organizationName, workspaceName, retrieveContent, pathPrefix, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
             (0, common_1.assertParamExists)('listDocuments', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
@@ -3640,6 +3915,9 @@ const DocumentsApiAxiosParamCreator = function (configuration) {
             if (retrieveContent !== undefined) {
                 localVarQueryParameter['retrieveContent'] = retrieveContent;
             }
+            if (pathPrefix !== undefined) {
+                localVarQueryParameter['pathPrefix'] = pathPrefix;
+            }
             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
@@ -3772,13 +4050,14 @@ const DocumentsApiFp = function (configuration) {
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {boolean} [retrieveContent] If true, include the document content in the response. Defaults to false.
+         * @param {string} [pathPrefix] List only the documents whose path starts with this string, matched literally (`%` and `_` are not wildcards). A draft\'s files are `drafts/{draftId}/`, so a caller that wants one draft\'s files reads those rather than the whole workspace. Omitted, every document is listed.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDocuments(organizationName, workspaceName, retrieveContent, options) {
+        listDocuments(organizationName, workspaceName, retrieveContent, pathPrefix, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.listDocuments(organizationName, workspaceName, retrieveContent, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.listDocuments(organizationName, workspaceName, retrieveContent, pathPrefix, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
                 const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DocumentsApi.listDocuments']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
@@ -3861,11 +4140,12 @@ const DocumentsApiFactory = function (configuration, basePath, axios) {
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {boolean} [retrieveContent] If true, include the document content in the response. Defaults to false.
+         * @param {string} [pathPrefix] List only the documents whose path starts with this string, matched literally (`%` and `_` are not wildcards). A draft\'s files are `drafts/{draftId}/`, so a caller that wants one draft\'s files reads those rather than the whole workspace. Omitted, every document is listed.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDocuments(organizationName, workspaceName, retrieveContent, options) {
-            return localVarFp.listDocuments(organizationName, workspaceName, retrieveContent, options).then((request) => request(axios, basePath));
+        listDocuments(organizationName, workspaceName, retrieveContent, pathPrefix, options) {
+            return localVarFp.listDocuments(organizationName, workspaceName, retrieveContent, pathPrefix, options).then((request) => request(axios, basePath));
         },
         /**
          * Updates the content and metadata of an existing document within the workspace.  **Authorization**: `can_create_document` in the workspace (its managers, and its members who belong to the organization). Anything in a draft (`drafts/{draftId}` and every path under it) additionally takes `can_create_package` on the environment its manifest names, so a member who is not a modeler there cannot change a colleague\'s draft. When the REQUEST BODY\'s `type` is `draft_package`, the environment named by its `metadata.target_env` must additionally grant the caller `can_create_package` — the same bar `createDocument` applies, checked here on the incoming type because this operation ASSIGNS the type from the body: without it, converting any writable document into a `draft_package` would reach the modeling surface. A missing or blank `metadata.target_env` is refused. This narrows the existing 403; it is not a new status. **Content**: Supports updating document content, type, and other properties.  Refuses with `400` (`draft-notebook-read-only`) when the path is a `.malloynb` file inside a draft (`drafts/{draftId}/...`) and the write would change it or add a new one to a draft that already has files, whatever the request\'s `type`. See `writeDraftDocument`.  **Precondition**: `expectedUpdatedAt` is the `updatedAt` the writer read the document at. When sent, the write applies only if the document still carries that `updatedAt` (compared to the millisecond), else `409` `stale-document` and nothing is written; the check and the write hold the row lock together, so of two writers holding the same value exactly one wins. Absent, the write is last-writer-wins as it has always been.  **Partial update**: `updateMask=metadata` writes only the body\'s `metadata`. The stored `type` and `content` are kept whatever the body carries, so a caller changing metadata need not read or resend the content, and the response omits `content`. Every check above applies, against the stored type. Absent, the body replaces type, content and metadata.  **A public-link visitor** changes a document of theirs only while the package it is about (metadata `visitor_package`) is still public to them; otherwise 403. `visitor_package` is controlplane\'s: an update cannot change or remove it.
@@ -3941,12 +4221,13 @@ class DocumentsApi extends base_1.BaseAPI {
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {boolean} [retrieveContent] If true, include the document content in the response. Defaults to false.
+     * @param {string} [pathPrefix] List only the documents whose path starts with this string, matched literally (`%` and `_` are not wildcards). A draft\'s files are `drafts/{draftId}/`, so a caller that wants one draft\'s files reads those rather than the whole workspace. Omitted, every document is listed.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DocumentsApi
      */
-    listDocuments(organizationName, workspaceName, retrieveContent, options) {
-        return (0, exports.DocumentsApiFp)(this.configuration).listDocuments(organizationName, workspaceName, retrieveContent, options).then((request) => request(this.axios, this.basePath));
+    listDocuments(organizationName, workspaceName, retrieveContent, pathPrefix, options) {
+        return (0, exports.DocumentsApiFp)(this.configuration).listDocuments(organizationName, workspaceName, retrieveContent, pathPrefix, options).then((request) => request(this.axios, this.basePath));
     }
     /**
      * Updates the content and metadata of an existing document within the workspace.  **Authorization**: `can_create_document` in the workspace (its managers, and its members who belong to the organization). Anything in a draft (`drafts/{draftId}` and every path under it) additionally takes `can_create_package` on the environment its manifest names, so a member who is not a modeler there cannot change a colleague\'s draft. When the REQUEST BODY\'s `type` is `draft_package`, the environment named by its `metadata.target_env` must additionally grant the caller `can_create_package` — the same bar `createDocument` applies, checked here on the incoming type because this operation ASSIGNS the type from the body: without it, converting any writable document into a `draft_package` would reach the modeling surface. A missing or blank `metadata.target_env` is refused. This narrows the existing 403; it is not a new status. **Content**: Supports updating document content, type, and other properties.  Refuses with `400` (`draft-notebook-read-only`) when the path is a `.malloynb` file inside a draft (`drafts/{draftId}/...`) and the write would change it or add a new one to a draft that already has files, whatever the request\'s `type`. See `writeDraftDocument`.  **Precondition**: `expectedUpdatedAt` is the `updatedAt` the writer read the document at. When sent, the write applies only if the document still carries that `updatedAt` (compared to the millisecond), else `409` `stale-document` and nothing is written; the check and the write hold the row lock together, so of two writers holding the same value exactly one wins. Absent, the write is last-writer-wins as it has always been.  **Partial update**: `updateMask=metadata` writes only the body\'s `metadata`. The stored `type` and `content` are kept whatever the body carries, so a caller changing metadata need not read or resend the content, and the response omits `content`. Every check above applies, against the stored type. Absent, the body replaces type, content and metadata.  **A public-link visitor** changes a document of theirs only while the package it is about (metadata `visitor_package`) is still public to them; otherwise 403. `visitor_package` is controlplane\'s: an update cannot change or remove it.
@@ -3979,7 +4260,7 @@ exports.UpdateDocumentUpdateMaskEnum = {
 const DraftsApiAxiosParamCreator = function (configuration) {
     return {
         /**
-         * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  **A git-backed draft\'s branch is created here too.** In a git-enrolled environment this provisions the branch and records the binding — repository, branch, package directory, base branch — before returning, so a caller either gets a complete draft or gets none. Assembled afterwards by separate writers there is no transaction to hold them together, and a failure part-way leaves a draft naming a branch that does not exist.  The binding is **not alterable through update, move or create** afterwards: the checkpoint collector resolves the subtree from `packagePath` and a merge\'s auto-publish resolves the owning environment from `git.environment`, so changing either would orphan what is already committed. Through the documents API, a request that introduces, removes or alters the binding or the draft\'s target answers `409 draft-binding-immutable`; a request that omits `git` keeps the stored block. Deleting the draft is still how a bound manifest goes away.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
+         * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  Every draft is a document-store draft, in a git-enrolled environment as in any other: the draft\'s files are workspace documents, and git is only where a pushed draft goes for review.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
          * @summary Create a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4017,7 +4298,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2). Branch removal was inherited from the document model — documents are deletable, so a draft\'s branch looked like it had to go too — and every failure mode of that obligation had to be handled. Git\'s model is the opposite: branches accumulate and tidying is a convenience. Once a draft has had a pull request, GitHub retains `refs/pull/N/head` permanently, so deleting the branch would not remove the content anyway. Removing a branch is `DELETE .../drafts/{draftId}/branch`, and the one case worth tidying — a branch nothing was ever committed to — is the caller\'s to decide. The other case is server-side: a successful publish closes the draft and deletes its branch with it (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
+         * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch usually lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2), with one server-side exception: a draft that was never published and still sits at its seed commit has its branch deleted first, best-effort, so a draft minted from a misread intent leaves nothing behind. The delete is pinned to the seed commit, so a commit that landed since keeps the branch; the pin is not a compare-and-swap, so a commit landing in the instant between the gateway\'s tip re-read and its delete is lost. A failed branch delete never blocks the draft\'s delete, and retrying after a partial failure finds the branch already gone. Every other branch is removed by `DELETE .../drafts/{draftId}/branch`, or by the close after a successful publish (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
          * @summary Delete a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4054,7 +4335,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo. See `listDraftCommits` for the auth-forwarding notes.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  One product path calls this, and only one: since the 2026-08-15 \"branches live on\" decision (docs/git-synced-modeling.md §7.2) deleting a draft deletes the manifest and leaves the branch, so the agent\'s `delete_file` cascade makes no branch call at all, and the app\'s delete tidies the branch only for a draft nothing was ever committed to (the §7.2 amendment of 2026-08-24). Otherwise it is the primitive operator tooling needs — see docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
+         * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo, forwarding the caller\'s own bearer token.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  Stays as the primitive operator tooling needs: `deleteDraft` deletes an untouched draft\'s branch at its seed commit on the server (docs/git-synced-modeling.md §7.2), so neither the app nor the agent needs to call this. See docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
          * @summary Delete a git-backed draft\'s branch
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4091,18 +4372,18 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Removes a document from the draft, whichever storage backs it. On a git-backed draft this is a commit that deletes the file, under the same precondition a write takes; on a document-store draft it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
+         * Removes a document from the draft: it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
          * @summary Delete one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The document\'s path relative to the draft root
-         * @param {string} [expectedRef] The branch head the caller read at. For a text document on a git-backed draft it is required; for a data file there it is ignored, since a data file\'s delete is not a commit. Refused for a document-store draft, data file or not — there is no commit to compare it against. See `writeDraftDocument` for why it is the branch head rather than the document\'s own sha.
-         * @param {string} [expectedSha] The `sha` the caller read the document at. Document-store drafts only, refused for a git-backed one: the delete applies only if the document still holds that version, else `409` `draft-document-stale`.
+         * @param {string} [expectedSha] The `sha` the caller read the document at: the delete applies only if the document still holds that version, else `409` `draft-document-stale`; a file already gone counts as deleted when this is the whole request, so a lost response can be resent.
+         * @param {string} [expectedRef] Deprecated: use `expectedSha`. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        deleteDraftDocument: (organizationName_1, workspaceName_1, draftId_1, documentPath_1, expectedRef_1, expectedSha_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, documentPath_1, expectedRef_1, expectedSha_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options = {}) {
+        deleteDraftDocument: (organizationName_1, workspaceName_1, draftId_1, documentPath_1, expectedSha_1, expectedRef_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, documentPath_1, expectedSha_1, expectedRef_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
             (0, common_1.assertParamExists)('deleteDraftDocument', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
@@ -4125,12 +4406,12 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = Object.assign(Object.assign({ method: 'DELETE' }, baseOptions), options);
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
-            if (expectedRef !== undefined) {
-                localVarQueryParameter['expectedRef'] = expectedRef;
-            }
             if (expectedSha !== undefined) {
                 localVarQueryParameter['expectedSha'] = expectedSha;
             }
+            if (expectedRef !== undefined) {
+                localVarQueryParameter['expectedRef'] = expectedRef;
+            }
             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
@@ -4140,13 +4421,13 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. `expectedRef` is optional   here, as it is absent on a data file\'s delete: when given on a git-backed draft, the   commit that writes a small published copy back builds on it (`409   draft-file-stale-head` if the branch has moved since), and on the branch\'s current   head when it is not given. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included; `503` `draft-changes-unavailable` when its changes could not be compared with its publication.  **Authorization** — the same pair `writeDraftDocument` takes.
+         * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included. Before any change is found, the comparison itself can be refused, with the answers a read of the baseline gives: `403` when the caller cannot read the package the draft is measured against, `409` `draft-publication-baseline-missing` when that baseline cannot be measured (a corrupt archive), and `503` `draft-changes-unavailable` when it could not be read.  **Authorization** — the same pair `writeDraftDocument` takes.
          * @summary Restore one of a draft\'s files to its published copy
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The file\'s path relative to the draft root
-         * @param {string} [expectedRef] The branch head the caller read at, for a git-backed draft where the restore is a commit: required for a text file, optional for a data file (used as the compare-and-swap base when a small published copy is written back as a document); refused for a document-store draft.
+         * @param {string} [expectedRef] Deprecated: a restore takes no precondition. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -4222,22 +4503,22 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * The branch a git-backed draft\'s files live on, and where it currently points. The tip is a property of the branch, so it is read from the branch rather than from an endpoint of its own.  Thin proxy to the code-assist git-gateway\'s `getDraftHead` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user.  NOT `listDraftCommits(limit=1)`\'s `sha`: that read is filtered to the draft\'s own package subtree, so a commit that lands on the branch without touching it (e.g. `syncDraftBranch`) never advances it — a caller building a checkpoint\'s `expectedHeadSha` from that filtered read can 409 against the real, unfiltered CAS forever. This endpoint returns that real tip.  **Authorization**: Requires read access to the draft document (enforced by the gateway) — the same bar `listDraftCommits` and `getDraftDocument` take.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary The draft\'s branch
+         * The draft\'s capabilities, derived by the server from its environment and what its package has published. The same value `getDraft` carries as `capabilities`, for a caller that does not need the rest of the draft: it reads the draft\'s manifest, its review state and one published-version lookup, not the checkpoint or the files.  A draft that is moving to the new store answers `409` `draft-converting`: retry.  **Authorization**: requires read access to the draft document.
+         * @summary What the draft\'s storage can do
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftBranch: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
+        getDraftCapabilities: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftBranch', 'organizationName', organizationName);
+            (0, common_1.assertParamExists)('getDraftCapabilities', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftBranch', 'workspaceName', workspaceName);
+            (0, common_1.assertParamExists)('getDraftCapabilities', 'workspaceName', workspaceName);
             // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftBranch', 'draftId', draftId);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/branch`
+            (0, common_1.assertParamExists)('getDraftCapabilities', 'draftId', draftId);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/capabilities`
                 .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
                 .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
                 .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
@@ -4296,30 +4577,65 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * The documents that differ between `base` and `head`, each with how it changed and, where the gateway supplies one, its patch.  Its own resource rather than a mode of the document listing: the listing already reports each document against the draft\'s last publication (`changeSincePublication`), and this answers what moved between any two commits — the History tab\'s question. An entry here can name two paths at once (`renamed`), and folding commit-to-commit diffs into the listing would mean an item schema whose fields were populated or `null` depending on which query parameters the caller happened to send.  **Git-backed drafts only.** A document-store draft has no commits to compare, so the question does not apply to it rather than having no answer: it is a `400` `draft-not-git-backed`, the same refusal every git-only draft operation gives, and `409` `draft-provisioning` while the branch is still being cut. The `422` below is the gateway\'s own, for an environment that is not provisioned.  **Authorization**: requires read access to the draft document, the same bar as the document listing.
-         * @summary What changed between two commits of a draft
+         * One entry of `getDraftConflicts` with the incoming side\'s, the draft\'s and their common ancestor\'s version of the file, so the caller can reconcile them and write the result through `writeDraftDocuments` with the `conflictSha` this returns.  **Authorization**: requires read access to the draft document, and `can_create_package` on the environment it targets: only a modeler can act on what this serves.  `404` when the path has no conflict (it was resolved, or never conflicted).
+         * @summary One conflicting file, with all three of its versions
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
-         * @param {string} base The commit to compare FROM. A full 40-character sha reachable from the draft\'s branch.
-         * @param {string} head The commit to compare TO. Same form as `base`.
-         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
+         * @param {string} documentPath The conflicting file\'s path relative to the draft root, as `getDraftConflicts` lists it.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getDraftConflict: (organizationName_1, workspaceName_1, draftId_1, documentPath_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, documentPath_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, documentPath, options = {}) {
+            // verify required parameter 'organizationName' is not null or undefined
+            (0, common_1.assertParamExists)('getDraftConflict', 'organizationName', organizationName);
+            // verify required parameter 'workspaceName' is not null or undefined
+            (0, common_1.assertParamExists)('getDraftConflict', 'workspaceName', workspaceName);
+            // verify required parameter 'draftId' is not null or undefined
+            (0, common_1.assertParamExists)('getDraftConflict', 'draftId', draftId);
+            // verify required parameter 'documentPath' is not null or undefined
+            (0, common_1.assertParamExists)('getDraftConflict', 'documentPath', documentPath);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/conflicts/{documentPath}`
+                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
+                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
+                .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)))
+                .replace(`{${"documentPath"}}`, encodeURIComponent(String(documentPath)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+        /**
+         * A page of the draft\'s conflicts: every path both the draft and what came in changed since their common ancestor, where what came in is a newer published version of its package (the base moved) or a commit someone pushed to its pull request. A superset of what cannot merge on its own, because nothing here runs a merge. Ordered by `relpath`.  Each entry says where its incoming side came from, and carries the `conflictSha` a resolution sends back through `writeDraftDocuments`, a member per file. `getDraftConflict` returns one file\'s three versions.  An empty list means nothing waits on the author: what only one side changed is absorbed in the background. Conflicts never block editing or a Submit; a submitted draft\'s push waits for the last one to be resolved and then starts on its own.  Served from controlplane\'s record alone: no file content, no archive read and no GitHub call.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary The files the draft and what came in both changed
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {string} draftId The draft package identifier
+         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
          * @param {number} [offset] Number of items to skip before starting to return results
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftComparison: (organizationName_1, workspaceName_1, draftId_1, base_2, head_1, limit_1, offset_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, base_2, head_1, limit_1, offset_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, base, head, limit, offset, options = {}) {
+        getDraftConflicts: (organizationName_1, workspaceName_1, draftId_1, limit_1, offset_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, limit_1, offset_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, limit, offset, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftComparison', 'organizationName', organizationName);
+            (0, common_1.assertParamExists)('getDraftConflicts', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftComparison', 'workspaceName', workspaceName);
+            (0, common_1.assertParamExists)('getDraftConflicts', 'workspaceName', workspaceName);
             // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftComparison', 'draftId', draftId);
-            // verify required parameter 'base' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftComparison', 'base', base);
-            // verify required parameter 'head' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftComparison', 'head', head);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/comparison`
+            (0, common_1.assertParamExists)('getDraftConflicts', 'draftId', draftId);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/conflicts`
                 .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
                 .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
                 .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
@@ -4332,12 +4648,6 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
-            if (base !== undefined) {
-                localVarQueryParameter['base'] = base;
-            }
-            if (head !== undefined) {
-                localVarQueryParameter['head'] = head;
-            }
             if (limit !== undefined) {
                 localVarQueryParameter['limit'] = limit;
             }
@@ -4353,7 +4663,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-provisioning` while the draft\'s storage is still being set up; on a git-backed draft the branch is read through the gateway, with its `409`, `422`, `429` and `503` answers; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
+         * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-converting` while the draft is moving to the new store; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
          * @summary Download a draft package as a zip
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4390,13 +4700,13 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * One document\'s content, whichever storage backs the draft. See `listDraftDocuments` for why the backing is not the caller\'s concern.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: for a git-backed draft, the draft-branch commit its last publish shipped (`publishedAs.commitSha`); for a document-store draft, the stored archive of its last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: on a document-store draft, the caller can read the draft but not the   package whose archive the baseline is. The archive is the package\'s, and   workspace access does not imply environment access, so this read also takes   `can_read_package` on it. A git-backed baseline is the draft\'s own branch. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded, or a published   commit no longer on the draft\'s branch. Permanent until the draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  On a document-store draft the content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`. `ref` is null on a document-store answer; on a git answer it names the published commit, which is NOT a head a compare-and-swap write can build on — read the head separately before writing.  **Authorization**: requires read access to the draft document.
+         * One document\'s content. `409` `draft-converting` while the draft is moving to the new store.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: the stored archive of the draft\'s last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: the caller can read the draft but not the package whose stored archive is the   baseline. Workspace access does not imply environment access, so this read also   takes `can_read_package` on it. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded. Permanent until the   draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  The content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`.  **Authorization**: requires read access to the draft document.
          * @summary Read one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The document\'s path relative to the draft root
-         * @param {string} [ref] Read at this commit rather than at the branch tip. A commit is honored on git-backed drafts only; a document-store draft has no commits and reads its current content whatever commit is named. The literal `publication` is reserved, on either backing: it reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case) and never forwarded to git, so it cannot be mistaken for a commit, which is hexadecimal. Prefer the one-call pairing: the response\'s `ref` names the commit the content was read at. A writer that intends to send the content back under a compare-and-swap must read the head first and then the document AT that head — reading the document first and the head second yields content from one commit paired with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.
+         * @param {string} [ref] The literal `publication` reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case). Any other value is ignored: a draft keeps no commits to read at.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -4435,7 +4745,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-provisioning` while the draft\'s storage is still being set up.  A file a git-backed draft\'s branch holds that cannot be served as text (over 1 MiB, or not UTF-8) answers `413` `draft-file-unreadable`, as `getDraftDocument` does: the branch is read as text only, so there are no bytes to serve. An uploaded data file never takes this path. On a git-backed draft the branch read is `getDraftDocument`\'s, and carries its `409`, `422`, `429` and `503` answers.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
+         * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-converting` while the draft is moving to the new store.  A text document that cannot be served as text (1 MiB or more) answers `413` `draft-file-unreadable`, as `getDraftDocument` does. An uploaded data file never takes this path.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
          * @summary Download one of a draft\'s files
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4476,22 +4786,22 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Proxies the git-gateway\'s `getDraftPullRequest`. Always answers `200`; `state` is `none` when the draft has no pull request, so a polling client does not have to treat absence as an error.  `mergeable` is GitHub\'s own verdict and is `null` while GitHub is still computing it — a routine answer for a freshly opened pull request. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Not a pure proxy: reading an open pull request also starts the compile check.** `compileVerdict` reports whether the package compiles at the current `headSha`, and the first read of a new head starts that check rather than waiting for it — so a `pending` verdict is the normal first answer, resolved by a later poll. A client that polls this endpoint therefore needs no separate call, and needs to make none when the verdict is already `passing` or `failing` for the head it holds.  **A read can also close a merged and published draft.** When the close that follows a publish was skipped or deferred (most often because the merge created a package the publish could not attach to the workspace), a read of the merged pull request finishes it: it attaches that package to the workspace, then deletes the draft and its branch. Afterwards the draft reads `403`, like any deleted draft.  **Authorization**: Requires read access to the draft document (enforced by the gateway). The three side effects this read can have carry their own, higher bars and are SKIPPED rather than refused when the caller lacks them, so the read itself never fails for a permission: recording an observed merge takes the draft\'s `can_update_document`, computing `compileVerdict` takes the environment\'s `can_create_package` (see that field), and closing a published draft takes the draft\'s `can_delete_document`, plus the package\'s `can_share_package` when it attaches a package first. A read below a bar returns the same pull request with that part left undone for the next qualified caller.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary The draft\'s pull request, read live from GitHub
+         * The gates `writeDraftPublication` applies, read without acting on any of them: no submit, no build request, no merge and no listing of the package on GitHub, so it costs database reads only. `ready` false comes with the `reason` the publish would answer now. `ready` true means every gate this read covers passed; the publish\'s own listing of the package at the pull request\'s head can still refuse it. `ready` says nothing about the caller: a reader who may not publish reads it too, and the publish refuses them `403`.  A draft that is owed a push or a build reads `sending` or `building` here, and only `writeDraftPublication` starts them. A `blocked` pull request reads `pull-request-blocked` here even when the publish would re-post its check and merge.  `warnings` are about what the publish would ship, not whether it can: today, that a first publish exposes every source (see `DraftPublicationWarning`). They are read only when `ready` is true, and are empty otherwise.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary Whether the draft can be published now
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftPullRequest: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
+        getDraftPublication: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftPullRequest', 'organizationName', organizationName);
+            (0, common_1.assertParamExists)('getDraftPublication', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftPullRequest', 'workspaceName', workspaceName);
+            (0, common_1.assertParamExists)('getDraftPublication', 'workspaceName', workspaceName);
             // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('getDraftPullRequest', 'draftId', draftId);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/pull-request`
+            (0, common_1.assertParamExists)('getDraftPublication', 'draftId', draftId);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/publication`
                 .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
                 .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
                 .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
@@ -4513,24 +4823,22 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Thin proxy to the code-assist git-gateway\'s `listDraftCommits` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user; the branch/subtree binding to `draftId` is derived and enforced server-side by the gateway, not by this endpoint.  **Authorization**: Requires read access to the draft document (enforced by the gateway).  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary List commits on a git-backed draft\'s branch (History tab)
+         * Served from controlplane\'s record of the draft and nothing else: no GitHub read and no side effect, so polling it costs controlplane\'s own reads only. Always answers `200` for a draft the caller can read. `state` is `none` when the draft has no pull request, and a draft whose environment does not review on GitHub answers `state: none`, `reviewState: notSubmitted`, so a polling client treats absence as an answer, not an error.  `reviewState` says where the review stands and `nextAttemptAt` when it is next worked on; `unsubmittedChanges` says whether the draft has edits since its last push. Poll while `reviewState` is `sending` or a pull request is open, and stop otherwise.  `mergeable` is GitHub\'s own verdict as last recorded and is `null` while GitHub is still computing it. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary The draft\'s pull request and review state
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
-         * @param {number} [limit]
-         * @param {number} [offset]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDraftCommits: (organizationName_1, workspaceName_1, draftId_1, limit_1, offset_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, limit_1, offset_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, limit, offset, options = {}) {
+        getDraftPullRequest: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('listDraftCommits', 'organizationName', organizationName);
+            (0, common_1.assertParamExists)('getDraftPullRequest', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('listDraftCommits', 'workspaceName', workspaceName);
+            (0, common_1.assertParamExists)('getDraftPullRequest', 'workspaceName', workspaceName);
             // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('listDraftCommits', 'draftId', draftId);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/commits`
+            (0, common_1.assertParamExists)('getDraftPullRequest', 'draftId', draftId);
+            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/pull-request`
                 .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
                 .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
                 .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
@@ -4543,12 +4851,6 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
-            if (limit !== undefined) {
-                localVarQueryParameter['limit'] = limit;
-            }
-            if (offset !== undefined) {
-                localVarQueryParameter['offset'] = offset;
-            }
             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
@@ -4558,20 +4860,20 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * The draft\'s files, **whichever storage backs them**. A git-backed draft\'s files live on its branch and a document-store draft\'s live as workspace documents; this answers for both, so a client never branches on the backing to read a draft\'s contents. That branch is the reason a draft\'s backing had to be known before its files could be fetched, which put an unrelated read on the critical path of every draft page.  Two shapes, both listings: the documents under `path` to `depth`, or — with `ref` — that same listing as of a commit. Git-backed drafts only for `ref`; a document-store draft has no history to address and ignores it.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing of the draft as it stands (no `ref`) reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A document-store draft never published is measured against the published version it was opened on, and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. Any other never-published draft, or a listing at a `ref`, carries no markers and no removed entries. When the comparison cannot be made (a git compare over the gateway\'s size limit, a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  What changed between two COMMITS is a different question — the History tab\'s — and has its own endpoint: `GET ../comparison`.  Content is omitted from the listing; read a document to get it.  **Authorization**: requires read access to the draft document.
+         * The draft\'s files: the documents under `path` to `depth`, held as workspace documents. `409` `draft-converting` while the draft is moving to the new store.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A draft never published is measured against the published version it was opened on (the package\'s latest version when none was recorded), and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. A baseline that exists but cannot be measured or read (an archive that failed to download) is `Changes-Unavailable` too, never \"nothing to compare against\". A never-published draft of a package with no published version carries no markers and no removed entries. When the comparison cannot be made (a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  Content is omitted from the listing unless `withContent=true`; otherwise read a document to get it.  **Authorization**: requires read access to the draft document.
          * @summary List a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} [path] Restrict the listing to this subtree, relative to the draft root.
-         * @param {number} [depth] `1` lists only the immediate children of `path`, as a file browser would. Omitted returns the whole subtree, which is what a section listing wants. The two are answered by different reads, so they differ in two ways a caller can see. A bounded depth returns directory entries as well as files; the whole subtree returns files only, since a directory is not a document and every caller of the depth-less listing filters to files anyway. And the whole subtree is refused with `413` for a draft holding a symlink or submodule, where a bounded depth lists around it.
-         * @param {string} [ref] Read the listing at this commit rather than at the branch tip. Accepts only a full 40-character sha reachable from the draft\'s branch. Ignored by a document-store draft, which has no commits.
+         * @param {number} [depth] `1` lists only the files directly under `path`, as a file browser would. Omitted returns every file in the subtree, which is what a section listing wants. A draft\'s paths are flat, so neither returns directory entries.
+         * @param {boolean} [withContent] Carry each document\'s content on its entry, so a caller that wants the whole draft makes one request rather than one per file. A document\'s text comes as `content`. A data file the draft holds beside its documents (`kind` `data`) carries neither, as in any listing. The listing is whole-draft or refused: past the same file-count and byte limits a checkpoint collects under, it answers `413` `draft-listing-too-large` rather than a partial one, and `limit` and `offset` do not lower what is read, only what is returned. Read the files one at a time instead.
          * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
          * @param {number} [offset] Number of items to skip before starting to return results
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDraftDocuments: (organizationName_1, workspaceName_1, draftId_1, path_1, depth_1, ref_1, limit_1, offset_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, path_1, depth_1, ref_1, limit_1, offset_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options = {}) {
+        listDraftDocuments: (organizationName_1, workspaceName_1, draftId_1, path_1, depth_1, withContent_1, limit_1, offset_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, path_1, depth_1, withContent_1, limit_1, offset_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
             (0, common_1.assertParamExists)('listDraftDocuments', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
@@ -4597,8 +4899,8 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             if (depth !== undefined) {
                 localVarQueryParameter['depth'] = depth;
             }
-            if (ref !== undefined) {
-                localVarQueryParameter['ref'] = ref;
+            if (withContent !== undefined) {
+                localVarQueryParameter['withContent'] = withContent;
             }
             if (limit !== undefined) {
                 localVarQueryParameter['limit'] = limit;
@@ -4660,7 +4962,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish, the git stamps from a checkpoint or a merge. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields, which is how a stamp drops the git pointers a concurrent checkpoint had just written: a read taken a moment too early preserves stale ones.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
+         * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
          * @summary Update a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4702,86 +5004,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Changes where the branch points. `syncWithBase` brings it up to date with its environment\'s base branch. A `PATCH` on the branch rather than a `/sync` verb: moving a branch is a change to the branch, and the path names resources.  Calls the git-gateway\'s `syncDraftBranch` to merge the base branch into the draft\'s own branch, then writes the result to the draft\'s manifest as `metadata.git.package_base_sha` — the marker `writeDraftPullRequest` and `updateDraftPullRequest` check to clear `draft-behind-base`.  **Not a pure proxy.** The manifest write is this endpoint\'s own, and it is the half that matters: the gateway never writes a manifest (that boundary holds for every route in its API), so a caller going straight to the gateway would sync the branch and leave the marker unwritten. Both outcomes of the merge yield a SHA to freeze — the tip the gateway reports it absorbed, or, when the branch already contained the base tip, that tip itself, which GitHub\'s own `204` proves was already reachable.  A MERGE refused with `draft-behind-base` is recovered by this sync — pull-request creation already retries this automatically (see `writeDraftPullRequest`), but merging is the higher-authority operation and deliberately does not auto-sync, so the user sees what they are absorbing before it lands on the base branch.  A `409` is terminal either way, and the gateway\'s body sentinel says which: `sync-conflict` means GitHub reports the merge would CONFLICT, `sync-rejected` means GitHub rejected the merge request as invalid and will reject it again. In-product resolution is out of scope for both — resolve it directly on github.com against the draft\'s branch, or start a fresh draft.  **Authorization**: Requires the environment\'s `can_create_package` — the SAME bar `writeDraftPullRequest` takes, not the merge bar: syncing writes only to the draft\'s own branch, never the base branch.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Move the draft\'s branch
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        updateDraftBranch: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
-            // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftBranch', 'organizationName', organizationName);
-            // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftBranch', 'workspaceName', workspaceName);
-            // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftBranch', 'draftId', draftId);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/branch`
-                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
-                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
-                .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'PATCH' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * Advances the pull request\'s state. Merging is a transition of the pull request, not an action filed under it — `PATCH` on the resource rather than a `/merge` verb in the path, which is what every other resource in this API does.  Proxies the git-gateway\'s `mergeDraftPullRequest`. Squash-merges into the base branch and returns the merge commit SHA, which becomes the published version\'s `git_commit_sha` — the first provenance anchor reachable from the base branch.  `expectedHeadSha` is required and pins what is merged to what the caller read, so a checkpoint that landed after the review cannot be merged silently. Read it from `getDraftPullRequest` and pass it straight back. A `409` means the head moved, the pull request is gone, `publisher.json` names a version that already exists, or the package is known not to compile at this head (`draft-compile-failed`); a `405` means GitHub says the branch is not mergeable — a conflict, or a required review that has not passed.  The compile check is READ here, never run — it is started by `getDraftPullRequest` and can take minutes, so this call adds no compile latency. The consequence is that it refuses only a `failing` verdict already computed for this exact `expectedHeadSha`. `pending`, `unverified`, and a verdict this replica has not computed at all ALL allow the merge. Treat it as a guard against merging a known-broken package, not as a guarantee that a merged package compiled.  **Authorization**: Requires the environment\'s `can_update_project` (enforced by the gateway) — a strictly higher bar than opening the pull request, because a merge changes what serves for the whole environment.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Merge the draft\'s pull request
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {MergeDraftPullRequest} mergeDraftPullRequest
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        updateDraftPullRequest: (organizationName_1, workspaceName_1, draftId_1, mergeDraftPullRequest_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, mergeDraftPullRequest_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, mergeDraftPullRequest, options = {}) {
-            // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftPullRequest', 'organizationName', organizationName);
-            // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftPullRequest', 'workspaceName', workspaceName);
-            // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftPullRequest', 'draftId', draftId);
-            // verify required parameter 'mergeDraftPullRequest' is not null or undefined
-            (0, common_1.assertParamExists)('updateDraftPullRequest', 'mergeDraftPullRequest', mergeDraftPullRequest);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/pull-request`
-                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
-                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
-                .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'PATCH' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(mergeDraftPullRequest, localVarRequestOptions, configuration);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Always answers `202` with the current status: this call is a nudge, not the publish. The reconciler resolves the draft\'s current content itself when it collects the work — the git branch head for a git-backed draft, the doc-store tree otherwise — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
+         * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Answers `202` with the current status: this call is a nudge, not the publish. A draft that is moving to the new store answers `409` `draft-converting` and records nothing; retry after a moment. The reconciler resolves the draft\'s current content itself when it collects the work — the draft\'s documents — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
          * @summary Set the draft\'s checkpoint to its current content
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4818,7 +5041,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Creates or replaces a document, whichever storage backs the draft. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition depends on the storage, and each is refused on the other.** On a git-backed draft `expectedRef` is required and is the BRANCH HEAD the writer read at, not the document\'s own blob sha: the gateway refuses to build on anything but the branch\'s current tip, so a stale value means the draft moved under the writer. Take it from `getDraftDocument`\'s `ref`, and read the document at the head you intend to write against — reading the document first and the head second pairs content from one commit with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.  On a document-store draft the precondition is per file: `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Either is checked in the same statement that writes, so of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`. They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been. `expectedRef` is refused on a document-store draft, and `expectedSha` and `createOnly` are refused on a git-backed one, rather than ignored: a caller that sends a precondition believes it holds a guarantee.  On a document-store draft the server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment, on either backing. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. A git-backed write also commits into that environment\'s repository. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+         * Creates or replaces a document. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition is per file.** `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`, except that a resent write that already landed is answered as applied (below). They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been.  A retry whose change is already in place (the content is current, or the file to delete is gone) is answered as applied, not as a conflict, so a lost response can be resent. A deletion of a gone file with an `expectedSha` counts as applied only when no write in the same set is still to land: a move whose old path was deleted or moved by someone else is stale (`\"\"`), not a second copy.  The server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
          * @summary Write one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4864,7 +5087,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents rather than in either backing, so this works the same on a git-backed draft and a document-store draft, and never commits to a repository (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  When the path is one a git-backed draft holds as text (the small CSV case above), the text copy\'s removal is a commit at the branch head, and the upload carries the gateway\'s own answers for it, each listed on its status below: `409` `draft-provisioning` and `draft-file-stale-head`, `422` for an unprovisioned environment, GitHub\'s `429` with `Retry-After`, and a code-less `503`. On every one of them the upload is rolled back and the draft is as it was.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
+         * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`), or   ends in any other extension outside the formats a model reads as data: `.csv`,   `.tsv`, `.parquet`, `.xlsx`, `.json`, `.jsonl`, `.ndjson`, and `.csv.gz`, `.tsv.gz`,   `.json.gz`, `.jsonl.gz`, `.ndjson.gz` (an `.xls` is told to save as `.xlsx`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
          * @summary Upload a data file into a draft
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4910,7 +5133,7 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Writes a set of documents together. On a git-backed draft they land as **one commit**, which is the reason this exists beside the per-document `PUT`: seeding a draft from a package is a single logical change, and writing its files one at a time would put N commits in the History tab for one action — and leave a reader of any intermediate commit looking at half a package.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature: the seed, and a multi-file edit that should be reviewable as one diff.  `expectedRef` applies to the whole set, and a client-minted `intentTimestamp` resent byte-identical makes a retried write a replay rather than a second commit — which matters more here than for one document, since a lost response after an N-file commit is otherwise indistinguishable from a write that never landed.  On a document-store draft each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. The set stays all-or-nothing: if any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path.  **Authorization**: as `writeDraftDocument`.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. On a branch-backed draft the commit is made by the gateway, so the claim is checked just before it: a cancel that lands during that one commit can let it through, and the commit\'s `Turn-Work-Item` trailer records which item wrote it. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+         * Writes a set of documents together, in one transaction: a seed, or a multi-file edit that must not be seen half applied.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature.  Each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. If any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path; a set already partly in place (a resent one) commits only what remains.  **Authorization**: as `writeDraftDocument`.  **Resolving conflicts.** A member carrying the `conflictSha` that `getDraftConflicts` gave its path resolves that one conflict: the path leaves the conflict list and its base moves to the incoming side, so the next sync does not raise it again. With no content and no `deleted` the member keeps the draft\'s file as it is (an uploaded data file too), and only the conflict is cleared. Members without a `conflictSha` write as usual, and a write may resolve any subset of the list. A `conflictSha` that no longer names the path\'s conflict (the incoming side moved, or it was resolved) is `409` `draft-conflict-changed`, and nothing is written. Once none remain, the draft moves on to what came in, and a submitted draft\'s push starts. A resolution never fails on an archive: when the published version the last conflicts came from cannot be read, the draft\'s next sync moves its base instead.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
          * @summary Write several of a draft\'s documents as one change
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -4956,15 +5179,16 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Publishes the draft\'s bound package straight from its recorded merge commit, closing the loop after a pull request merges without a separate zip-upload publish. Panel-invoked rather than part of `updateDraftPullRequest`\'s own response — merge-click latency and proxy-timeout risk keep the two calls separate. `GitWebhookService` already publishes on merge on its own; this endpoint is the manual fallback the draft panel\'s own \"Publish\" button calls, for a merge whose webhook delivery was refused, lost, or raced the manifest\'s merge-commit stamp — safe to call more than once: a repeat answers 409, but so does a different publish having already taken that version id, and the two are told apart only by whether a served version carries this merge commit\'s own sha.  **Refuses (`409 draft-not-at-merge`) unless the manifest still carries a merge commit.** `updateDraftPullRequest` / `getDraftPullRequest` stamp `metadata.git.merge_commit_sha` best-effort and clear it the moment a checkpoint advances the draft past the merge, so a call made immediately after a merge can race a failed stamp. Reload the pull request (which repairs the stamp on the next qualified read) and retry.  Reads the package\'s subtree at the merge commit through the same draft reads the History/Files tabs use, so any file that cannot be read as UTF-8 text under 1MB refuses the whole publish (`409 draft-publish-unreadable-file`) rather than silently omitting it from the package.  Publishes only the manifest\'s own bound package (`metadata.git.package` / `metadata.git.environment`) — there is no way to name a different one.  **A successful publish closes the draft.** The draft and its branch are deleted, the branch delete pinned to the head that was published, when the draft is still at the merge this call published, no pull request is open on its branch, the publish did not create the package without attaching it to the workspace (`workspaceAttached: false`), the caller may delete the draft, and no agent sandbox turn is live on it. Otherwise the draft stays and the next change can continue it, as it does when the branch delete fails. A branch a published version records is kept while the draft is still deleted. The close never fails this call: the response is the publish\'s, and `publishedVersion` names the version it created.  **Authorization**: enforced where publishing already is — `createOrUpdatePackage`\'s own `can_create_package` / `can_update_package` check, re-run under the caller\'s principal.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Publish a git-backed draft\'s merged package
+         * The one way a draft ships, whether or not its environment reviews drafts on GitHub. Either the draft\'s package is published and this answers `200` with it, or nothing is published and it answers `409` `draft-not-ready` with `details.reason` saying what it waits on. Call it again once that clears: every step is safe to repeat, and a repeat after a publish answers with the version already published. `getDraftPublication` reads the same gates without acting on them.  **A draft whose environment does not review on GitHub** is published from its own files, in this order:  1. `conflicts`: the draft has unresolved conflicts (`details.conflictCount`). 2. `stale`: the package has a newer version than the one the draft is synced to;    the background sync brings it in. 3. `building` / `build-failed`: the draft\'s latest content has no passing build from    the last hour. A missing, pending or stale build is requested here and answers    `building`; a failing one answers `build-failed`, with the compiler\'s message. 4. The publish, `createOrUpdatePackage` naming this draft. The body\'s `description`    is written into the published `publisher.json`. A package that moved under the    draft while it published answers `stale`.  **A draft whose environment reviews on GitHub** merges its pull request and publishes the merge commit:  1. A draft whose pull request merged, and which has not changed since, goes straight    to the publish (8). One edited after its merge is a new pull request. While a    rebuild of a merged draft is pending this answers `building`: the build says    whether it holds an edit. A rebuild that failed on the merged content still    publishes the merge. One whose content cannot be compared answers `build-failed`    when it failed to compile, and `building` when it failed on Credible\'s side, which    this call asks to rebuild. 2. A push GitHub refused for good answers `push-refused`, with the reason in    `details.pushError`: `data_files_only`, `no_changes`, `content_refused`,    `review_outside_package`, `repository_too_large` or `push_refused`, until the    draft\'s content changes, which sends it again (`repository_too_large` only    fails again: see `push-refused` below). Otherwise a push is owed when the    draft has never been sent, has changed since its last push, or the body\'s    `title` / `description` differ from the pull request\'s; this call submits it. 3. `conflicts` (the draft\'s own, `details.conflictCount`) and `stale` (as above). 4. `sending` until the owed push lands and the pull request is open at it. 5. The build at the pull request\'s head must be a pass from the last hour. Otherwise    this call asks for one, which posts the head\'s check run once it settles, and    answers `building`, or `build-failed` for a failing one. 6. GitHub\'s mergeable state, as last recorded: `dirty` answers    `pull-request-conflicts` (the draft\'s own conflicts are step 3\'s `conflicts`, so    this one is resolved on GitHub), `draft` is read once more, as a press may follow    a pull request marked ready, and answers `pull-request-draft` if it still is (or    if GitHub cannot be read), and a state GitHub has not computed is read once more    and otherwise answers `sending`. `blocked`    with a passing build re-posts the head\'s passing check run, since a check run left    from an earlier answer can be what blocks it, and goes on to the merge. `behind`    alone does not refuse: the merge itself refuses a base branch that changed the    package. 7. The package at the head is listed once and refused for what a publish cannot    carry: `draft-publish-unreadable-file`, `draft-publish-too-large`, or    `draft-publish-manifest-missing` (no `publisher.json`). 8. The pull request is merged at that head, confined to the package and only while    the base branch has not changed the package since the draft\'s base, and the merge    commit is published. GitHub refusing the merge answers `pull-request-blocked`    (a required review or check is outstanding), a base branch that changed the    package `stale`, a head that moved `sending`, and a pull request that changes files    outside the package `push-refused` with `details.pushError`    `review_outside_package`: a merge here never carries them onto the base branch, so    they are reconciled on GitHub. A refusal because the pull request already merged    (a second Publish racing the first) publishes that merge.    Until the merge\'s version exists this answers `publishing` (the webhook or the    merge record holds it, or GitHub\'s merge time is not read yet); call again,    which never merges twice.  **A successful publish closes the draft**, as the publish of a draft always has: the draft and its branch are deleted unless it changed meanwhile, a pull request is open on its branch, the publish created the package without attaching it to the workspace (`workspaceAttached: false`), or an agent sandbox turn is live on it. The close never fails this call; `publishedVersion` names the version published, or the existing one that already carries this merge.  **Authorization**: the draft\'s modeling bar (`can_create_document` on the workspace, `can_create_package` on its environment) and `can_update_package` on a package that already exists; the publish itself re-checks them.  `409` `draft-converting` means the draft is moving to the new store; retry. A `400` is the publish refusing the package itself (an archive it cannot read, a name it does not accept).
+         * @summary Publish the draft
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
+         * @param {DraftPublicationRequest} [draftPublicationRequest]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        writeDraftPublication: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
+        writeDraftPublication: (organizationName_1, workspaceName_1, draftId_1, draftPublicationRequest_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, draftPublicationRequest_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, draftPublicationRequest, options = {}) {
             // verify required parameter 'organizationName' is not null or undefined
             (0, common_1.assertParamExists)('writeDraftPublication', 'organizationName', organizationName);
             // verify required parameter 'workspaceName' is not null or undefined
@@ -4984,46 +5208,11 @@ const DraftsApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = Object.assign(Object.assign({ method: 'PUT' }, baseOptions), options);
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            localVarHeaderParameter['Content-Type'] = 'application/json';
             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        }),
-        /**
-         * Proxies the code-assist git-gateway\'s `createDraftPullRequest`, forwarding the caller\'s own bearer token exactly as the History operations do. The gateway remains the sole authorizer; this endpoint performs no authorization of its own.  Idempotent — an already-open pull request for this draft comes back rather than a second one.  **Not a pure proxy: this call can sync and retry on your behalf.** A draft whose package already exists on the base branch — most commonly because this draft\'s own earlier pull request already merged it — is refused `409 draft-behind-base` unless it can be shown to derive from the base branch\'s current tip. Rather than surfacing that refusal immediately, this endpoint calls `updateDraftBranch`\'s own implementation, which merges the base branch into the draft\'s branch and writes `metadata.git.package_base_sha` on the draft\'s manifest from what that sync proves, then retries the create exactly once. Only a second refusal (a real race, or a draft whose package belongs to another name entirely) reaches the caller as `409`. A `sync-conflict` or `sync-rejected` from that internal sync surfaces as its own clear refusal, naming the manual paths out (resolve on github.com, or start a fresh draft) — resolve it there, or call `updateDraftBranch` directly for the same outcome without going through this endpoint.  **Authorization**: Requires the environment\'s `can_create_package` (enforced by the gateway) — proposing a change is the same authority as writing the draft.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Open a pull request for a git-backed draft
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        writeDraftPullRequest: (organizationName_1, workspaceName_1, draftId_1, ...args_1) => __awaiter(this, [organizationName_1, workspaceName_1, draftId_1, ...args_1], void 0, function* (organizationName, workspaceName, draftId, options = {}) {
-            // verify required parameter 'organizationName' is not null or undefined
-            (0, common_1.assertParamExists)('writeDraftPullRequest', 'organizationName', organizationName);
-            // verify required parameter 'workspaceName' is not null or undefined
-            (0, common_1.assertParamExists)('writeDraftPullRequest', 'workspaceName', workspaceName);
-            // verify required parameter 'draftId' is not null or undefined
-            (0, common_1.assertParamExists)('writeDraftPullRequest', 'draftId', draftId);
-            const localVarPath = `/organizations/{organizationName}/workspaces/{workspaceName}/drafts/{draftId}/pull-request`
-                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)))
-                .replace(`{${"workspaceName"}}`, encodeURIComponent(String(workspaceName)))
-                .replace(`{${"draftId"}}`, encodeURIComponent(String(draftId)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = Object.assign(Object.assign({ method: 'PUT' }, baseOptions), options);
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(draftPublicationRequest, localVarRequestOptions, configuration);
             return {
                 url: (0, common_1.toPathString)(localVarUrlObj),
                 options: localVarRequestOptions,
@@ -5040,7 +5229,7 @@ const DraftsApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.DraftsApiAxiosParamCreator)(configuration);
     return {
         /**
-         * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  **A git-backed draft\'s branch is created here too.** In a git-enrolled environment this provisions the branch and records the binding — repository, branch, package directory, base branch — before returning, so a caller either gets a complete draft or gets none. Assembled afterwards by separate writers there is no transaction to hold them together, and a failure part-way leaves a draft naming a branch that does not exist.  The binding is **not alterable through update, move or create** afterwards: the checkpoint collector resolves the subtree from `packagePath` and a merge\'s auto-publish resolves the owning environment from `git.environment`, so changing either would orphan what is already committed. Through the documents API, a request that introduces, removes or alters the binding or the draft\'s target answers `409 draft-binding-immutable`; a request that omits `git` keeps the stored block. Deleting the draft is still how a bound manifest goes away.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
+         * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  Every draft is a document-store draft, in a git-enrolled environment as in any other: the draft\'s files are workspace documents, and git is only where a pushed draft goes for review.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
          * @summary Create a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5058,7 +5247,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2). Branch removal was inherited from the document model — documents are deletable, so a draft\'s branch looked like it had to go too — and every failure mode of that obligation had to be handled. Git\'s model is the opposite: branches accumulate and tidying is a convenience. Once a draft has had a pull request, GitHub retains `refs/pull/N/head` permanently, so deleting the branch would not remove the content anyway. Removing a branch is `DELETE .../drafts/{draftId}/branch`, and the one case worth tidying — a branch nothing was ever committed to — is the caller\'s to decide. The other case is server-side: a successful publish closes the draft and deletes its branch with it (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
+         * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch usually lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2), with one server-side exception: a draft that was never published and still sits at its seed commit has its branch deleted first, best-effort, so a draft minted from a misread intent leaves nothing behind. The delete is pinned to the seed commit, so a commit that landed since keeps the branch; the pin is not a compare-and-swap, so a commit landing in the instant between the gateway\'s tip re-read and its delete is lost. A failed branch delete never blocks the draft\'s delete, and retrying after a partial failure finds the branch already gone. Every other branch is removed by `DELETE .../drafts/{draftId}/branch`, or by the close after a successful publish (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
          * @summary Delete a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5076,7 +5265,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo. See `listDraftCommits` for the auth-forwarding notes.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  One product path calls this, and only one: since the 2026-08-15 \"branches live on\" decision (docs/git-synced-modeling.md §7.2) deleting a draft deletes the manifest and leaves the branch, so the agent\'s `delete_file` cascade makes no branch call at all, and the app\'s delete tidies the branch only for a draft nothing was ever committed to (the §7.2 amendment of 2026-08-24). Otherwise it is the primitive operator tooling needs — see docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
+         * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo, forwarding the caller\'s own bearer token.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  Stays as the primitive operator tooling needs: `deleteDraft` deletes an untouched draft\'s branch at its seed commit on the server (docs/git-synced-modeling.md §7.2), so neither the app nor the agent needs to call this. See docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
          * @summary Delete a git-backed draft\'s branch
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5094,34 +5283,34 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Removes a document from the draft, whichever storage backs it. On a git-backed draft this is a commit that deletes the file, under the same precondition a write takes; on a document-store draft it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
+         * Removes a document from the draft: it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
          * @summary Delete one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The document\'s path relative to the draft root
-         * @param {string} [expectedRef] The branch head the caller read at. For a text document on a git-backed draft it is required; for a data file there it is ignored, since a data file\'s delete is not a commit. Refused for a document-store draft, data file or not — there is no commit to compare it against. See `writeDraftDocument` for why it is the branch head rather than the document\'s own sha.
-         * @param {string} [expectedSha] The `sha` the caller read the document at. Document-store drafts only, refused for a git-backed one: the delete applies only if the document still holds that version, else `409` `draft-document-stale`.
+         * @param {string} [expectedSha] The `sha` the caller read the document at: the delete applies only if the document still holds that version, else `409` `draft-document-stale`; a file already gone counts as deleted when this is the whole request, so a lost response can be resent.
+         * @param {string} [expectedRef] Deprecated: use `expectedSha`. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options) {
+        deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
                 const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.deleteDraftDocument']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
             });
         },
         /**
-         * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. `expectedRef` is optional   here, as it is absent on a data file\'s delete: when given on a git-backed draft, the   commit that writes a small published copy back builds on it (`409   draft-file-stale-head` if the branch has moved since), and on the branch\'s current   head when it is not given. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included; `503` `draft-changes-unavailable` when its changes could not be compared with its publication.  **Authorization** — the same pair `writeDraftDocument` takes.
+         * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included. Before any change is found, the comparison itself can be refused, with the answers a read of the baseline gives: `403` when the caller cannot read the package the draft is measured against, `409` `draft-publication-baseline-missing` when that baseline cannot be measured (a corrupt archive), and `503` `draft-changes-unavailable` when it could not be read.  **Authorization** — the same pair `writeDraftDocument` takes.
          * @summary Restore one of a draft\'s files to its published copy
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The file\'s path relative to the draft root
-         * @param {string} [expectedRef] The branch head the caller read at, for a git-backed draft where the restore is a commit: required for a text file, optional for a data file (used as the compare-and-swap base when a small published copy is written back as a document); refused for a document-store draft.
+         * @param {string} [expectedRef] Deprecated: a restore takes no precondition. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -5153,20 +5342,20 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * The branch a git-backed draft\'s files live on, and where it currently points. The tip is a property of the branch, so it is read from the branch rather than from an endpoint of its own.  Thin proxy to the code-assist git-gateway\'s `getDraftHead` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user.  NOT `listDraftCommits(limit=1)`\'s `sha`: that read is filtered to the draft\'s own package subtree, so a commit that lands on the branch without touching it (e.g. `syncDraftBranch`) never advances it — a caller building a checkpoint\'s `expectedHeadSha` from that filtered read can 409 against the real, unfiltered CAS forever. This endpoint returns that real tip.  **Authorization**: Requires read access to the draft document (enforced by the gateway) — the same bar `listDraftCommits` and `getDraftDocument` take.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary The draft\'s branch
+         * The draft\'s capabilities, derived by the server from its environment and what its package has published. The same value `getDraft` carries as `capabilities`, for a caller that does not need the rest of the draft: it reads the draft\'s manifest, its review state and one published-version lookup, not the checkpoint or the files.  A draft that is moving to the new store answers `409` `draft-converting`: retry.  **Authorization**: requires read access to the draft document.
+         * @summary What the draft\'s storage can do
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftBranch(organizationName, workspaceName, draftId, options) {
+        getDraftCapabilities(organizationName, workspaceName, draftId, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftBranch(organizationName, workspaceName, draftId, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftCapabilities(organizationName, workspaceName, draftId, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftBranch']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftCapabilities']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
             });
         },
@@ -5189,29 +5378,46 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * The documents that differ between `base` and `head`, each with how it changed and, where the gateway supplies one, its patch.  Its own resource rather than a mode of the document listing: the listing already reports each document against the draft\'s last publication (`changeSincePublication`), and this answers what moved between any two commits — the History tab\'s question. An entry here can name two paths at once (`renamed`), and folding commit-to-commit diffs into the listing would mean an item schema whose fields were populated or `null` depending on which query parameters the caller happened to send.  **Git-backed drafts only.** A document-store draft has no commits to compare, so the question does not apply to it rather than having no answer: it is a `400` `draft-not-git-backed`, the same refusal every git-only draft operation gives, and `409` `draft-provisioning` while the branch is still being cut. The `422` below is the gateway\'s own, for an environment that is not provisioned.  **Authorization**: requires read access to the draft document, the same bar as the document listing.
-         * @summary What changed between two commits of a draft
+         * One entry of `getDraftConflicts` with the incoming side\'s, the draft\'s and their common ancestor\'s version of the file, so the caller can reconcile them and write the result through `writeDraftDocuments` with the `conflictSha` this returns.  **Authorization**: requires read access to the draft document, and `can_create_package` on the environment it targets: only a modeler can act on what this serves.  `404` when the path has no conflict (it was resolved, or never conflicted).
+         * @summary One conflicting file, with all three of its versions
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
-         * @param {string} base The commit to compare FROM. A full 40-character sha reachable from the draft\'s branch.
-         * @param {string} head The commit to compare TO. Same form as `base`.
-         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
+         * @param {string} documentPath The conflicting file\'s path relative to the draft root, as `getDraftConflicts` lists it.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getDraftConflict(organizationName, workspaceName, draftId, documentPath, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftConflict(organizationName, workspaceName, draftId, documentPath, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftConflict']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+        /**
+         * A page of the draft\'s conflicts: every path both the draft and what came in changed since their common ancestor, where what came in is a newer published version of its package (the base moved) or a commit someone pushed to its pull request. A superset of what cannot merge on its own, because nothing here runs a merge. Ordered by `relpath`.  Each entry says where its incoming side came from, and carries the `conflictSha` a resolution sends back through `writeDraftDocuments`, a member per file. `getDraftConflict` returns one file\'s three versions.  An empty list means nothing waits on the author: what only one side changed is absorbed in the background. Conflicts never block editing or a Submit; a submitted draft\'s push waits for the last one to be resolved and then starts on its own.  Served from controlplane\'s record alone: no file content, no archive read and no GitHub call.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary The files the draft and what came in both changed
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {string} draftId The draft package identifier
+         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
          * @param {number} [offset] Number of items to skip before starting to return results
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftComparison(organizationName, workspaceName, draftId, base, head, limit, offset, options) {
+        getDraftConflicts(organizationName, workspaceName, draftId, limit, offset, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftComparison(organizationName, workspaceName, draftId, base, head, limit, offset, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftConflicts(organizationName, workspaceName, draftId, limit, offset, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftComparison']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftConflicts']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
             });
         },
         /**
-         * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-provisioning` while the draft\'s storage is still being set up; on a git-backed draft the branch is read through the gateway, with its `409`, `422`, `429` and `503` answers; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
+         * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-converting` while the draft is moving to the new store; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
          * @summary Download a draft package as a zip
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5229,13 +5435,13 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * One document\'s content, whichever storage backs the draft. See `listDraftDocuments` for why the backing is not the caller\'s concern.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: for a git-backed draft, the draft-branch commit its last publish shipped (`publishedAs.commitSha`); for a document-store draft, the stored archive of its last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: on a document-store draft, the caller can read the draft but not the   package whose archive the baseline is. The archive is the package\'s, and   workspace access does not imply environment access, so this read also takes   `can_read_package` on it. A git-backed baseline is the draft\'s own branch. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded, or a published   commit no longer on the draft\'s branch. Permanent until the draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  On a document-store draft the content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`. `ref` is null on a document-store answer; on a git answer it names the published commit, which is NOT a head a compare-and-swap write can build on — read the head separately before writing.  **Authorization**: requires read access to the draft document.
+         * One document\'s content. `409` `draft-converting` while the draft is moving to the new store.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: the stored archive of the draft\'s last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: the caller can read the draft but not the package whose stored archive is the   baseline. Workspace access does not imply environment access, so this read also   takes `can_read_package` on it. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded. Permanent until the   draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  The content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`.  **Authorization**: requires read access to the draft document.
          * @summary Read one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The document\'s path relative to the draft root
-         * @param {string} [ref] Read at this commit rather than at the branch tip. A commit is honored on git-backed drafts only; a document-store draft has no commits and reads its current content whatever commit is named. The literal `publication` is reserved, on either backing: it reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case) and never forwarded to git, so it cannot be mistaken for a commit, which is hexadecimal. Prefer the one-call pairing: the response\'s `ref` names the commit the content was read at. A writer that intends to send the content back under a compare-and-swap must read the head first and then the document AT that head — reading the document first and the head second yields content from one commit paired with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.
+         * @param {string} [ref] The literal `publication` reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case). Any other value is ignored: a draft keeps no commits to read at.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -5249,7 +5455,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-provisioning` while the draft\'s storage is still being set up.  A file a git-backed draft\'s branch holds that cannot be served as text (over 1 MiB, or not UTF-8) answers `413` `draft-file-unreadable`, as `getDraftDocument` does: the branch is read as text only, so there are no bytes to serve. An uploaded data file never takes this path. On a git-backed draft the branch read is `getDraftDocument`\'s, and carries its `409`, `422`, `429` and `503` answers.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
+         * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-converting` while the draft is moving to the new store.  A text document that cannot be served as text (1 MiB or more) answers `413` `draft-file-unreadable`, as `getDraftDocument` does. An uploaded data file never takes this path.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
          * @summary Download one of a draft\'s files
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5268,61 +5474,59 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Proxies the git-gateway\'s `getDraftPullRequest`. Always answers `200`; `state` is `none` when the draft has no pull request, so a polling client does not have to treat absence as an error.  `mergeable` is GitHub\'s own verdict and is `null` while GitHub is still computing it — a routine answer for a freshly opened pull request. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Not a pure proxy: reading an open pull request also starts the compile check.** `compileVerdict` reports whether the package compiles at the current `headSha`, and the first read of a new head starts that check rather than waiting for it — so a `pending` verdict is the normal first answer, resolved by a later poll. A client that polls this endpoint therefore needs no separate call, and needs to make none when the verdict is already `passing` or `failing` for the head it holds.  **A read can also close a merged and published draft.** When the close that follows a publish was skipped or deferred (most often because the merge created a package the publish could not attach to the workspace), a read of the merged pull request finishes it: it attaches that package to the workspace, then deletes the draft and its branch. Afterwards the draft reads `403`, like any deleted draft.  **Authorization**: Requires read access to the draft document (enforced by the gateway). The three side effects this read can have carry their own, higher bars and are SKIPPED rather than refused when the caller lacks them, so the read itself never fails for a permission: recording an observed merge takes the draft\'s `can_update_document`, computing `compileVerdict` takes the environment\'s `can_create_package` (see that field), and closing a published draft takes the draft\'s `can_delete_document`, plus the package\'s `can_share_package` when it attaches a package first. A read below a bar returns the same pull request with that part left undone for the next qualified caller.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary The draft\'s pull request, read live from GitHub
+         * The gates `writeDraftPublication` applies, read without acting on any of them: no submit, no build request, no merge and no listing of the package on GitHub, so it costs database reads only. `ready` false comes with the `reason` the publish would answer now. `ready` true means every gate this read covers passed; the publish\'s own listing of the package at the pull request\'s head can still refuse it. `ready` says nothing about the caller: a reader who may not publish reads it too, and the publish refuses them `403`.  A draft that is owed a push or a build reads `sending` or `building` here, and only `writeDraftPublication` starts them. A `blocked` pull request reads `pull-request-blocked` here even when the publish would re-post its check and merge.  `warnings` are about what the publish would ship, not whether it can: today, that a first publish exposes every source (see `DraftPublicationWarning`). They are read only when `ready` is true, and are empty otherwise.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary Whether the draft can be published now
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftPullRequest(organizationName, workspaceName, draftId, options) {
+        getDraftPublication(organizationName, workspaceName, draftId, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftPullRequest(organizationName, workspaceName, draftId, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftPublication(organizationName, workspaceName, draftId, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftPullRequest']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftPublication']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
             });
         },
         /**
-         * Thin proxy to the code-assist git-gateway\'s `listDraftCommits` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user; the branch/subtree binding to `draftId` is derived and enforced server-side by the gateway, not by this endpoint.  **Authorization**: Requires read access to the draft document (enforced by the gateway).  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary List commits on a git-backed draft\'s branch (History tab)
+         * Served from controlplane\'s record of the draft and nothing else: no GitHub read and no side effect, so polling it costs controlplane\'s own reads only. Always answers `200` for a draft the caller can read. `state` is `none` when the draft has no pull request, and a draft whose environment does not review on GitHub answers `state: none`, `reviewState: notSubmitted`, so a polling client treats absence as an answer, not an error.  `reviewState` says where the review stands and `nextAttemptAt` when it is next worked on; `unsubmittedChanges` says whether the draft has edits since its last push. Poll while `reviewState` is `sending` or a pull request is open, and stop otherwise.  `mergeable` is GitHub\'s own verdict as last recorded and is `null` while GitHub is still computing it. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary The draft\'s pull request and review state
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
-         * @param {number} [limit]
-         * @param {number} [offset]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDraftCommits(organizationName, workspaceName, draftId, limit, offset, options) {
+        getDraftPullRequest(organizationName, workspaceName, draftId, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.listDraftCommits(organizationName, workspaceName, draftId, limit, offset, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.getDraftPullRequest(organizationName, workspaceName, draftId, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.listDraftCommits']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.getDraftPullRequest']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
             });
         },
         /**
-         * The draft\'s files, **whichever storage backs them**. A git-backed draft\'s files live on its branch and a document-store draft\'s live as workspace documents; this answers for both, so a client never branches on the backing to read a draft\'s contents. That branch is the reason a draft\'s backing had to be known before its files could be fetched, which put an unrelated read on the critical path of every draft page.  Two shapes, both listings: the documents under `path` to `depth`, or — with `ref` — that same listing as of a commit. Git-backed drafts only for `ref`; a document-store draft has no history to address and ignores it.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing of the draft as it stands (no `ref`) reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A document-store draft never published is measured against the published version it was opened on, and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. Any other never-published draft, or a listing at a `ref`, carries no markers and no removed entries. When the comparison cannot be made (a git compare over the gateway\'s size limit, a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  What changed between two COMMITS is a different question — the History tab\'s — and has its own endpoint: `GET ../comparison`.  Content is omitted from the listing; read a document to get it.  **Authorization**: requires read access to the draft document.
+         * The draft\'s files: the documents under `path` to `depth`, held as workspace documents. `409` `draft-converting` while the draft is moving to the new store.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A draft never published is measured against the published version it was opened on (the package\'s latest version when none was recorded), and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. A baseline that exists but cannot be measured or read (an archive that failed to download) is `Changes-Unavailable` too, never \"nothing to compare against\". A never-published draft of a package with no published version carries no markers and no removed entries. When the comparison cannot be made (a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  Content is omitted from the listing unless `withContent=true`; otherwise read a document to get it.  **Authorization**: requires read access to the draft document.
          * @summary List a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} [path] Restrict the listing to this subtree, relative to the draft root.
-         * @param {number} [depth] `1` lists only the immediate children of `path`, as a file browser would. Omitted returns the whole subtree, which is what a section listing wants. The two are answered by different reads, so they differ in two ways a caller can see. A bounded depth returns directory entries as well as files; the whole subtree returns files only, since a directory is not a document and every caller of the depth-less listing filters to files anyway. And the whole subtree is refused with `413` for a draft holding a symlink or submodule, where a bounded depth lists around it.
-         * @param {string} [ref] Read the listing at this commit rather than at the branch tip. Accepts only a full 40-character sha reachable from the draft\'s branch. Ignored by a document-store draft, which has no commits.
+         * @param {number} [depth] `1` lists only the files directly under `path`, as a file browser would. Omitted returns every file in the subtree, which is what a section listing wants. A draft\'s paths are flat, so neither returns directory entries.
+         * @param {boolean} [withContent] Carry each document\'s content on its entry, so a caller that wants the whole draft makes one request rather than one per file. A document\'s text comes as `content`. A data file the draft holds beside its documents (`kind` `data`) carries neither, as in any listing. The listing is whole-draft or refused: past the same file-count and byte limits a checkpoint collects under, it answers `413` `draft-listing-too-large` rather than a partial one, and `limit` and `offset` do not lower what is read, only what is returned. Read the files one at a time instead.
          * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
          * @param {number} [offset] Number of items to skip before starting to return results
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDraftDocuments(organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options) {
+        listDraftDocuments(organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.listDraftDocuments(organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.listDraftDocuments(organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
                 const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.listDraftDocuments']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
@@ -5349,7 +5553,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish, the git stamps from a checkpoint or a merge. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields, which is how a stamp drops the git pointers a concurrent checkpoint had just written: a read taken a moment too early preserves stale ones.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
+         * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
          * @summary Update a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5368,44 +5572,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Changes where the branch points. `syncWithBase` brings it up to date with its environment\'s base branch. A `PATCH` on the branch rather than a `/sync` verb: moving a branch is a change to the branch, and the path names resources.  Calls the git-gateway\'s `syncDraftBranch` to merge the base branch into the draft\'s own branch, then writes the result to the draft\'s manifest as `metadata.git.package_base_sha` — the marker `writeDraftPullRequest` and `updateDraftPullRequest` check to clear `draft-behind-base`.  **Not a pure proxy.** The manifest write is this endpoint\'s own, and it is the half that matters: the gateway never writes a manifest (that boundary holds for every route in its API), so a caller going straight to the gateway would sync the branch and leave the marker unwritten. Both outcomes of the merge yield a SHA to freeze — the tip the gateway reports it absorbed, or, when the branch already contained the base tip, that tip itself, which GitHub\'s own `204` proves was already reachable.  A MERGE refused with `draft-behind-base` is recovered by this sync — pull-request creation already retries this automatically (see `writeDraftPullRequest`), but merging is the higher-authority operation and deliberately does not auto-sync, so the user sees what they are absorbing before it lands on the base branch.  A `409` is terminal either way, and the gateway\'s body sentinel says which: `sync-conflict` means GitHub reports the merge would CONFLICT, `sync-rejected` means GitHub rejected the merge request as invalid and will reject it again. In-product resolution is out of scope for both — resolve it directly on github.com against the draft\'s branch, or start a fresh draft.  **Authorization**: Requires the environment\'s `can_create_package` — the SAME bar `writeDraftPullRequest` takes, not the merge bar: syncing writes only to the draft\'s own branch, never the base branch.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Move the draft\'s branch
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        updateDraftBranch(organizationName, workspaceName, draftId, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.updateDraftBranch(organizationName, workspaceName, draftId, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.updateDraftBranch']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-        /**
-         * Advances the pull request\'s state. Merging is a transition of the pull request, not an action filed under it — `PATCH` on the resource rather than a `/merge` verb in the path, which is what every other resource in this API does.  Proxies the git-gateway\'s `mergeDraftPullRequest`. Squash-merges into the base branch and returns the merge commit SHA, which becomes the published version\'s `git_commit_sha` — the first provenance anchor reachable from the base branch.  `expectedHeadSha` is required and pins what is merged to what the caller read, so a checkpoint that landed after the review cannot be merged silently. Read it from `getDraftPullRequest` and pass it straight back. A `409` means the head moved, the pull request is gone, `publisher.json` names a version that already exists, or the package is known not to compile at this head (`draft-compile-failed`); a `405` means GitHub says the branch is not mergeable — a conflict, or a required review that has not passed.  The compile check is READ here, never run — it is started by `getDraftPullRequest` and can take minutes, so this call adds no compile latency. The consequence is that it refuses only a `failing` verdict already computed for this exact `expectedHeadSha`. `pending`, `unverified`, and a verdict this replica has not computed at all ALL allow the merge. Treat it as a guard against merging a known-broken package, not as a guarantee that a merged package compiled.  **Authorization**: Requires the environment\'s `can_update_project` (enforced by the gateway) — a strictly higher bar than opening the pull request, because a merge changes what serves for the whole environment.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Merge the draft\'s pull request
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {MergeDraftPullRequest} mergeDraftPullRequest
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        updateDraftPullRequest(organizationName, workspaceName, draftId, mergeDraftPullRequest, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.updateDraftPullRequest(organizationName, workspaceName, draftId, mergeDraftPullRequest, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.updateDraftPullRequest']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
-        /**
-         * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Always answers `202` with the current status: this call is a nudge, not the publish. The reconciler resolves the draft\'s current content itself when it collects the work — the git branch head for a git-backed draft, the doc-store tree otherwise — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
+         * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Answers `202` with the current status: this call is a nudge, not the publish. A draft that is moving to the new store answers `409` `draft-converting` and records nothing; retry after a moment. The reconciler resolves the draft\'s current content itself when it collects the work — the draft\'s documents — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
          * @summary Set the draft\'s checkpoint to its current content
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5423,7 +5590,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Creates or replaces a document, whichever storage backs the draft. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition depends on the storage, and each is refused on the other.** On a git-backed draft `expectedRef` is required and is the BRANCH HEAD the writer read at, not the document\'s own blob sha: the gateway refuses to build on anything but the branch\'s current tip, so a stale value means the draft moved under the writer. Take it from `getDraftDocument`\'s `ref`, and read the document at the head you intend to write against — reading the document first and the head second pairs content from one commit with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.  On a document-store draft the precondition is per file: `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Either is checked in the same statement that writes, so of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`. They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been. `expectedRef` is refused on a document-store draft, and `expectedSha` and `createOnly` are refused on a git-backed one, rather than ignored: a caller that sends a precondition believes it holds a guarantee.  On a document-store draft the server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment, on either backing. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. A git-backed write also commits into that environment\'s repository. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+         * Creates or replaces a document. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition is per file.** `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`, except that a resent write that already landed is answered as applied (below). They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been.  A retry whose change is already in place (the content is current, or the file to delete is gone) is answered as applied, not as a conflict, so a lost response can be resent. A deletion of a gone file with an `expectedSha` counts as applied only when no write in the same set is still to land: a move whose old path was deleted or moved by someone else is stale (`\"\"`), not a second copy.  The server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
          * @summary Write one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5443,7 +5610,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents rather than in either backing, so this works the same on a git-backed draft and a document-store draft, and never commits to a repository (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  When the path is one a git-backed draft holds as text (the small CSV case above), the text copy\'s removal is a commit at the branch head, and the upload carries the gateway\'s own answers for it, each listed on its status below: `409` `draft-provisioning` and `draft-file-stale-head`, `422` for an unprovisioned environment, GitHub\'s `429` with `Retry-After`, and a code-less `503`. On every one of them the upload is rolled back and the draft is as it was.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
+         * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`), or   ends in any other extension outside the formats a model reads as data: `.csv`,   `.tsv`, `.parquet`, `.xlsx`, `.json`, `.jsonl`, `.ndjson`, and `.csv.gz`, `.tsv.gz`,   `.json.gz`, `.jsonl.gz`, `.ndjson.gz` (an `.xls` is told to save as `.xlsx`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
          * @summary Upload a data file into a draft
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5463,7 +5630,7 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Writes a set of documents together. On a git-backed draft they land as **one commit**, which is the reason this exists beside the per-document `PUT`: seeding a draft from a package is a single logical change, and writing its files one at a time would put N commits in the History tab for one action — and leave a reader of any intermediate commit looking at half a package.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature: the seed, and a multi-file edit that should be reviewable as one diff.  `expectedRef` applies to the whole set, and a client-minted `intentTimestamp` resent byte-identical makes a retried write a replay rather than a second commit — which matters more here than for one document, since a lost response after an N-file commit is otherwise indistinguishable from a write that never landed.  On a document-store draft each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. The set stays all-or-nothing: if any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path.  **Authorization**: as `writeDraftDocument`.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. On a branch-backed draft the commit is made by the gateway, so the claim is checked just before it: a cancel that lands during that one commit can let it through, and the commit\'s `Turn-Work-Item` trailer records which item wrote it. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+         * Writes a set of documents together, in one transaction: a seed, or a multi-file edit that must not be seen half applied.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature.  Each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. If any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path; a set already partly in place (a resent one) commits only what remains.  **Authorization**: as `writeDraftDocument`.  **Resolving conflicts.** A member carrying the `conflictSha` that `getDraftConflicts` gave its path resolves that one conflict: the path leaves the conflict list and its base moves to the incoming side, so the next sync does not raise it again. With no content and no `deleted` the member keeps the draft\'s file as it is (an uploaded data file too), and only the conflict is cleared. Members without a `conflictSha` write as usual, and a write may resolve any subset of the list. A `conflictSha` that no longer names the path\'s conflict (the incoming side moved, or it was resolved) is `409` `draft-conflict-changed`, and nothing is written. Once none remain, the draft moves on to what came in, and a submitted draft\'s push starts. A resolution never fails on an archive: when the published version the last conflicts came from cannot be read, the draft\'s next sync moves its base instead.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
          * @summary Write several of a draft\'s documents as one change
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5483,41 +5650,24 @@ const DraftsApiFp = function (configuration) {
             });
         },
         /**
-         * Publishes the draft\'s bound package straight from its recorded merge commit, closing the loop after a pull request merges without a separate zip-upload publish. Panel-invoked rather than part of `updateDraftPullRequest`\'s own response — merge-click latency and proxy-timeout risk keep the two calls separate. `GitWebhookService` already publishes on merge on its own; this endpoint is the manual fallback the draft panel\'s own \"Publish\" button calls, for a merge whose webhook delivery was refused, lost, or raced the manifest\'s merge-commit stamp — safe to call more than once: a repeat answers 409, but so does a different publish having already taken that version id, and the two are told apart only by whether a served version carries this merge commit\'s own sha.  **Refuses (`409 draft-not-at-merge`) unless the manifest still carries a merge commit.** `updateDraftPullRequest` / `getDraftPullRequest` stamp `metadata.git.merge_commit_sha` best-effort and clear it the moment a checkpoint advances the draft past the merge, so a call made immediately after a merge can race a failed stamp. Reload the pull request (which repairs the stamp on the next qualified read) and retry.  Reads the package\'s subtree at the merge commit through the same draft reads the History/Files tabs use, so any file that cannot be read as UTF-8 text under 1MB refuses the whole publish (`409 draft-publish-unreadable-file`) rather than silently omitting it from the package.  Publishes only the manifest\'s own bound package (`metadata.git.package` / `metadata.git.environment`) — there is no way to name a different one.  **A successful publish closes the draft.** The draft and its branch are deleted, the branch delete pinned to the head that was published, when the draft is still at the merge this call published, no pull request is open on its branch, the publish did not create the package without attaching it to the workspace (`workspaceAttached: false`), the caller may delete the draft, and no agent sandbox turn is live on it. Otherwise the draft stays and the next change can continue it, as it does when the branch delete fails. A branch a published version records is kept while the draft is still deleted. The close never fails this call: the response is the publish\'s, and `publishedVersion` names the version it created.  **Authorization**: enforced where publishing already is — `createOrUpdatePackage`\'s own `can_create_package` / `can_update_package` check, re-run under the caller\'s principal.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Publish a git-backed draft\'s merged package
+         * The one way a draft ships, whether or not its environment reviews drafts on GitHub. Either the draft\'s package is published and this answers `200` with it, or nothing is published and it answers `409` `draft-not-ready` with `details.reason` saying what it waits on. Call it again once that clears: every step is safe to repeat, and a repeat after a publish answers with the version already published. `getDraftPublication` reads the same gates without acting on them.  **A draft whose environment does not review on GitHub** is published from its own files, in this order:  1. `conflicts`: the draft has unresolved conflicts (`details.conflictCount`). 2. `stale`: the package has a newer version than the one the draft is synced to;    the background sync brings it in. 3. `building` / `build-failed`: the draft\'s latest content has no passing build from    the last hour. A missing, pending or stale build is requested here and answers    `building`; a failing one answers `build-failed`, with the compiler\'s message. 4. The publish, `createOrUpdatePackage` naming this draft. The body\'s `description`    is written into the published `publisher.json`. A package that moved under the    draft while it published answers `stale`.  **A draft whose environment reviews on GitHub** merges its pull request and publishes the merge commit:  1. A draft whose pull request merged, and which has not changed since, goes straight    to the publish (8). One edited after its merge is a new pull request. While a    rebuild of a merged draft is pending this answers `building`: the build says    whether it holds an edit. A rebuild that failed on the merged content still    publishes the merge. One whose content cannot be compared answers `build-failed`    when it failed to compile, and `building` when it failed on Credible\'s side, which    this call asks to rebuild. 2. A push GitHub refused for good answers `push-refused`, with the reason in    `details.pushError`: `data_files_only`, `no_changes`, `content_refused`,    `review_outside_package`, `repository_too_large` or `push_refused`, until the    draft\'s content changes, which sends it again (`repository_too_large` only    fails again: see `push-refused` below). Otherwise a push is owed when the    draft has never been sent, has changed since its last push, or the body\'s    `title` / `description` differ from the pull request\'s; this call submits it. 3. `conflicts` (the draft\'s own, `details.conflictCount`) and `stale` (as above). 4. `sending` until the owed push lands and the pull request is open at it. 5. The build at the pull request\'s head must be a pass from the last hour. Otherwise    this call asks for one, which posts the head\'s check run once it settles, and    answers `building`, or `build-failed` for a failing one. 6. GitHub\'s mergeable state, as last recorded: `dirty` answers    `pull-request-conflicts` (the draft\'s own conflicts are step 3\'s `conflicts`, so    this one is resolved on GitHub), `draft` is read once more, as a press may follow    a pull request marked ready, and answers `pull-request-draft` if it still is (or    if GitHub cannot be read), and a state GitHub has not computed is read once more    and otherwise answers `sending`. `blocked`    with a passing build re-posts the head\'s passing check run, since a check run left    from an earlier answer can be what blocks it, and goes on to the merge. `behind`    alone does not refuse: the merge itself refuses a base branch that changed the    package. 7. The package at the head is listed once and refused for what a publish cannot    carry: `draft-publish-unreadable-file`, `draft-publish-too-large`, or    `draft-publish-manifest-missing` (no `publisher.json`). 8. The pull request is merged at that head, confined to the package and only while    the base branch has not changed the package since the draft\'s base, and the merge    commit is published. GitHub refusing the merge answers `pull-request-blocked`    (a required review or check is outstanding), a base branch that changed the    package `stale`, a head that moved `sending`, and a pull request that changes files    outside the package `push-refused` with `details.pushError`    `review_outside_package`: a merge here never carries them onto the base branch, so    they are reconciled on GitHub. A refusal because the pull request already merged    (a second Publish racing the first) publishes that merge.    Until the merge\'s version exists this answers `publishing` (the webhook or the    merge record holds it, or GitHub\'s merge time is not read yet); call again,    which never merges twice.  **A successful publish closes the draft**, as the publish of a draft always has: the draft and its branch are deleted unless it changed meanwhile, a pull request is open on its branch, the publish created the package without attaching it to the workspace (`workspaceAttached: false`), or an agent sandbox turn is live on it. The close never fails this call; `publishedVersion` names the version published, or the existing one that already carries this merge.  **Authorization**: the draft\'s modeling bar (`can_create_document` on the workspace, `can_create_package` on its environment) and `can_update_package` on a package that already exists; the publish itself re-checks them.  `409` `draft-converting` means the draft is moving to the new store; retry. A `400` is the publish refusing the package itself (an archive it cannot read, a name it does not accept).
+         * @summary Publish the draft
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
+         * @param {DraftPublicationRequest} [draftPublicationRequest]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        writeDraftPublication(organizationName, workspaceName, draftId, options) {
+        writeDraftPublication(organizationName, workspaceName, draftId, draftPublicationRequest, options) {
             return __awaiter(this, void 0, void 0, function* () {
                 var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.writeDraftPublication(organizationName, workspaceName, draftId, options);
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.writeDraftPublication(organizationName, workspaceName, draftId, draftPublicationRequest, options);
                 const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
                 const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.writeDraftPublication']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
                 return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
             });
         },
-        /**
-         * Proxies the code-assist git-gateway\'s `createDraftPullRequest`, forwarding the caller\'s own bearer token exactly as the History operations do. The gateway remains the sole authorizer; this endpoint performs no authorization of its own.  Idempotent — an already-open pull request for this draft comes back rather than a second one.  **Not a pure proxy: this call can sync and retry on your behalf.** A draft whose package already exists on the base branch — most commonly because this draft\'s own earlier pull request already merged it — is refused `409 draft-behind-base` unless it can be shown to derive from the base branch\'s current tip. Rather than surfacing that refusal immediately, this endpoint calls `updateDraftBranch`\'s own implementation, which merges the base branch into the draft\'s branch and writes `metadata.git.package_base_sha` on the draft\'s manifest from what that sync proves, then retries the create exactly once. Only a second refusal (a real race, or a draft whose package belongs to another name entirely) reaches the caller as `409`. A `sync-conflict` or `sync-rejected` from that internal sync surfaces as its own clear refusal, naming the manual paths out (resolve on github.com, or start a fresh draft) — resolve it there, or call `updateDraftBranch` directly for the same outcome without going through this endpoint.  **Authorization**: Requires the environment\'s `can_create_package` (enforced by the gateway) — proposing a change is the same authority as writing the draft.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Open a pull request for a git-backed draft
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        writeDraftPullRequest(organizationName, workspaceName, draftId, options) {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
-                const localVarAxiosArgs = yield localVarAxiosParamCreator.writeDraftPullRequest(organizationName, workspaceName, draftId, options);
-                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
-                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['DraftsApi.writeDraftPullRequest']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
-                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-            });
-        },
     };
 };
 exports.DraftsApiFp = DraftsApiFp;
@@ -5529,7 +5679,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.DraftsApiFp)(configuration);
     return {
         /**
-         * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  **A git-backed draft\'s branch is created here too.** In a git-enrolled environment this provisions the branch and records the binding — repository, branch, package directory, base branch — before returning, so a caller either gets a complete draft or gets none. Assembled afterwards by separate writers there is no transaction to hold them together, and a failure part-way leaves a draft naming a branch that does not exist.  The binding is **not alterable through update, move or create** afterwards: the checkpoint collector resolves the subtree from `packagePath` and a merge\'s auto-publish resolves the owning environment from `git.environment`, so changing either would orphan what is already committed. Through the documents API, a request that introduces, removes or alters the binding or the draft\'s target answers `409 draft-binding-immutable`; a request that omits `git` keeps the stored block. Deleting the draft is still how a bound manifest goes away.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
+         * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  Every draft is a document-store draft, in a git-enrolled environment as in any other: the draft\'s files are workspace documents, and git is only where a pushed draft goes for review.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
          * @summary Create a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5541,7 +5691,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.createDraft(organizationName, workspaceName, draftCreateRequest, options).then((request) => request(axios, basePath));
         },
         /**
-         * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2). Branch removal was inherited from the document model — documents are deletable, so a draft\'s branch looked like it had to go too — and every failure mode of that obligation had to be handled. Git\'s model is the opposite: branches accumulate and tidying is a convenience. Once a draft has had a pull request, GitHub retains `refs/pull/N/head` permanently, so deleting the branch would not remove the content anyway. Removing a branch is `DELETE .../drafts/{draftId}/branch`, and the one case worth tidying — a branch nothing was ever committed to — is the caller\'s to decide. The other case is server-side: a successful publish closes the draft and deletes its branch with it (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
+         * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch usually lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2), with one server-side exception: a draft that was never published and still sits at its seed commit has its branch deleted first, best-effort, so a draft minted from a misread intent leaves nothing behind. The delete is pinned to the seed commit, so a commit that landed since keeps the branch; the pin is not a compare-and-swap, so a commit landing in the instant between the gateway\'s tip re-read and its delete is lost. A failed branch delete never blocks the draft\'s delete, and retrying after a partial failure finds the branch already gone. Every other branch is removed by `DELETE .../drafts/{draftId}/branch`, or by the close after a successful publish (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
          * @summary Delete a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5553,7 +5703,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.deleteDraft(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo. See `listDraftCommits` for the auth-forwarding notes.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  One product path calls this, and only one: since the 2026-08-15 \"branches live on\" decision (docs/git-synced-modeling.md §7.2) deleting a draft deletes the manifest and leaves the branch, so the agent\'s `delete_file` cascade makes no branch call at all, and the app\'s delete tidies the branch only for a draft nothing was ever committed to (the §7.2 amendment of 2026-08-24). Otherwise it is the primitive operator tooling needs — see docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
+         * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo, forwarding the caller\'s own bearer token.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  Stays as the primitive operator tooling needs: `deleteDraft` deletes an untouched draft\'s branch at its seed commit on the server (docs/git-synced-modeling.md §7.2), so neither the app nor the agent needs to call this. See docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
          * @summary Delete a git-backed draft\'s branch
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5565,28 +5715,28 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.deleteDraftBranch(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * Removes a document from the draft, whichever storage backs it. On a git-backed draft this is a commit that deletes the file, under the same precondition a write takes; on a document-store draft it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
+         * Removes a document from the draft: it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
          * @summary Delete one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The document\'s path relative to the draft root
-         * @param {string} [expectedRef] The branch head the caller read at. For a text document on a git-backed draft it is required; for a data file there it is ignored, since a data file\'s delete is not a commit. Refused for a document-store draft, data file or not — there is no commit to compare it against. See `writeDraftDocument` for why it is the branch head rather than the document\'s own sha.
-         * @param {string} [expectedSha] The `sha` the caller read the document at. Document-store drafts only, refused for a git-backed one: the delete applies only if the document still holds that version, else `409` `draft-document-stale`.
+         * @param {string} [expectedSha] The `sha` the caller read the document at: the delete applies only if the document still holds that version, else `409` `draft-document-stale`; a file already gone counts as deleted when this is the whole request, so a lost response can be resent.
+         * @param {string} [expectedRef] Deprecated: use `expectedSha`. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options) {
-            return localVarFp.deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options).then((request) => request(axios, basePath));
+        deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options) {
+            return localVarFp.deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options).then((request) => request(axios, basePath));
         },
         /**
-         * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. `expectedRef` is optional   here, as it is absent on a data file\'s delete: when given on a git-backed draft, the   commit that writes a small published copy back builds on it (`409   draft-file-stale-head` if the branch has moved since), and on the branch\'s current   head when it is not given. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included; `503` `draft-changes-unavailable` when its changes could not be compared with its publication.  **Authorization** — the same pair `writeDraftDocument` takes.
+         * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included. Before any change is found, the comparison itself can be refused, with the answers a read of the baseline gives: `403` when the caller cannot read the package the draft is measured against, `409` `draft-publication-baseline-missing` when that baseline cannot be measured (a corrupt archive), and `503` `draft-changes-unavailable` when it could not be read.  **Authorization** — the same pair `writeDraftDocument` takes.
          * @summary Restore one of a draft\'s files to its published copy
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The file\'s path relative to the draft root
-         * @param {string} [expectedRef] The branch head the caller read at, for a git-backed draft where the restore is a commit: required for a text file, optional for a data file (used as the compare-and-swap base when a small published copy is written back as a document); refused for a document-store draft.
+         * @param {string} [expectedRef] Deprecated: a restore takes no precondition. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -5606,16 +5756,16 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getDraft(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * The branch a git-backed draft\'s files live on, and where it currently points. The tip is a property of the branch, so it is read from the branch rather than from an endpoint of its own.  Thin proxy to the code-assist git-gateway\'s `getDraftHead` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user.  NOT `listDraftCommits(limit=1)`\'s `sha`: that read is filtered to the draft\'s own package subtree, so a commit that lands on the branch without touching it (e.g. `syncDraftBranch`) never advances it — a caller building a checkpoint\'s `expectedHeadSha` from that filtered read can 409 against the real, unfiltered CAS forever. This endpoint returns that real tip.  **Authorization**: Requires read access to the draft document (enforced by the gateway) — the same bar `listDraftCommits` and `getDraftDocument` take.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary The draft\'s branch
+         * The draft\'s capabilities, derived by the server from its environment and what its package has published. The same value `getDraft` carries as `capabilities`, for a caller that does not need the rest of the draft: it reads the draft\'s manifest, its review state and one published-version lookup, not the checkpoint or the files.  A draft that is moving to the new store answers `409` `draft-converting`: retry.  **Authorization**: requires read access to the draft document.
+         * @summary What the draft\'s storage can do
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftBranch(organizationName, workspaceName, draftId, options) {
-            return localVarFp.getDraftBranch(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
+        getDraftCapabilities(organizationName, workspaceName, draftId, options) {
+            return localVarFp.getDraftCapabilities(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
          * Reports where the draft\'s environment package stands. Always answers `200`; `status` is `none` before the first checkpoint is requested, so a polling client does not treat absence as an error.  **A pure read**, and the cheap one: this is what a client polls while a checkpoint is unsettled. It performs no write and starts no publish.  This is a pure read. Resurrecting an idle-reaped draft package is a `POST` to `../checkpoints`, so that a publish into a live environment follows from an explicit request rather than from whichever tab last refreshed. `resurrectable` on the response says whether such a request would rebuild anything.  **Authorization**: requires read access to the draft document, the same bar as the other draft reads.
@@ -5630,23 +5780,34 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getDraftCheckpointStatus(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * The documents that differ between `base` and `head`, each with how it changed and, where the gateway supplies one, its patch.  Its own resource rather than a mode of the document listing: the listing already reports each document against the draft\'s last publication (`changeSincePublication`), and this answers what moved between any two commits — the History tab\'s question. An entry here can name two paths at once (`renamed`), and folding commit-to-commit diffs into the listing would mean an item schema whose fields were populated or `null` depending on which query parameters the caller happened to send.  **Git-backed drafts only.** A document-store draft has no commits to compare, so the question does not apply to it rather than having no answer: it is a `400` `draft-not-git-backed`, the same refusal every git-only draft operation gives, and `409` `draft-provisioning` while the branch is still being cut. The `422` below is the gateway\'s own, for an environment that is not provisioned.  **Authorization**: requires read access to the draft document, the same bar as the document listing.
-         * @summary What changed between two commits of a draft
+         * One entry of `getDraftConflicts` with the incoming side\'s, the draft\'s and their common ancestor\'s version of the file, so the caller can reconcile them and write the result through `writeDraftDocuments` with the `conflictSha` this returns.  **Authorization**: requires read access to the draft document, and `can_create_package` on the environment it targets: only a modeler can act on what this serves.  `404` when the path has no conflict (it was resolved, or never conflicted).
+         * @summary One conflicting file, with all three of its versions
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
-         * @param {string} base The commit to compare FROM. A full 40-character sha reachable from the draft\'s branch.
-         * @param {string} head The commit to compare TO. Same form as `base`.
-         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
+         * @param {string} documentPath The conflicting file\'s path relative to the draft root, as `getDraftConflicts` lists it.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getDraftConflict(organizationName, workspaceName, draftId, documentPath, options) {
+            return localVarFp.getDraftConflict(organizationName, workspaceName, draftId, documentPath, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * A page of the draft\'s conflicts: every path both the draft and what came in changed since their common ancestor, where what came in is a newer published version of its package (the base moved) or a commit someone pushed to its pull request. A superset of what cannot merge on its own, because nothing here runs a merge. Ordered by `relpath`.  Each entry says where its incoming side came from, and carries the `conflictSha` a resolution sends back through `writeDraftDocuments`, a member per file. `getDraftConflict` returns one file\'s three versions.  An empty list means nothing waits on the author: what only one side changed is absorbed in the background. Conflicts never block editing or a Submit; a submitted draft\'s push waits for the last one to be resolved and then starts on its own.  Served from controlplane\'s record alone: no file content, no archive read and no GitHub call.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary The files the draft and what came in both changed
+         * @param {string} organizationName The unique identifier of the organization
+         * @param {string} workspaceName The unique identifier of the workspace
+         * @param {string} draftId The draft package identifier
+         * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
          * @param {number} [offset] Number of items to skip before starting to return results
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftComparison(organizationName, workspaceName, draftId, base, head, limit, offset, options) {
-            return localVarFp.getDraftComparison(organizationName, workspaceName, draftId, base, head, limit, offset, options).then((request) => request(axios, basePath));
+        getDraftConflicts(organizationName, workspaceName, draftId, limit, offset, options) {
+            return localVarFp.getDraftConflicts(organizationName, workspaceName, draftId, limit, offset, options).then((request) => request(axios, basePath));
         },
         /**
-         * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-provisioning` while the draft\'s storage is still being set up; on a git-backed draft the branch is read through the gateway, with its `409`, `422`, `429` and `503` answers; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
+         * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-converting` while the draft is moving to the new store; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
          * @summary Download a draft package as a zip
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5658,13 +5819,13 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getDraftContent(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * One document\'s content, whichever storage backs the draft. See `listDraftDocuments` for why the backing is not the caller\'s concern.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: for a git-backed draft, the draft-branch commit its last publish shipped (`publishedAs.commitSha`); for a document-store draft, the stored archive of its last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: on a document-store draft, the caller can read the draft but not the   package whose archive the baseline is. The archive is the package\'s, and   workspace access does not imply environment access, so this read also takes   `can_read_package` on it. A git-backed baseline is the draft\'s own branch. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded, or a published   commit no longer on the draft\'s branch. Permanent until the draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  On a document-store draft the content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`. `ref` is null on a document-store answer; on a git answer it names the published commit, which is NOT a head a compare-and-swap write can build on — read the head separately before writing.  **Authorization**: requires read access to the draft document.
+         * One document\'s content. `409` `draft-converting` while the draft is moving to the new store.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: the stored archive of the draft\'s last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: the caller can read the draft but not the package whose stored archive is the   baseline. Workspace access does not imply environment access, so this read also   takes `can_read_package` on it. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded. Permanent until the   draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  The content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`.  **Authorization**: requires read access to the draft document.
          * @summary Read one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} documentPath The document\'s path relative to the draft root
-         * @param {string} [ref] Read at this commit rather than at the branch tip. A commit is honored on git-backed drafts only; a document-store draft has no commits and reads its current content whatever commit is named. The literal `publication` is reserved, on either backing: it reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case) and never forwarded to git, so it cannot be mistaken for a commit, which is hexadecimal. Prefer the one-call pairing: the response\'s `ref` names the commit the content was read at. A writer that intends to send the content back under a compare-and-swap must read the head first and then the document AT that head — reading the document first and the head second yields content from one commit paired with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.
+         * @param {string} [ref] The literal `publication` reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case). Any other value is ignored: a draft keeps no commits to read at.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -5672,7 +5833,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getDraftDocument(organizationName, workspaceName, draftId, documentPath, ref, options).then((request) => request(axios, basePath));
         },
         /**
-         * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-provisioning` while the draft\'s storage is still being set up.  A file a git-backed draft\'s branch holds that cannot be served as text (over 1 MiB, or not UTF-8) answers `413` `draft-file-unreadable`, as `getDraftDocument` does: the branch is read as text only, so there are no bytes to serve. An uploaded data file never takes this path. On a git-backed draft the branch read is `getDraftDocument`\'s, and carries its `409`, `422`, `429` and `503` answers.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
+         * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-converting` while the draft is moving to the new store.  A text document that cannot be served as text (1 MiB or more) answers `413` `draft-file-unreadable`, as `getDraftDocument` does. An uploaded data file never takes this path.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
          * @summary Download one of a draft\'s files
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5685,47 +5846,45 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getDraftDocumentContent(organizationName, workspaceName, draftId, documentPath, options).then((request) => request(axios, basePath));
         },
         /**
-         * Proxies the git-gateway\'s `getDraftPullRequest`. Always answers `200`; `state` is `none` when the draft has no pull request, so a polling client does not have to treat absence as an error.  `mergeable` is GitHub\'s own verdict and is `null` while GitHub is still computing it — a routine answer for a freshly opened pull request. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Not a pure proxy: reading an open pull request also starts the compile check.** `compileVerdict` reports whether the package compiles at the current `headSha`, and the first read of a new head starts that check rather than waiting for it — so a `pending` verdict is the normal first answer, resolved by a later poll. A client that polls this endpoint therefore needs no separate call, and needs to make none when the verdict is already `passing` or `failing` for the head it holds.  **A read can also close a merged and published draft.** When the close that follows a publish was skipped or deferred (most often because the merge created a package the publish could not attach to the workspace), a read of the merged pull request finishes it: it attaches that package to the workspace, then deletes the draft and its branch. Afterwards the draft reads `403`, like any deleted draft.  **Authorization**: Requires read access to the draft document (enforced by the gateway). The three side effects this read can have carry their own, higher bars and are SKIPPED rather than refused when the caller lacks them, so the read itself never fails for a permission: recording an observed merge takes the draft\'s `can_update_document`, computing `compileVerdict` takes the environment\'s `can_create_package` (see that field), and closing a published draft takes the draft\'s `can_delete_document`, plus the package\'s `can_share_package` when it attaches a package first. A read below a bar returns the same pull request with that part left undone for the next qualified caller.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary The draft\'s pull request, read live from GitHub
+         * The gates `writeDraftPublication` applies, read without acting on any of them: no submit, no build request, no merge and no listing of the package on GitHub, so it costs database reads only. `ready` false comes with the `reason` the publish would answer now. `ready` true means every gate this read covers passed; the publish\'s own listing of the package at the pull request\'s head can still refuse it. `ready` says nothing about the caller: a reader who may not publish reads it too, and the publish refuses them `403`.  A draft that is owed a push or a build reads `sending` or `building` here, and only `writeDraftPublication` starts them. A `blocked` pull request reads `pull-request-blocked` here even when the publish would re-post its check and merge.  `warnings` are about what the publish would ship, not whether it can: today, that a first publish exposes every source (see `DraftPublicationWarning`). They are read only when `ready` is true, and are empty otherwise.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary Whether the draft can be published now
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        getDraftPullRequest(organizationName, workspaceName, draftId, options) {
-            return localVarFp.getDraftPullRequest(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
+        getDraftPublication(organizationName, workspaceName, draftId, options) {
+            return localVarFp.getDraftPublication(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * Thin proxy to the code-assist git-gateway\'s `listDraftCommits` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user; the branch/subtree binding to `draftId` is derived and enforced server-side by the gateway, not by this endpoint.  **Authorization**: Requires read access to the draft document (enforced by the gateway).  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary List commits on a git-backed draft\'s branch (History tab)
+         * Served from controlplane\'s record of the draft and nothing else: no GitHub read and no side effect, so polling it costs controlplane\'s own reads only. Always answers `200` for a draft the caller can read. `state` is `none` when the draft has no pull request, and a draft whose environment does not review on GitHub answers `state: none`, `reviewState: notSubmitted`, so a polling client treats absence as an answer, not an error.  `reviewState` says where the review stands and `nextAttemptAt` when it is next worked on; `unsubmittedChanges` says whether the draft has edits since its last push. Poll while `reviewState` is `sending` or a pull request is open, and stop otherwise.  `mergeable` is GitHub\'s own verdict as last recorded and is `null` while GitHub is still computing it. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+         * @summary The draft\'s pull request and review state
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
-         * @param {number} [limit]
-         * @param {number} [offset]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDraftCommits(organizationName, workspaceName, draftId, limit, offset, options) {
-            return localVarFp.listDraftCommits(organizationName, workspaceName, draftId, limit, offset, options).then((request) => request(axios, basePath));
+        getDraftPullRequest(organizationName, workspaceName, draftId, options) {
+            return localVarFp.getDraftPullRequest(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * The draft\'s files, **whichever storage backs them**. A git-backed draft\'s files live on its branch and a document-store draft\'s live as workspace documents; this answers for both, so a client never branches on the backing to read a draft\'s contents. That branch is the reason a draft\'s backing had to be known before its files could be fetched, which put an unrelated read on the critical path of every draft page.  Two shapes, both listings: the documents under `path` to `depth`, or — with `ref` — that same listing as of a commit. Git-backed drafts only for `ref`; a document-store draft has no history to address and ignores it.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing of the draft as it stands (no `ref`) reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A document-store draft never published is measured against the published version it was opened on, and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. Any other never-published draft, or a listing at a `ref`, carries no markers and no removed entries. When the comparison cannot be made (a git compare over the gateway\'s size limit, a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  What changed between two COMMITS is a different question — the History tab\'s — and has its own endpoint: `GET ../comparison`.  Content is omitted from the listing; read a document to get it.  **Authorization**: requires read access to the draft document.
+         * The draft\'s files: the documents under `path` to `depth`, held as workspace documents. `409` `draft-converting` while the draft is moving to the new store.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A draft never published is measured against the published version it was opened on (the package\'s latest version when none was recorded), and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. A baseline that exists but cannot be measured or read (an archive that failed to download) is `Changes-Unavailable` too, never \"nothing to compare against\". A never-published draft of a package with no published version carries no markers and no removed entries. When the comparison cannot be made (a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  Content is omitted from the listing unless `withContent=true`; otherwise read a document to get it.  **Authorization**: requires read access to the draft document.
          * @summary List a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
          * @param {string} [path] Restrict the listing to this subtree, relative to the draft root.
-         * @param {number} [depth] `1` lists only the immediate children of `path`, as a file browser would. Omitted returns the whole subtree, which is what a section listing wants. The two are answered by different reads, so they differ in two ways a caller can see. A bounded depth returns directory entries as well as files; the whole subtree returns files only, since a directory is not a document and every caller of the depth-less listing filters to files anyway. And the whole subtree is refused with `413` for a draft holding a symlink or submodule, where a bounded depth lists around it.
-         * @param {string} [ref] Read the listing at this commit rather than at the branch tip. Accepts only a full 40-character sha reachable from the draft\'s branch. Ignored by a document-store draft, which has no commits.
+         * @param {number} [depth] `1` lists only the files directly under `path`, as a file browser would. Omitted returns every file in the subtree, which is what a section listing wants. A draft\'s paths are flat, so neither returns directory entries.
+         * @param {boolean} [withContent] Carry each document\'s content on its entry, so a caller that wants the whole draft makes one request rather than one per file. A document\'s text comes as `content`. A data file the draft holds beside its documents (`kind` `data`) carries neither, as in any listing. The listing is whole-draft or refused: past the same file-count and byte limits a checkpoint collects under, it answers `413` `draft-listing-too-large` rather than a partial one, and `limit` and `offset` do not lower what is read, only what is returned. Read the files one at a time instead.
          * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
          * @param {number} [offset] Number of items to skip before starting to return results
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDraftDocuments(organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options) {
-            return localVarFp.listDraftDocuments(organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options).then((request) => request(axios, basePath));
+        listDraftDocuments(organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options) {
+            return localVarFp.listDraftDocuments(organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options).then((request) => request(axios, basePath));
         },
         /**
          * The workspace\'s drafts, each as the same `Draft` the item endpoint returns.  **This is how a surface finds drafts.** Before it existed the only way was to list every document in the workspace and filter on type and path prefix, which meant the sidebar, the scope chips and the edit-package flow each pulled every file of every draft in the workspace to render a handful of rows. Composed server-side, one query against the checkpoint rows rather than one request per draft.  **Authorization**: requires read access to the workspace, and each draft is filtered to those the caller can read — the same two-stage bar `listDocuments` applies, since a draft\'s authorization object is still its manifest document.
@@ -5742,7 +5901,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.listDrafts(organizationName, workspaceName, retired, limit, offset, options).then((request) => request(axios, basePath));
         },
         /**
-         * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish, the git stamps from a checkpoint or a merge. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields, which is how a stamp drops the git pointers a concurrent checkpoint had just written: a read taken a moment too early preserves stale ones.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
+         * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
          * @summary Update a draft package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5755,32 +5914,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.updateDraft(organizationName, workspaceName, draftId, draftUpdate, options).then((request) => request(axios, basePath));
         },
         /**
-         * Changes where the branch points. `syncWithBase` brings it up to date with its environment\'s base branch. A `PATCH` on the branch rather than a `/sync` verb: moving a branch is a change to the branch, and the path names resources.  Calls the git-gateway\'s `syncDraftBranch` to merge the base branch into the draft\'s own branch, then writes the result to the draft\'s manifest as `metadata.git.package_base_sha` — the marker `writeDraftPullRequest` and `updateDraftPullRequest` check to clear `draft-behind-base`.  **Not a pure proxy.** The manifest write is this endpoint\'s own, and it is the half that matters: the gateway never writes a manifest (that boundary holds for every route in its API), so a caller going straight to the gateway would sync the branch and leave the marker unwritten. Both outcomes of the merge yield a SHA to freeze — the tip the gateway reports it absorbed, or, when the branch already contained the base tip, that tip itself, which GitHub\'s own `204` proves was already reachable.  A MERGE refused with `draft-behind-base` is recovered by this sync — pull-request creation already retries this automatically (see `writeDraftPullRequest`), but merging is the higher-authority operation and deliberately does not auto-sync, so the user sees what they are absorbing before it lands on the base branch.  A `409` is terminal either way, and the gateway\'s body sentinel says which: `sync-conflict` means GitHub reports the merge would CONFLICT, `sync-rejected` means GitHub rejected the merge request as invalid and will reject it again. In-product resolution is out of scope for both — resolve it directly on github.com against the draft\'s branch, or start a fresh draft.  **Authorization**: Requires the environment\'s `can_create_package` — the SAME bar `writeDraftPullRequest` takes, not the merge bar: syncing writes only to the draft\'s own branch, never the base branch.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Move the draft\'s branch
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        updateDraftBranch(organizationName, workspaceName, draftId, options) {
-            return localVarFp.updateDraftBranch(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Advances the pull request\'s state. Merging is a transition of the pull request, not an action filed under it — `PATCH` on the resource rather than a `/merge` verb in the path, which is what every other resource in this API does.  Proxies the git-gateway\'s `mergeDraftPullRequest`. Squash-merges into the base branch and returns the merge commit SHA, which becomes the published version\'s `git_commit_sha` — the first provenance anchor reachable from the base branch.  `expectedHeadSha` is required and pins what is merged to what the caller read, so a checkpoint that landed after the review cannot be merged silently. Read it from `getDraftPullRequest` and pass it straight back. A `409` means the head moved, the pull request is gone, `publisher.json` names a version that already exists, or the package is known not to compile at this head (`draft-compile-failed`); a `405` means GitHub says the branch is not mergeable — a conflict, or a required review that has not passed.  The compile check is READ here, never run — it is started by `getDraftPullRequest` and can take minutes, so this call adds no compile latency. The consequence is that it refuses only a `failing` verdict already computed for this exact `expectedHeadSha`. `pending`, `unverified`, and a verdict this replica has not computed at all ALL allow the merge. Treat it as a guard against merging a known-broken package, not as a guarantee that a merged package compiled.  **Authorization**: Requires the environment\'s `can_update_project` (enforced by the gateway) — a strictly higher bar than opening the pull request, because a merge changes what serves for the whole environment.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Merge the draft\'s pull request
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {MergeDraftPullRequest} mergeDraftPullRequest
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        updateDraftPullRequest(organizationName, workspaceName, draftId, mergeDraftPullRequest, options) {
-            return localVarFp.updateDraftPullRequest(organizationName, workspaceName, draftId, mergeDraftPullRequest, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Always answers `202` with the current status: this call is a nudge, not the publish. The reconciler resolves the draft\'s current content itself when it collects the work — the git branch head for a git-backed draft, the doc-store tree otherwise — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
+         * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Answers `202` with the current status: this call is a nudge, not the publish. A draft that is moving to the new store answers `409` `draft-converting` and records nothing; retry after a moment. The reconciler resolves the draft\'s current content itself when it collects the work — the draft\'s documents — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
          * @summary Set the draft\'s checkpoint to its current content
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5792,7 +5926,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.writeDraftCheckpoint(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
         },
         /**
-         * Creates or replaces a document, whichever storage backs the draft. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition depends on the storage, and each is refused on the other.** On a git-backed draft `expectedRef` is required and is the BRANCH HEAD the writer read at, not the document\'s own blob sha: the gateway refuses to build on anything but the branch\'s current tip, so a stale value means the draft moved under the writer. Take it from `getDraftDocument`\'s `ref`, and read the document at the head you intend to write against — reading the document first and the head second pairs content from one commit with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.  On a document-store draft the precondition is per file: `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Either is checked in the same statement that writes, so of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`. They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been. `expectedRef` is refused on a document-store draft, and `expectedSha` and `createOnly` are refused on a git-backed one, rather than ignored: a caller that sends a precondition believes it holds a guarantee.  On a document-store draft the server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment, on either backing. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. A git-backed write also commits into that environment\'s repository. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+         * Creates or replaces a document. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition is per file.** `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`, except that a resent write that already landed is answered as applied (below). They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been.  A retry whose change is already in place (the content is current, or the file to delete is gone) is answered as applied, not as a conflict, so a lost response can be resent. A deletion of a gone file with an `expectedSha` counts as applied only when no write in the same set is still to land: a move whose old path was deleted or moved by someone else is stale (`\"\"`), not a second copy.  The server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
          * @summary Write one of a draft\'s documents
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5806,7 +5940,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.writeDraftDocument(organizationName, workspaceName, draftId, documentPath, draftDocumentWrite, options).then((request) => request(axios, basePath));
         },
         /**
-         * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents rather than in either backing, so this works the same on a git-backed draft and a document-store draft, and never commits to a repository (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  When the path is one a git-backed draft holds as text (the small CSV case above), the text copy\'s removal is a commit at the branch head, and the upload carries the gateway\'s own answers for it, each listed on its status below: `409` `draft-provisioning` and `draft-file-stale-head`, `422` for an unprovisioned environment, GitHub\'s `429` with `Retry-After`, and a code-less `503`. On every one of them the upload is rolled back and the draft is as it was.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
+         * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`), or   ends in any other extension outside the formats a model reads as data: `.csv`,   `.tsv`, `.parquet`, `.xlsx`, `.json`, `.jsonl`, `.ndjson`, and `.csv.gz`, `.tsv.gz`,   `.json.gz`, `.jsonl.gz`, `.ndjson.gz` (an `.xls` is told to save as `.xlsx`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
          * @summary Upload a data file into a draft
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5820,7 +5954,7 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.writeDraftDocumentContent(organizationName, workspaceName, draftId, documentPath, body, options).then((request) => request(axios, basePath));
         },
         /**
-         * Writes a set of documents together. On a git-backed draft they land as **one commit**, which is the reason this exists beside the per-document `PUT`: seeding a draft from a package is a single logical change, and writing its files one at a time would put N commits in the History tab for one action — and leave a reader of any intermediate commit looking at half a package.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature: the seed, and a multi-file edit that should be reviewable as one diff.  `expectedRef` applies to the whole set, and a client-minted `intentTimestamp` resent byte-identical makes a retried write a replay rather than a second commit — which matters more here than for one document, since a lost response after an N-file commit is otherwise indistinguishable from a write that never landed.  On a document-store draft each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. The set stays all-or-nothing: if any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path.  **Authorization**: as `writeDraftDocument`.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. On a branch-backed draft the commit is made by the gateway, so the claim is checked just before it: a cancel that lands during that one commit can let it through, and the commit\'s `Turn-Work-Item` trailer records which item wrote it. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+         * Writes a set of documents together, in one transaction: a seed, or a multi-file edit that must not be seen half applied.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature.  Each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. If any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path; a set already partly in place (a resent one) commits only what remains.  **Authorization**: as `writeDraftDocument`.  **Resolving conflicts.** A member carrying the `conflictSha` that `getDraftConflicts` gave its path resolves that one conflict: the path leaves the conflict list and its base moves to the incoming side, so the next sync does not raise it again. With no content and no `deleted` the member keeps the draft\'s file as it is (an uploaded data file too), and only the conflict is cleared. Members without a `conflictSha` write as usual, and a write may resolve any subset of the list. A `conflictSha` that no longer names the path\'s conflict (the incoming side moved, or it was resolved) is `409` `draft-conflict-changed`, and nothing is written. Once none remain, the draft moves on to what came in, and a submitted draft\'s push starts. A resolution never fails on an archive: when the published version the last conflicts came from cannot be read, the draft\'s next sync moves its base instead.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
          * @summary Write several of a draft\'s documents as one change
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
@@ -5834,28 +5968,17 @@ const DraftsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.writeDraftDocuments(organizationName, workspaceName, draftId, draftDocumentsWrite, workItemClaim, options).then((request) => request(axios, basePath));
         },
         /**
-         * Publishes the draft\'s bound package straight from its recorded merge commit, closing the loop after a pull request merges without a separate zip-upload publish. Panel-invoked rather than part of `updateDraftPullRequest`\'s own response — merge-click latency and proxy-timeout risk keep the two calls separate. `GitWebhookService` already publishes on merge on its own; this endpoint is the manual fallback the draft panel\'s own \"Publish\" button calls, for a merge whose webhook delivery was refused, lost, or raced the manifest\'s merge-commit stamp — safe to call more than once: a repeat answers 409, but so does a different publish having already taken that version id, and the two are told apart only by whether a served version carries this merge commit\'s own sha.  **Refuses (`409 draft-not-at-merge`) unless the manifest still carries a merge commit.** `updateDraftPullRequest` / `getDraftPullRequest` stamp `metadata.git.merge_commit_sha` best-effort and clear it the moment a checkpoint advances the draft past the merge, so a call made immediately after a merge can race a failed stamp. Reload the pull request (which repairs the stamp on the next qualified read) and retry.  Reads the package\'s subtree at the merge commit through the same draft reads the History/Files tabs use, so any file that cannot be read as UTF-8 text under 1MB refuses the whole publish (`409 draft-publish-unreadable-file`) rather than silently omitting it from the package.  Publishes only the manifest\'s own bound package (`metadata.git.package` / `metadata.git.environment`) — there is no way to name a different one.  **A successful publish closes the draft.** The draft and its branch are deleted, the branch delete pinned to the head that was published, when the draft is still at the merge this call published, no pull request is open on its branch, the publish did not create the package without attaching it to the workspace (`workspaceAttached: false`), the caller may delete the draft, and no agent sandbox turn is live on it. Otherwise the draft stays and the next change can continue it, as it does when the branch delete fails. A branch a published version records is kept while the draft is still deleted. The close never fails this call: the response is the publish\'s, and `publishedVersion` names the version it created.  **Authorization**: enforced where publishing already is — `createOrUpdatePackage`\'s own `can_create_package` / `can_update_package` check, re-run under the caller\'s principal.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Publish a git-backed draft\'s merged package
+         * The one way a draft ships, whether or not its environment reviews drafts on GitHub. Either the draft\'s package is published and this answers `200` with it, or nothing is published and it answers `409` `draft-not-ready` with `details.reason` saying what it waits on. Call it again once that clears: every step is safe to repeat, and a repeat after a publish answers with the version already published. `getDraftPublication` reads the same gates without acting on them.  **A draft whose environment does not review on GitHub** is published from its own files, in this order:  1. `conflicts`: the draft has unresolved conflicts (`details.conflictCount`). 2. `stale`: the package has a newer version than the one the draft is synced to;    the background sync brings it in. 3. `building` / `build-failed`: the draft\'s latest content has no passing build from    the last hour. A missing, pending or stale build is requested here and answers    `building`; a failing one answers `build-failed`, with the compiler\'s message. 4. The publish, `createOrUpdatePackage` naming this draft. The body\'s `description`    is written into the published `publisher.json`. A package that moved under the    draft while it published answers `stale`.  **A draft whose environment reviews on GitHub** merges its pull request and publishes the merge commit:  1. A draft whose pull request merged, and which has not changed since, goes straight    to the publish (8). One edited after its merge is a new pull request. While a    rebuild of a merged draft is pending this answers `building`: the build says    whether it holds an edit. A rebuild that failed on the merged content still    publishes the merge. One whose content cannot be compared answers `build-failed`    when it failed to compile, and `building` when it failed on Credible\'s side, which    this call asks to rebuild. 2. A push GitHub refused for good answers `push-refused`, with the reason in    `details.pushError`: `data_files_only`, `no_changes`, `content_refused`,    `review_outside_package`, `repository_too_large` or `push_refused`, until the    draft\'s content changes, which sends it again (`repository_too_large` only    fails again: see `push-refused` below). Otherwise a push is owed when the    draft has never been sent, has changed since its last push, or the body\'s    `title` / `description` differ from the pull request\'s; this call submits it. 3. `conflicts` (the draft\'s own, `details.conflictCount`) and `stale` (as above). 4. `sending` until the owed push lands and the pull request is open at it. 5. The build at the pull request\'s head must be a pass from the last hour. Otherwise    this call asks for one, which posts the head\'s check run once it settles, and    answers `building`, or `build-failed` for a failing one. 6. GitHub\'s mergeable state, as last recorded: `dirty` answers    `pull-request-conflicts` (the draft\'s own conflicts are step 3\'s `conflicts`, so    this one is resolved on GitHub), `draft` is read once more, as a press may follow    a pull request marked ready, and answers `pull-request-draft` if it still is (or    if GitHub cannot be read), and a state GitHub has not computed is read once more    and otherwise answers `sending`. `blocked`    with a passing build re-posts the head\'s passing check run, since a check run left    from an earlier answer can be what blocks it, and goes on to the merge. `behind`    alone does not refuse: the merge itself refuses a base branch that changed the    package. 7. The package at the head is listed once and refused for what a publish cannot    carry: `draft-publish-unreadable-file`, `draft-publish-too-large`, or    `draft-publish-manifest-missing` (no `publisher.json`). 8. The pull request is merged at that head, confined to the package and only while    the base branch has not changed the package since the draft\'s base, and the merge    commit is published. GitHub refusing the merge answers `pull-request-blocked`    (a required review or check is outstanding), a base branch that changed the    package `stale`, a head that moved `sending`, and a pull request that changes files    outside the package `push-refused` with `details.pushError`    `review_outside_package`: a merge here never carries them onto the base branch, so    they are reconciled on GitHub. A refusal because the pull request already merged    (a second Publish racing the first) publishes that merge.    Until the merge\'s version exists this answers `publishing` (the webhook or the    merge record holds it, or GitHub\'s merge time is not read yet); call again,    which never merges twice.  **A successful publish closes the draft**, as the publish of a draft always has: the draft and its branch are deleted unless it changed meanwhile, a pull request is open on its branch, the publish created the package without attaching it to the workspace (`workspaceAttached: false`), or an agent sandbox turn is live on it. The close never fails this call; `publishedVersion` names the version published, or the existing one that already carries this merge.  **Authorization**: the draft\'s modeling bar (`can_create_document` on the workspace, `can_create_package` on its environment) and `can_update_package` on a package that already exists; the publish itself re-checks them.  `409` `draft-converting` means the draft is moving to the new store; retry. A `400` is the publish refusing the package itself (an archive it cannot read, a name it does not accept).
+         * @summary Publish the draft
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} workspaceName The unique identifier of the workspace
          * @param {string} draftId The draft package identifier
+         * @param {DraftPublicationRequest} [draftPublicationRequest]
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        writeDraftPublication(organizationName, workspaceName, draftId, options) {
-            return localVarFp.writeDraftPublication(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Proxies the code-assist git-gateway\'s `createDraftPullRequest`, forwarding the caller\'s own bearer token exactly as the History operations do. The gateway remains the sole authorizer; this endpoint performs no authorization of its own.  Idempotent — an already-open pull request for this draft comes back rather than a second one.  **Not a pure proxy: this call can sync and retry on your behalf.** A draft whose package already exists on the base branch — most commonly because this draft\'s own earlier pull request already merged it — is refused `409 draft-behind-base` unless it can be shown to derive from the base branch\'s current tip. Rather than surfacing that refusal immediately, this endpoint calls `updateDraftBranch`\'s own implementation, which merges the base branch into the draft\'s branch and writes `metadata.git.package_base_sha` on the draft\'s manifest from what that sync proves, then retries the create exactly once. Only a second refusal (a real race, or a draft whose package belongs to another name entirely) reaches the caller as `409`. A `sync-conflict` or `sync-rejected` from that internal sync surfaces as its own clear refusal, naming the manual paths out (resolve on github.com, or start a fresh draft) — resolve it there, or call `updateDraftBranch` directly for the same outcome without going through this endpoint.  **Authorization**: Requires the environment\'s `can_create_package` (enforced by the gateway) — proposing a change is the same authority as writing the draft.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-         * @summary Open a pull request for a git-backed draft
-         * @param {string} organizationName The unique identifier of the organization
-         * @param {string} workspaceName The unique identifier of the workspace
-         * @param {string} draftId The draft package identifier
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        writeDraftPullRequest(organizationName, workspaceName, draftId, options) {
-            return localVarFp.writeDraftPullRequest(organizationName, workspaceName, draftId, options).then((request) => request(axios, basePath));
+        writeDraftPublication(organizationName, workspaceName, draftId, draftPublicationRequest, options) {
+            return localVarFp.writeDraftPublication(organizationName, workspaceName, draftId, draftPublicationRequest, options).then((request) => request(axios, basePath));
         },
     };
 };
@@ -5868,7 +5991,7 @@ exports.DraftsApiFactory = DraftsApiFactory;
  */
 class DraftsApi extends base_1.BaseAPI {
     /**
-     * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  **A git-backed draft\'s branch is created here too.** In a git-enrolled environment this provisions the branch and records the binding — repository, branch, package directory, base branch — before returning, so a caller either gets a complete draft or gets none. Assembled afterwards by separate writers there is no transaction to hold them together, and a failure part-way leaves a draft naming a branch that does not exist.  The binding is **not alterable through update, move or create** afterwards: the checkpoint collector resolves the subtree from `packagePath` and a merge\'s auto-publish resolves the owning environment from `git.environment`, so changing either would orphan what is already committed. Through the documents API, a request that introduces, removes or alters the binding or the draft\'s target answers `409 draft-binding-immutable`; a request that omits `git` keeps the stored block. Deleting the draft is still how a bound manifest goes away.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
+     * Mints a draft in this workspace and returns it. **Always creates**: a package can hold any number of drafts, one per chat by default, so a second request for the same `targetPackageName` mints a second draft rather than returning the first. Callers that want an existing draft list the workspace\'s drafts and open one by id. What keeps two writers off one draft is the draft\'s work-item claim, not uniqueness here.  Every draft is a document-store draft, in a git-enrolled environment as in any other: the draft\'s files are workspace documents, and git is only where a pushed draft goes for review.  **`seedFromPublished` returns the draft already holding a published version\'s files**, in this one call: what opening a published package for editing takes, without a chat. Its refusals all come before the draft exists, and a seed that fails afterwards removes the draft; see the field.  `201` with the new draft.  **Authorization**: `can_create_document` in the workspace, and on every create the target environment\'s modeling bar (`can_create_package`, modeler or admin): putting a package in draft mode, or starting a new package\'s draft, is modeling work in that environment, and in a git-enrolled one creating the branch is a write into its repository. It is taken before anything is created; refused, it answers `403 draft-modeling-permission-required`.
      * @summary Create a draft package
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -5881,7 +6004,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).createDraft(organizationName, workspaceName, draftCreateRequest, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2). Branch removal was inherited from the document model — documents are deletable, so a draft\'s branch looked like it had to go too — and every failure mode of that obligation had to be handled. Git\'s model is the opposite: branches accumulate and tidying is a convenience. Once a draft has had a pull request, GitHub retains `refs/pull/N/head` permanently, so deleting the branch would not remove the content anyway. Removing a branch is `DELETE .../drafts/{draftId}/branch`, and the one case worth tidying — a branch nothing was ever committed to — is the caller\'s to decide. The other case is server-side: a successful publish closes the draft and deletes its branch with it (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
+     * Deletes the draft: its manifest and, for a document-store draft, its files. Its environment draft package is marked for the checkpoint reaper, so what was serving the draft is removed on the next tick.  **The branch usually lives on.** Deleting a draft does not delete its git branch (docs/git-synced-modeling.md §7.2), with one server-side exception: a draft that was never published and still sits at its seed commit has its branch deleted first, best-effort, so a draft minted from a misread intent leaves nothing behind. The delete is pinned to the seed commit, so a commit that landed since keeps the branch; the pin is not a compare-and-swap, so a commit landing in the instant between the gateway\'s tip re-read and its delete is lost. A failed branch delete never blocks the draft\'s delete, and retrying after a partial failure finds the branch already gone. Every other branch is removed by `DELETE .../drafts/{draftId}/branch`, or by the close after a successful publish (see `writeDraftPublication` and `createOrUpdatePackage`\'s `draftId`).  **A second delete, or a read after this one, answers 404** to a caller who can use the workspace (403 to one who cannot): the gate is the workspace\'s, and the row is gone.  **Authorization**: requires `can_delete_document` on the draft document, and `can_create_package` on the environment it targets.
      * @summary Delete a draft package
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -5894,7 +6017,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).deleteDraft(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo. See `listDraftCommits` for the auth-forwarding notes.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  One product path calls this, and only one: since the 2026-08-15 \"branches live on\" decision (docs/git-synced-modeling.md §7.2) deleting a draft deletes the manifest and leaves the branch, so the agent\'s `delete_file` cascade makes no branch call at all, and the app\'s delete tidies the branch only for a draft nothing was ever committed to (the §7.2 amendment of 2026-08-24). Otherwise it is the primitive operator tooling needs — see docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
+     * Thin proxy to the code-assist git-gateway\'s `deleteDraft` — deletes the draft\'s branch in the managed monorepo, forwarding the caller\'s own bearer token.  **This is branch removal only — it does not delete the draft.** Deleting the draft is `DELETE` on the draft itself.  Stays as the primitive operator tooling needs: `deleteDraft` deletes an untouched draft\'s branch at its seed commit on the server (docs/git-synced-modeling.md §7.2), so neither the app nor the agent needs to call this. See docs/tenant-offboarding-playbook.md, which prefers it over a raw GitHub call precisely because it carries the FGA check below. The close after a successful publish also deletes a draft\'s branch, but through the gateway directly rather than through this endpoint.  **Authorization**: Requires write access to the draft\'s workspace (`can_create_document`) and `can_create_package` on the environment the draft targets, as deleting the draft does. The gateway re-checks the workspace relation.  Idempotent, and deliberately not gated on the draft being git-backed, so a provisioning draft\'s half-cut branch can still be cleaned up.
      * @summary Delete a git-backed draft\'s branch
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -5907,29 +6030,29 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).deleteDraftBranch(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Removes a document from the draft, whichever storage backs it. On a git-backed draft this is a commit that deletes the file, under the same precondition a write takes; on a document-store draft it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
+     * Removes a document from the draft: it deletes the document row, only if it still holds the `sha` in `expectedSha` when one is sent, and unconditionally (and idempotently) otherwise.  **Authorization**: as `writeDraftDocument`.
      * @summary Delete one of a draft\'s documents
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
      * @param {string} documentPath The document\'s path relative to the draft root
-     * @param {string} [expectedRef] The branch head the caller read at. For a text document on a git-backed draft it is required; for a data file there it is ignored, since a data file\'s delete is not a commit. Refused for a document-store draft, data file or not — there is no commit to compare it against. See `writeDraftDocument` for why it is the branch head rather than the document\'s own sha.
-     * @param {string} [expectedSha] The `sha` the caller read the document at. Document-store drafts only, refused for a git-backed one: the delete applies only if the document still holds that version, else `409` `draft-document-stale`.
+     * @param {string} [expectedSha] The `sha` the caller read the document at: the delete applies only if the document still holds that version, else `409` `draft-document-stale`; a file already gone counts as deleted when this is the whole request, so a lost response can be resent.
+     * @param {string} [expectedRef] Deprecated: use `expectedSha`. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedRef, expectedSha, options).then((request) => request(this.axios, this.basePath));
+    deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).deleteDraftDocument(organizationName, workspaceName, draftId, documentPath, expectedSha, expectedRef, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. `expectedRef` is optional   here, as it is absent on a data file\'s delete: when given on a git-backed draft, the   commit that writes a small published copy back builds on it (`409   draft-file-stale-head` if the branch has moved since), and on the branch\'s current   head when it is not given. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included; `503` `draft-changes-unavailable` when its changes could not be compared with its publication.  **Authorization** — the same pair `writeDraftDocument` takes.
+     * Discards the draft\'s change to one file, so the draft carries what its publication has at this path again. This is Restore, for any kind of file; after it the path has no `changeSincePublication` marker. `DELETE` on the document itself deletes the file instead — a different change, which this would undo.  What it does follows the file\'s change marker, never whether a published copy can be read:  - A data file: the draft\'s own upload or deletion is dropped. Where the draft\'s last   publish shipped its own upload, the path returns to that upload; otherwise the   published copy is inherited again, and a small UTF-8 file, which a draft holds as a   document rather than inheriting, is written back as one. - A text file the draft added: deleted. - A text file the draft edited or deleted: the published copy written back. Answers   as `getDraftDocument` with `ref=publication` does when that copy cannot be read   (`404` `draft-file-not-in-publication`, `409`, `413`, `503`), changing nothing.  `404` `draft-document-unchanged` when the draft has no change at this path — a data file the draft\'s last publish shipped and has not touched since included. Before any change is found, the comparison itself can be refused, with the answers a read of the baseline gives: `403` when the caller cannot read the package the draft is measured against, `409` `draft-publication-baseline-missing` when that baseline cannot be measured (a corrupt archive), and `503` `draft-changes-unavailable` when it could not be read.  **Authorization** — the same pair `writeDraftDocument` takes.
      * @summary Restore one of a draft\'s files to its published copy
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
      * @param {string} documentPath The file\'s path relative to the draft root
-     * @param {string} [expectedRef] The branch head the caller read at, for a git-backed draft where the restore is a commit: required for a text file, optional for a data file (used as the compare-and-swap base when a small published copy is written back as a document); refused for a document-store draft.
+     * @param {string} [expectedRef] Deprecated: a restore takes no precondition. A git branch head, refused with `400` when set: a draft has no commits to compare it against, and a caller that sends a precondition believes it holds one. Kept one release, so a client from before the document store is refused rather than written unconditionally; removed in the release after.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
@@ -5951,8 +6074,8 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).getDraft(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * The branch a git-backed draft\'s files live on, and where it currently points. The tip is a property of the branch, so it is read from the branch rather than from an endpoint of its own.  Thin proxy to the code-assist git-gateway\'s `getDraftHead` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user.  NOT `listDraftCommits(limit=1)`\'s `sha`: that read is filtered to the draft\'s own package subtree, so a commit that lands on the branch without touching it (e.g. `syncDraftBranch`) never advances it — a caller building a checkpoint\'s `expectedHeadSha` from that filtered read can 409 against the real, unfiltered CAS forever. This endpoint returns that real tip.  **Authorization**: Requires read access to the draft document (enforced by the gateway) — the same bar `listDraftCommits` and `getDraftDocument` take.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary The draft\'s branch
+     * The draft\'s capabilities, derived by the server from its environment and what its package has published. The same value `getDraft` carries as `capabilities`, for a caller that does not need the rest of the draft: it reads the draft\'s manifest, its review state and one published-version lookup, not the checkpoint or the files.  A draft that is moving to the new store answers `409` `draft-converting`: retry.  **Authorization**: requires read access to the draft document.
+     * @summary What the draft\'s storage can do
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
@@ -5960,8 +6083,8 @@ class DraftsApi extends base_1.BaseAPI {
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    getDraftBranch(organizationName, workspaceName, draftId, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).getDraftBranch(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
+    getDraftCapabilities(organizationName, workspaceName, draftId, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).getDraftCapabilities(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
      * Reports where the draft\'s environment package stands. Always answers `200`; `status` is `none` before the first checkpoint is requested, so a polling client does not treat absence as an error.  **A pure read**, and the cheap one: this is what a client polls while a checkpoint is unsettled. It performs no write and starts no publish.  This is a pure read. Resurrecting an idle-reaped draft package is a `POST` to `../checkpoints`, so that a publish into a live environment follows from an explicit request rather than from whichever tab last refreshed. `resurrectable` on the response says whether such a request would rebuild anything.  **Authorization**: requires read access to the draft document, the same bar as the other draft reads.
@@ -5977,24 +6100,36 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).getDraftCheckpointStatus(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * The documents that differ between `base` and `head`, each with how it changed and, where the gateway supplies one, its patch.  Its own resource rather than a mode of the document listing: the listing already reports each document against the draft\'s last publication (`changeSincePublication`), and this answers what moved between any two commits — the History tab\'s question. An entry here can name two paths at once (`renamed`), and folding commit-to-commit diffs into the listing would mean an item schema whose fields were populated or `null` depending on which query parameters the caller happened to send.  **Git-backed drafts only.** A document-store draft has no commits to compare, so the question does not apply to it rather than having no answer: it is a `400` `draft-not-git-backed`, the same refusal every git-only draft operation gives, and `409` `draft-provisioning` while the branch is still being cut. The `422` below is the gateway\'s own, for an environment that is not provisioned.  **Authorization**: requires read access to the draft document, the same bar as the document listing.
-     * @summary What changed between two commits of a draft
+     * One entry of `getDraftConflicts` with the incoming side\'s, the draft\'s and their common ancestor\'s version of the file, so the caller can reconcile them and write the result through `writeDraftDocuments` with the `conflictSha` this returns.  **Authorization**: requires read access to the draft document, and `can_create_package` on the environment it targets: only a modeler can act on what this serves.  `404` when the path has no conflict (it was resolved, or never conflicted).
+     * @summary One conflicting file, with all three of its versions
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
-     * @param {string} base The commit to compare FROM. A full 40-character sha reachable from the draft\'s branch.
-     * @param {string} head The commit to compare TO. Same form as `base`.
-     * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
+     * @param {string} documentPath The conflicting file\'s path relative to the draft root, as `getDraftConflicts` lists it.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof DraftsApi
+     */
+    getDraftConflict(organizationName, workspaceName, draftId, documentPath, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).getDraftConflict(organizationName, workspaceName, draftId, documentPath, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * A page of the draft\'s conflicts: every path both the draft and what came in changed since their common ancestor, where what came in is a newer published version of its package (the base moved) or a commit someone pushed to its pull request. A superset of what cannot merge on its own, because nothing here runs a merge. Ordered by `relpath`.  Each entry says where its incoming side came from, and carries the `conflictSha` a resolution sends back through `writeDraftDocuments`, a member per file. `getDraftConflict` returns one file\'s three versions.  An empty list means nothing waits on the author: what only one side changed is absorbed in the background. Conflicts never block editing or a Submit; a submitted draft\'s push waits for the last one to be resolved and then starts on its own.  Served from controlplane\'s record alone: no file content, no archive read and no GitHub call.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+     * @summary The files the draft and what came in both changed
+     * @param {string} organizationName The unique identifier of the organization
+     * @param {string} workspaceName The unique identifier of the workspace
+     * @param {string} draftId The draft package identifier
+     * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–500.
      * @param {number} [offset] Number of items to skip before starting to return results
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    getDraftComparison(organizationName, workspaceName, draftId, base, head, limit, offset, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).getDraftComparison(organizationName, workspaceName, draftId, base, head, limit, offset, options).then((request) => request(this.axios, this.basePath));
+    getDraftConflicts(organizationName, workspaceName, draftId, limit, offset, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).getDraftConflicts(organizationName, workspaceName, draftId, limit, offset, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-provisioning` while the draft\'s storage is still being set up; on a git-backed draft the branch is read through the gateway, with its `409`, `422`, `429` and `503` answers; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
+     * The draft as it stands, as a package archive: its own files at its latest content, its uploaded data files, and the data files it inherits from the published version, minus any it deleted — the same layering its checkpoints and publishes use (docs/draft-data-file-upload-design.md §4.3), but built from the draft\'s current content rather than its last checkpoint, and with its own `publisher.json`. For working on the package locally. `409` `draft-converting` while the draft is moving to the new store; `503` `draft-data-file-storage-unavailable` when an upload\'s object or the published archive could not be read.  **Authorization**: requires read access to the draft document, and — when the draft\'s package has a published version, whose data files the zip would inherit — update access to the package, as downloading that version does (`getPackageVersionContent`). That check runs before the published archive is fetched, so a reader without it never causes that read.
      * @summary Download a draft package as a zip
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6007,13 +6142,13 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).getDraftContent(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * One document\'s content, whichever storage backs the draft. See `listDraftDocuments` for why the backing is not the caller\'s concern.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: for a git-backed draft, the draft-branch commit its last publish shipped (`publishedAs.commitSha`); for a document-store draft, the stored archive of its last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: on a document-store draft, the caller can read the draft but not the   package whose archive the baseline is. The archive is the package\'s, and   workspace access does not imply environment access, so this read also takes   `can_read_package` on it. A git-backed baseline is the draft\'s own branch. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded, or a published   commit no longer on the draft\'s branch. Permanent until the draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  On a document-store draft the content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`. `ref` is null on a document-store answer; on a git answer it names the published commit, which is NOT a head a compare-and-swap write can build on — read the head separately before writing.  **Authorization**: requires read access to the draft document.
+     * One document\'s content. `409` `draft-converting` while the draft is moving to the new store.  Refuses with `413` (`draft-file-unreadable`) when the document is not readable as UTF-8 text under 1MB. That is a permanent refusal about the file\'s shape, not a transient failure: the same refusal stops a publish, so retrying achieves nothing until the file is removed or replaced.  **`ref=publication`** reads the document as it is in the version the draft\'s `changeSincePublication` markers compare against. The baseline is resolved server-side, never taken from the caller: the stored archive of the draft\'s last published version, or — for one never published — of the version it was opened on. The answers, each distinct:  - `200`: the file\'s content in that baseline. - `403`: the caller can read the draft but not the package whose stored archive is the   baseline. Workspace access does not imply environment access, so this read also   takes `can_read_package` on it. - `404` `draft-file-not-in-publication`: the baseline exists and does not hold   this file. There is nothing to restore from it. - `409` `draft-publication-baseline-missing`: there is no baseline to read — a   draft never published and opened on nothing, a publication recorded before   baselines were, a published version with no stored archive, one whose archive is   corrupt, or one that no longer holds what its publish recorded. Permanent until the   draft publishes again. - `413` `draft-file-unreadable`: the baseline\'s copy is not UTF-8 text under 1MB. - `503` `draft-publication-unreadable`: the baseline exists but could not be read   right now. Retryable.  The content is the published archive\'s bytes decoded as UTF-8, so its SHA-256 is the hash the markers were computed from. A published file a draft cannot hold (binary, or 1 MiB and over) is inherited by the draft rather than held, so it is not in the baseline and answers `404`.  **Authorization**: requires read access to the draft document.
      * @summary Read one of a draft\'s documents
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
      * @param {string} documentPath The document\'s path relative to the draft root
-     * @param {string} [ref] Read at this commit rather than at the branch tip. A commit is honored on git-backed drafts only; a document-store draft has no commits and reads its current content whatever commit is named. The literal `publication` is reserved, on either backing: it reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case) and never forwarded to git, so it cannot be mistaken for a commit, which is hexadecimal. Prefer the one-call pairing: the response\'s `ref` names the commit the content was read at. A writer that intends to send the content back under a compare-and-swap must read the head first and then the document AT that head — reading the document first and the head second yields content from one commit paired with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.
+     * @param {string} [ref] The literal `publication` reads the file as it is in the draft\'s publication baseline — see the operation\'s description. It is matched exactly (lower case). Any other value is ignored: a draft keeps no commits to read at.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
@@ -6022,7 +6157,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).getDraftDocument(organizationName, workspaceName, draftId, documentPath, ref, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-provisioning` while the draft\'s storage is still being set up.  A file a git-backed draft\'s branch holds that cannot be served as text (over 1 MiB, or not UTF-8) answers `413` `draft-file-unreadable`, as `getDraftDocument` does: the branch is read as text only, so there are no bytes to serve. An uploaded data file never takes this path. On a git-backed draft the branch read is `getDraftDocument`\'s, and carries its `409`, `422`, `429` and `503` answers.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
+     * The bytes of a file as the draft carries it: a text document\'s content, a data file\'s own upload, or otherwise the data file it inherits from the package\'s published version. So a download works the same on any file of the draft. A path the draft deleted answers `404`; `409` `draft-converting` while the draft is moving to the new store.  A text document that cannot be served as text (1 MiB or more) answers `413` `draft-file-unreadable`, as `getDraftDocument` does. An uploaded data file never takes this path.  **Authorization**: requires read access to the draft document. A data file the draft inherits also requires update access to the package, as downloading the published version does (`getPackageVersionContent`); the draft\'s own uploads do not. That check runs before the published archive is fetched, so a reader without it gets `403` for any path the draft itself does not hold, a missing one included.
      * @summary Download one of a draft\'s files
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6036,8 +6171,8 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).getDraftDocumentContent(organizationName, workspaceName, draftId, documentPath, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Proxies the git-gateway\'s `getDraftPullRequest`. Always answers `200`; `state` is `none` when the draft has no pull request, so a polling client does not have to treat absence as an error.  `mergeable` is GitHub\'s own verdict and is `null` while GitHub is still computing it — a routine answer for a freshly opened pull request. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Not a pure proxy: reading an open pull request also starts the compile check.** `compileVerdict` reports whether the package compiles at the current `headSha`, and the first read of a new head starts that check rather than waiting for it — so a `pending` verdict is the normal first answer, resolved by a later poll. A client that polls this endpoint therefore needs no separate call, and needs to make none when the verdict is already `passing` or `failing` for the head it holds.  **A read can also close a merged and published draft.** When the close that follows a publish was skipped or deferred (most often because the merge created a package the publish could not attach to the workspace), a read of the merged pull request finishes it: it attaches that package to the workspace, then deletes the draft and its branch. Afterwards the draft reads `403`, like any deleted draft.  **Authorization**: Requires read access to the draft document (enforced by the gateway). The three side effects this read can have carry their own, higher bars and are SKIPPED rather than refused when the caller lacks them, so the read itself never fails for a permission: recording an observed merge takes the draft\'s `can_update_document`, computing `compileVerdict` takes the environment\'s `can_create_package` (see that field), and closing a published draft takes the draft\'s `can_delete_document`, plus the package\'s `can_share_package` when it attaches a package first. A read below a bar returns the same pull request with that part left undone for the next qualified caller.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary The draft\'s pull request, read live from GitHub
+     * The gates `writeDraftPublication` applies, read without acting on any of them: no submit, no build request, no merge and no listing of the package on GitHub, so it costs database reads only. `ready` false comes with the `reason` the publish would answer now. `ready` true means every gate this read covers passed; the publish\'s own listing of the package at the pull request\'s head can still refuse it. `ready` says nothing about the caller: a reader who may not publish reads it too, and the publish refuses them `403`.  A draft that is owed a push or a build reads `sending` or `building` here, and only `writeDraftPublication` starts them. A `blocked` pull request reads `pull-request-blocked` here even when the publish would re-post its check and merge.  `warnings` are about what the publish would ship, not whether it can: today, that a first publish exposes every source (see `DraftPublicationWarning`). They are read only when `ready` is true, and are empty otherwise.  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+     * @summary Whether the draft can be published now
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
@@ -6045,41 +6180,39 @@ class DraftsApi extends base_1.BaseAPI {
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    getDraftPullRequest(organizationName, workspaceName, draftId, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).getDraftPullRequest(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
+    getDraftPublication(organizationName, workspaceName, draftId, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).getDraftPublication(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Thin proxy to the code-assist git-gateway\'s `listDraftCommits` — the frontend never calls the gateway or GitHub directly. Forwards the caller\'s own bearer token so the gateway\'s FGA check runs as the authenticated user; the branch/subtree binding to `draftId` is derived and enforced server-side by the gateway, not by this endpoint.  **Authorization**: Requires read access to the draft document (enforced by the gateway).  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary List commits on a git-backed draft\'s branch (History tab)
+     * Served from controlplane\'s record of the draft and nothing else: no GitHub read and no side effect, so polling it costs controlplane\'s own reads only. Always answers `200` for a draft the caller can read. `state` is `none` when the draft has no pull request, and a draft whose environment does not review on GitHub answers `state: none`, `reviewState: notSubmitted`, so a polling client treats absence as an answer, not an error.  `reviewState` says where the review stands and `nextAttemptAt` when it is next worked on; `unsubmittedChanges` says whether the draft has edits since its last push. Poll while `reviewState` is `sending` or a pull request is open, and stop otherwise.  `mergeable` is GitHub\'s own verdict as last recorded and is `null` while GitHub is still computing it. Treat `null` as \"not yet known\" and re-read; never as \"not mergeable\".  **Authorization**: requires read access to the draft document.  `409` `draft-converting` means the draft is moving to the new store; retry.
+     * @summary The draft\'s pull request and review state
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
-     * @param {number} [limit]
-     * @param {number} [offset]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    listDraftCommits(organizationName, workspaceName, draftId, limit, offset, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).listDraftCommits(organizationName, workspaceName, draftId, limit, offset, options).then((request) => request(this.axios, this.basePath));
+    getDraftPullRequest(organizationName, workspaceName, draftId, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).getDraftPullRequest(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * The draft\'s files, **whichever storage backs them**. A git-backed draft\'s files live on its branch and a document-store draft\'s live as workspace documents; this answers for both, so a client never branches on the backing to read a draft\'s contents. That branch is the reason a draft\'s backing had to be known before its files could be fetched, which put an unrelated read on the critical path of every draft page.  Two shapes, both listings: the documents under `path` to `depth`, or — with `ref` — that same listing as of a commit. Git-backed drafts only for `ref`; a document-store draft has no history to address and ignores it.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing of the draft as it stands (no `ref`) reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A document-store draft never published is measured against the published version it was opened on, and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. Any other never-published draft, or a listing at a `ref`, carries no markers and no removed entries. When the comparison cannot be made (a git compare over the gateway\'s size limit, a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  What changed between two COMMITS is a different question — the History tab\'s — and has its own endpoint: `GET ../comparison`.  Content is omitted from the listing; read a document to get it.  **Authorization**: requires read access to the draft document.
+     * The draft\'s files: the documents under `path` to `depth`, held as workspace documents. `409` `draft-converting` while the draft is moving to the new store.  **Listed against the draft\'s last publication.** A draft is a package in draft mode, so a listing reports each document\'s `changeSincePublication` — added, modified, or unchanged — and includes the files the publication shipped that the draft has since deleted, as `removed` entries. A deletion is an edit like any other, and a page rendering the draft\'s files needs all of them from one read. A draft never published is measured against the published version it was opened on (the package\'s latest version when none was recorded), and only for a caller with read access to that package: the markers would otherwise name the package\'s published files, and their absence say which of them the draft leaves unchanged, to a reader who cannot read it. For such a caller the draft\'s own files are listed without markers, with `Changes-Unavailable`. A baseline that exists but cannot be measured or read (an archive that failed to download) is `Changes-Unavailable` too, never \"nothing to compare against\". A never-published draft of a package with no published version carries no markers and no removed entries. When the comparison cannot be made (a transient failure, or a publication recorded before its baseline existed), the listing is still returned, without markers, and says so with the `Changes-Unavailable` header rather than failing.  Content is omitted from the listing unless `withContent=true`; otherwise read a document to get it.  **Authorization**: requires read access to the draft document.
      * @summary List a draft\'s documents
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
      * @param {string} [path] Restrict the listing to this subtree, relative to the draft root.
-     * @param {number} [depth] `1` lists only the immediate children of `path`, as a file browser would. Omitted returns the whole subtree, which is what a section listing wants. The two are answered by different reads, so they differ in two ways a caller can see. A bounded depth returns directory entries as well as files; the whole subtree returns files only, since a directory is not a document and every caller of the depth-less listing filters to files anyway. And the whole subtree is refused with `413` for a draft holding a symlink or submodule, where a bounded depth lists around it.
-     * @param {string} [ref] Read the listing at this commit rather than at the branch tip. Accepts only a full 40-character sha reachable from the draft\'s branch. Ignored by a document-store draft, which has no commits.
+     * @param {number} [depth] `1` lists only the files directly under `path`, as a file browser would. Omitted returns every file in the subtree, which is what a section listing wants. A draft\'s paths are flat, so neither returns directory entries.
+     * @param {boolean} [withContent] Carry each document\'s content on its entry, so a caller that wants the whole draft makes one request rather than one per file. A document\'s text comes as `content`. A data file the draft holds beside its documents (`kind` `data`) carries neither, as in any listing. The listing is whole-draft or refused: past the same file-count and byte limits a checkpoint collects under, it answers `413` `draft-listing-too-large` rather than a partial one, and `limit` and `offset` do not lower what is read, only what is returned. Read the files one at a time instead.
      * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results.
      * @param {number} [offset] Number of items to skip before starting to return results
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    listDraftDocuments(organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).listDraftDocuments(organizationName, workspaceName, draftId, path, depth, ref, limit, offset, options).then((request) => request(this.axios, this.basePath));
+    listDraftDocuments(organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).listDraftDocuments(organizationName, workspaceName, draftId, path, depth, withContent, limit, offset, options).then((request) => request(this.axios, this.basePath));
     }
     /**
      * The workspace\'s drafts, each as the same `Draft` the item endpoint returns.  **This is how a surface finds drafts.** Before it existed the only way was to list every document in the workspace and filter on type and path prefix, which meant the sidebar, the scope chips and the edit-package flow each pulled every file of every draft in the workspace to render a handful of rows. Composed server-side, one query against the checkpoint rows rather than one request per draft.  **Authorization**: requires read access to the workspace, and each draft is filtered to those the caller can read — the same two-stage bar `listDocuments` applies, since a draft\'s authorization object is still its manifest document.
@@ -6097,7 +6230,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).listDrafts(organizationName, workspaceName, retired, limit, offset, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish, the git stamps from a checkpoint or a merge. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields, which is how a stamp drops the git pointers a concurrent checkpoint had just written: a read taken a moment too early preserves stale ones.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
+     * Changes a draft\'s own fields. Every field is optional and an absent one is left alone.  Its writers own different slices — a display name comes from a person, `publishedAs` from a publish. The package name is not one of them once set: `targetPackageName` cannot change a draft\'s package (`409 draft-package-name-fixed`). A replacement would make each of them responsible for preserving the others\' fields.  **A deleted or nonexistent draft answers 404 to a caller who can write its workspace**, and 403 to one who cannot, for the same reason `getDraft` does.  **Authorization**: requires `can_update_document` on the draft document, and `can_create_package` on the environment it targets.
      * @summary Update a draft package
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6111,34 +6244,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).updateDraft(organizationName, workspaceName, draftId, draftUpdate, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Changes where the branch points. `syncWithBase` brings it up to date with its environment\'s base branch. A `PATCH` on the branch rather than a `/sync` verb: moving a branch is a change to the branch, and the path names resources.  Calls the git-gateway\'s `syncDraftBranch` to merge the base branch into the draft\'s own branch, then writes the result to the draft\'s manifest as `metadata.git.package_base_sha` — the marker `writeDraftPullRequest` and `updateDraftPullRequest` check to clear `draft-behind-base`.  **Not a pure proxy.** The manifest write is this endpoint\'s own, and it is the half that matters: the gateway never writes a manifest (that boundary holds for every route in its API), so a caller going straight to the gateway would sync the branch and leave the marker unwritten. Both outcomes of the merge yield a SHA to freeze — the tip the gateway reports it absorbed, or, when the branch already contained the base tip, that tip itself, which GitHub\'s own `204` proves was already reachable.  A MERGE refused with `draft-behind-base` is recovered by this sync — pull-request creation already retries this automatically (see `writeDraftPullRequest`), but merging is the higher-authority operation and deliberately does not auto-sync, so the user sees what they are absorbing before it lands on the base branch.  A `409` is terminal either way, and the gateway\'s body sentinel says which: `sync-conflict` means GitHub reports the merge would CONFLICT, `sync-rejected` means GitHub rejected the merge request as invalid and will reject it again. In-product resolution is out of scope for both — resolve it directly on github.com against the draft\'s branch, or start a fresh draft.  **Authorization**: Requires the environment\'s `can_create_package` — the SAME bar `writeDraftPullRequest` takes, not the merge bar: syncing writes only to the draft\'s own branch, never the base branch.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary Move the draft\'s branch
-     * @param {string} organizationName The unique identifier of the organization
-     * @param {string} workspaceName The unique identifier of the workspace
-     * @param {string} draftId The draft package identifier
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof DraftsApi
-     */
-    updateDraftBranch(organizationName, workspaceName, draftId, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).updateDraftBranch(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * Advances the pull request\'s state. Merging is a transition of the pull request, not an action filed under it — `PATCH` on the resource rather than a `/merge` verb in the path, which is what every other resource in this API does.  Proxies the git-gateway\'s `mergeDraftPullRequest`. Squash-merges into the base branch and returns the merge commit SHA, which becomes the published version\'s `git_commit_sha` — the first provenance anchor reachable from the base branch.  `expectedHeadSha` is required and pins what is merged to what the caller read, so a checkpoint that landed after the review cannot be merged silently. Read it from `getDraftPullRequest` and pass it straight back. A `409` means the head moved, the pull request is gone, `publisher.json` names a version that already exists, or the package is known not to compile at this head (`draft-compile-failed`); a `405` means GitHub says the branch is not mergeable — a conflict, or a required review that has not passed.  The compile check is READ here, never run — it is started by `getDraftPullRequest` and can take minutes, so this call adds no compile latency. The consequence is that it refuses only a `failing` verdict already computed for this exact `expectedHeadSha`. `pending`, `unverified`, and a verdict this replica has not computed at all ALL allow the merge. Treat it as a guard against merging a known-broken package, not as a guarantee that a merged package compiled.  **Authorization**: Requires the environment\'s `can_update_project` (enforced by the gateway) — a strictly higher bar than opening the pull request, because a merge changes what serves for the whole environment.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary Merge the draft\'s pull request
-     * @param {string} organizationName The unique identifier of the organization
-     * @param {string} workspaceName The unique identifier of the workspace
-     * @param {string} draftId The draft package identifier
-     * @param {MergeDraftPullRequest} mergeDraftPullRequest
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof DraftsApi
-     */
-    updateDraftPullRequest(organizationName, workspaceName, draftId, mergeDraftPullRequest, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).updateDraftPullRequest(organizationName, workspaceName, draftId, mergeDraftPullRequest, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Always answers `202` with the current status: this call is a nudge, not the publish. The reconciler resolves the draft\'s current content itself when it collects the work — the git branch head for a git-backed draft, the doc-store tree otherwise — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
+     * Asks for a checkpoint of the draft\'s current content. A `POST` to the collection rather than a `PUT` on a singleton: this starts a job and answers `202`, and the checkpoints it appends to are a series (`1.0.N`), not one value being set. Sending it twice is still safe — see the coalescing note below — but that is a property of the nudge, not a claim that the request is idempotent in the `PUT` sense.  The current checkpoint\'s status is a separate read: `GET` on `../checkpoint`.  Records that the draft\'s current content should be published as the next checkpoint (`1.0.N`) of its environment draft package — an ordinary published package named `draft-{draftKey}` in the draft\'s target environment, served by the Publisher exactly like any other package there (docs/workspace-architecture-design.md §4). Answers `202` with the current status: this call is a nudge, not the publish. A draft that is moving to the new store answers `409` `draft-converting` and records nothing; retry after a moment. The reconciler resolves the draft\'s current content itself when it collects the work — the draft\'s documents — which is why the request carries no ref and no content: a caller-supplied ref would be both spoofable and racy against the agent\'s own commits, and a nudge that arrives late still publishes what the draft says NOW.  Nudges coalesce: any number recorded between publishes produce one checkpoint of the newest content, and a nudge whose content is identical to the latest published checkpoint publishes nothing. That is this operation\'s own contract, not something the verb supplies — a `POST` to a collection is not idempotent, so a retry after a lost response would otherwise mint a second checkpoint of content that has not changed.  A failed publish (the draft does not compile, most commonly) records `failed` with the compiler\'s message and leaves the previous checkpoint serving; the next nudge retries with the then-current content.  **This is also how a reaped draft package comes back.** A draft whose package has been idle-reaped (24 hours without a checkpoint request) keeps its row as a witness, and a nudge clears the reap marker and re-queues the publish — the same row update that publishes anything else, so no separate verb is needed. `GET` on this path reports `resurrectable` so a client knows to send one. A merge reap comes back the same way, but a client with the draft page open asks automatically: the app\'s own `POST` rebuilds the package unless the reap\'s own tick wins the race first — at `1.0.0` after the reap, or cancelling the reap and republishing into it. A package a resurrect brought back is a live draft again from there, so the ordinary idle sweep (24 hours since the *last checkpoint request*, not tied to a viewer leaving) reclaims it if nobody keeps asking. Either way a draft that outlives its merge (its close was skipped or its publish failed) can be nudged again, and any later nudge rebuilds it the same way: at `1.0.0` once the reap is deleting the package, or as the next `1.0.N` when the nudge lands before the reap starts and keeps it. Only a deleted draft\'s reap is terminal — its content has no home left — and a nudge for one is refused rather than honoured.  **Authorization**: requires `can_update_document` on the draft document AND the target environment\'s `can_create_package` — the same two bars every content-writing draft operation already takes, so anyone modeling in the draft holds both.
      * @summary Set the draft\'s checkpoint to its current content
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6151,7 +6257,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).writeDraftCheckpoint(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Creates or replaces a document, whichever storage backs the draft. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition depends on the storage, and each is refused on the other.** On a git-backed draft `expectedRef` is required and is the BRANCH HEAD the writer read at, not the document\'s own blob sha: the gateway refuses to build on anything but the branch\'s current tip, so a stale value means the draft moved under the writer. Take it from `getDraftDocument`\'s `ref`, and read the document at the head you intend to write against — reading the document first and the head second pairs content from one commit with a precondition naming a later one, which passes the swap and silently overwrites whatever moved in between.  On a document-store draft the precondition is per file: `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Either is checked in the same statement that writes, so of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`. They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been. `expectedRef` is refused on a document-store draft, and `expectedSha` and `createOnly` are refused on a git-backed one, rather than ignored: a caller that sends a precondition believes it holds a guarantee.  On a document-store draft the server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment, on either backing. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. A git-backed write also commits into that environment\'s repository. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+     * Creates or replaces a document. `PUT` rather than `POST` because the path is the identifier and the caller chooses it — there is no server-assigned id for a file, so a collection `POST` would have nothing to assign.  **The precondition is per file.** `expectedSha` (the `sha` the writer read) replaces the document only if it still holds that version, and `createOnly` creates it only if no document is there. Of two writers holding the same `sha` exactly one wins and the other gets `409` `draft-document-stale`, except that a resent write that already landed is answered as applied (below). They are mutually exclusive (`400` when both are sent). With neither, the write is last-writer-wins, as a write through the documents API has always been.  A retry whose change is already in place (the content is current, or the file to delete is gone) is answered as applied, not as a conflict, so a lost response can be resent. A deletion of a gone file with an `expectedSha` counts as applied only when no write in the same set is still to land: a move whose old path was deleted or moved by someone else is stale (`\"\"`), not a second copy.  The server requests the draft\'s checkpoint after the write commits, so a client does not request one itself.  **Authorization** — `can_update_document` on the draft document, **and** `can_create_package` on the draft\'s target environment. The second is not redundant: `can_update_document` on a draft is satisfied by bare workspace membership, while a file written here reaches the environment on the draft author\'s next checkpoint, carrying the checkpointer\'s bar rather than the writer\'s. The environment comes from the draft\'s own manifest and is never a request field; a draft that names none is refused, since it could not be published either.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
      * @summary Write one of a draft\'s documents
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6166,7 +6272,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).writeDraftDocument(organizationName, workspaceName, draftId, documentPath, draftDocumentWrite, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents rather than in either backing, so this works the same on a git-backed draft and a document-store draft, and never commits to a repository (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  When the path is one a git-backed draft holds as text (the small CSV case above), the text copy\'s removal is a commit at the branch head, and the upload carries the gateway\'s own answers for it, each listed on its status below: `409` `draft-provisioning` and `draft-file-stale-head`, `422` for an unprovisioned environment, GitHub\'s `429` with `Retry-After`, and a code-less `503`. On every one of them the upload is rolled back and the draft is as it was.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
+     * Writes a data file\'s bytes — a Parquet, CSV, JSON or Excel (`.xlsx`) file a model reads — into the draft, creating it or replacing the draft\'s earlier upload at the same path. A data file lives beside the draft\'s text documents (docs/draft-data-file-upload-design.md).  The body is the file itself, `application/octet-stream`, with `Content-Length` set; a chunked body without one is refused before it is read. Uploading over a data file the package\'s published version serves replaces it in the draft: the draft\'s checkpoint and its next publish carry the upload, and the published version keeps its copy until then. A path the draft holds as a small text document (a CSV the published version shipped, which a draft holds as text) moves: the upload is stored and the text copy removed, so the path lives in one place. `DELETE` on the document path deletes a data file, or — for one the draft inherits — records that the draft no longer carries it; `DELETE` on its `change` restores it to the published copy.  Refusals, each with its `code`:  - `400` `draft-data-file-body-unreadable`: the request body ended or failed before it   was read through (a dropped connection, a truncating proxy). Nothing was written;   send it again. - `400` `draft-data-file-invalid`: the path holds a character outside Malloy\'s unquoted   DuckDB path set `[A-Za-z0-9._~:/?#@!$&*+,=%-]`, such as a space, a bracket, a quote   or an accented letter (a model can\'t name such a file in `duckdb.table(\'…\')`; the   message names the path with accents dropped and each run of any other such   character replaced by `_`, which the app uploads to instead), or ends in   `.txt` (DuckDB has no reader for that extension; rename it `.csv` or `.tsv`), or   ends in any other extension outside the formats a model reads as data: `.csv`,   `.tsv`, `.parquet`, `.xlsx`, `.json`, `.jsonl`, `.ndjson`, and `.csv.gz`, `.tsv.gz`,   `.json.gz`, `.jsonl.gz`, `.ndjson.gz` (an `.xls` is told to save as `.xlsx`). Decided   by the path, before the body is read. - `409` `draft-content-not-data`: the path names a file the package treats as text   (`publisher.json`, `.malloy`, `.malloynb`, `.md`, `.html`, or a `.json` at the   package root). Those are written through `writeDraftDocument`. - `411` `draft-data-file-length-required`: the request declared no `Content-Length`. - `413` `draft-data-file-too-large`: over 32 MiB. - `413` `draft-data-files-over-quota`: the draft would hold more than 64 data files   or 128 MiB of them. - `422` `draft-data-file-invalid`: a `.parquet` or `.xlsx` path whose bytes are not that   format, or an empty body. - `429` `draft-data-file-rate-limited`: more than 30 uploads into this draft in the last   minute, or more uploads in flight on the serving replica than it spools at once (8).   Both are counted per replica. Retry after a moment.  **Authorization** — the same pair `writeDraftDocument` takes: `can_update_document` on the draft document, and `can_create_package` on the draft\'s target environment.
      * @summary Upload a data file into a draft
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6181,7 +6287,7 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).writeDraftDocumentContent(organizationName, workspaceName, draftId, documentPath, body, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Writes a set of documents together. On a git-backed draft they land as **one commit**, which is the reason this exists beside the per-document `PUT`: seeding a draft from a package is a single logical change, and writing its files one at a time would put N commits in the History tab for one action — and leave a reader of any intermediate commit looking at half a package.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature: the seed, and a multi-file edit that should be reviewable as one diff.  `expectedRef` applies to the whole set, and a client-minted `intentTimestamp` resent byte-identical makes a retried write a replay rather than a second commit — which matters more here than for one document, since a lost response after an N-file commit is otherwise indistinguishable from a write that never landed.  On a document-store draft each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. The set stays all-or-nothing: if any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path.  **Authorization**: as `writeDraftDocument`.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. On a branch-backed draft the commit is made by the gateway, so the claim is checked just before it: a cancel that lands during that one commit can let it through, and the commit\'s `Turn-Work-Item` trailer records which item wrote it. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.  Refuses with `400` and a distinct code when a git-backed checkpoint\'s own content is refused: `checkpoint-over-size-cap` (the draft\'s total content is over the cap; split the change across commits; this code was `draft-file-too-large` before) or `checkpoint-content-not-base64` (a file\'s content is not valid base64).
+     * Writes a set of documents together, in one transaction: a seed, or a multi-file edit that must not be seen half applied.  Ordinary editing uses the per-document `PUT`. This is for the cases that are atomic by nature.  Each member may carry its own `expectedSha` or `createOnly` (see `writeDraftDocument`), so a move is one set: `createOnly` on the new path and a deletion with `expectedSha` on the old one. If any member\'s precondition fails, none is written and the `409` `draft-document-stale` names every conflicting path; a set already partly in place (a resent one) commits only what remains.  **Authorization**: as `writeDraftDocument`.  **Resolving conflicts.** A member carrying the `conflictSha` that `getDraftConflicts` gave its path resolves that one conflict: the path leaves the conflict list and its base moves to the incoming side, so the next sync does not raise it again. With no content and no `deleted` the member keeps the draft\'s file as it is (an uploaded data file too), and only the conflict is cleared. Members without a `conflictSha` write as usual, and a write may resolve any subset of the list. A `conflictSha` that no longer names the path\'s conflict (the incoming side moved, or it was resolved) is `409` `draft-conflict-changed`, and nothing is written. Once none remain, the draft moves on to what came in, and a submitted draft\'s push starts. A resolution never fails on an archive: when the published version the last conflicts came from cannot be read, the draft\'s next sync moves its base instead.  **Fenced by a work item.** A caller executing a work item (one claimed through the controlplane\'s private work-item API) sends its claim in `Work-Item-Claim` (`{id}@{generation}`). The claim is checked first thing in the transaction that writes the document rows, and refused with `409` `draft-write-fenced` -- writing nothing -- when it is no longer the live one: released, cancelled, or swept after its holder stopped heartbeating. A malformed header is a `400`. Without the header the write is unfenced, as before. Only this operation honors the header.  Refuses with `400` (`draft-notebook-read-only`) when a document path ends `.malloynb` and the write would change it or add a new one to a draft that already has files. A `.malloynb` notebook in a draft is read-only: convert it to a `.malloy` notebook (the same name with `.malloy`, beside it) and edit that, or delete it. Writing identical content, or seeding an empty draft, is allowed, and so is a deletion.
      * @summary Write several of a draft\'s documents as one change
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
@@ -6196,30 +6302,18 @@ class DraftsApi extends base_1.BaseAPI {
         return (0, exports.DraftsApiFp)(this.configuration).writeDraftDocuments(organizationName, workspaceName, draftId, draftDocumentsWrite, workItemClaim, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Publishes the draft\'s bound package straight from its recorded merge commit, closing the loop after a pull request merges without a separate zip-upload publish. Panel-invoked rather than part of `updateDraftPullRequest`\'s own response — merge-click latency and proxy-timeout risk keep the two calls separate. `GitWebhookService` already publishes on merge on its own; this endpoint is the manual fallback the draft panel\'s own \"Publish\" button calls, for a merge whose webhook delivery was refused, lost, or raced the manifest\'s merge-commit stamp — safe to call more than once: a repeat answers 409, but so does a different publish having already taken that version id, and the two are told apart only by whether a served version carries this merge commit\'s own sha.  **Refuses (`409 draft-not-at-merge`) unless the manifest still carries a merge commit.** `updateDraftPullRequest` / `getDraftPullRequest` stamp `metadata.git.merge_commit_sha` best-effort and clear it the moment a checkpoint advances the draft past the merge, so a call made immediately after a merge can race a failed stamp. Reload the pull request (which repairs the stamp on the next qualified read) and retry.  Reads the package\'s subtree at the merge commit through the same draft reads the History/Files tabs use, so any file that cannot be read as UTF-8 text under 1MB refuses the whole publish (`409 draft-publish-unreadable-file`) rather than silently omitting it from the package.  Publishes only the manifest\'s own bound package (`metadata.git.package` / `metadata.git.environment`) — there is no way to name a different one.  **A successful publish closes the draft.** The draft and its branch are deleted, the branch delete pinned to the head that was published, when the draft is still at the merge this call published, no pull request is open on its branch, the publish did not create the package without attaching it to the workspace (`workspaceAttached: false`), the caller may delete the draft, and no agent sandbox turn is live on it. Otherwise the draft stays and the next change can continue it, as it does when the branch delete fails. A branch a published version records is kept while the draft is still deleted. The close never fails this call: the response is the publish\'s, and `publishedVersion` names the version it created.  **Authorization**: enforced where publishing already is — `createOrUpdatePackage`\'s own `can_create_package` / `can_update_package` check, re-run under the caller\'s principal.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary Publish a git-backed draft\'s merged package
-     * @param {string} organizationName The unique identifier of the organization
-     * @param {string} workspaceName The unique identifier of the workspace
-     * @param {string} draftId The draft package identifier
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof DraftsApi
-     */
-    writeDraftPublication(organizationName, workspaceName, draftId, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).writeDraftPublication(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * Proxies the code-assist git-gateway\'s `createDraftPullRequest`, forwarding the caller\'s own bearer token exactly as the History operations do. The gateway remains the sole authorizer; this endpoint performs no authorization of its own.  Idempotent — an already-open pull request for this draft comes back rather than a second one.  **Not a pure proxy: this call can sync and retry on your behalf.** A draft whose package already exists on the base branch — most commonly because this draft\'s own earlier pull request already merged it — is refused `409 draft-behind-base` unless it can be shown to derive from the base branch\'s current tip. Rather than surfacing that refusal immediately, this endpoint calls `updateDraftBranch`\'s own implementation, which merges the base branch into the draft\'s branch and writes `metadata.git.package_base_sha` on the draft\'s manifest from what that sync proves, then retries the create exactly once. Only a second refusal (a real race, or a draft whose package belongs to another name entirely) reaches the caller as `409`. A `sync-conflict` or `sync-rejected` from that internal sync surfaces as its own clear refusal, naming the manual paths out (resolve on github.com, or start a fresh draft) — resolve it there, or call `updateDraftBranch` directly for the same outcome without going through this endpoint.  **Authorization**: Requires the environment\'s `can_create_package` (enforced by the gateway) — proposing a change is the same authority as writing the draft.  **Git-backed drafts only.** A document-store draft answers `400` `draft-not-git-backed` before any call to the gateway: it has no branch, commits or pull request, so the operation does not apply to it. `409` `draft-provisioning` means the draft\'s branch is still being cut; retry.
-     * @summary Open a pull request for a git-backed draft
+     * The one way a draft ships, whether or not its environment reviews drafts on GitHub. Either the draft\'s package is published and this answers `200` with it, or nothing is published and it answers `409` `draft-not-ready` with `details.reason` saying what it waits on. Call it again once that clears: every step is safe to repeat, and a repeat after a publish answers with the version already published. `getDraftPublication` reads the same gates without acting on them.  **A draft whose environment does not review on GitHub** is published from its own files, in this order:  1. `conflicts`: the draft has unresolved conflicts (`details.conflictCount`). 2. `stale`: the package has a newer version than the one the draft is synced to;    the background sync brings it in. 3. `building` / `build-failed`: the draft\'s latest content has no passing build from    the last hour. A missing, pending or stale build is requested here and answers    `building`; a failing one answers `build-failed`, with the compiler\'s message. 4. The publish, `createOrUpdatePackage` naming this draft. The body\'s `description`    is written into the published `publisher.json`. A package that moved under the    draft while it published answers `stale`.  **A draft whose environment reviews on GitHub** merges its pull request and publishes the merge commit:  1. A draft whose pull request merged, and which has not changed since, goes straight    to the publish (8). One edited after its merge is a new pull request. While a    rebuild of a merged draft is pending this answers `building`: the build says    whether it holds an edit. A rebuild that failed on the merged content still    publishes the merge. One whose content cannot be compared answers `build-failed`    when it failed to compile, and `building` when it failed on Credible\'s side, which    this call asks to rebuild. 2. A push GitHub refused for good answers `push-refused`, with the reason in    `details.pushError`: `data_files_only`, `no_changes`, `content_refused`,    `review_outside_package`, `repository_too_large` or `push_refused`, until the    draft\'s content changes, which sends it again (`repository_too_large` only    fails again: see `push-refused` below). Otherwise a push is owed when the    draft has never been sent, has changed since its last push, or the body\'s    `title` / `description` differ from the pull request\'s; this call submits it. 3. `conflicts` (the draft\'s own, `details.conflictCount`) and `stale` (as above). 4. `sending` until the owed push lands and the pull request is open at it. 5. The build at the pull request\'s head must be a pass from the last hour. Otherwise    this call asks for one, which posts the head\'s check run once it settles, and    answers `building`, or `build-failed` for a failing one. 6. GitHub\'s mergeable state, as last recorded: `dirty` answers    `pull-request-conflicts` (the draft\'s own conflicts are step 3\'s `conflicts`, so    this one is resolved on GitHub), `draft` is read once more, as a press may follow    a pull request marked ready, and answers `pull-request-draft` if it still is (or    if GitHub cannot be read), and a state GitHub has not computed is read once more    and otherwise answers `sending`. `blocked`    with a passing build re-posts the head\'s passing check run, since a check run left    from an earlier answer can be what blocks it, and goes on to the merge. `behind`    alone does not refuse: the merge itself refuses a base branch that changed the    package. 7. The package at the head is listed once and refused for what a publish cannot    carry: `draft-publish-unreadable-file`, `draft-publish-too-large`, or    `draft-publish-manifest-missing` (no `publisher.json`). 8. The pull request is merged at that head, confined to the package and only while    the base branch has not changed the package since the draft\'s base, and the merge    commit is published. GitHub refusing the merge answers `pull-request-blocked`    (a required review or check is outstanding), a base branch that changed the    package `stale`, a head that moved `sending`, and a pull request that changes files    outside the package `push-refused` with `details.pushError`    `review_outside_package`: a merge here never carries them onto the base branch, so    they are reconciled on GitHub. A refusal because the pull request already merged    (a second Publish racing the first) publishes that merge.    Until the merge\'s version exists this answers `publishing` (the webhook or the    merge record holds it, or GitHub\'s merge time is not read yet); call again,    which never merges twice.  **A successful publish closes the draft**, as the publish of a draft always has: the draft and its branch are deleted unless it changed meanwhile, a pull request is open on its branch, the publish created the package without attaching it to the workspace (`workspaceAttached: false`), or an agent sandbox turn is live on it. The close never fails this call; `publishedVersion` names the version published, or the existing one that already carries this merge.  **Authorization**: the draft\'s modeling bar (`can_create_document` on the workspace, `can_create_package` on its environment) and `can_update_package` on a package that already exists; the publish itself re-checks them.  `409` `draft-converting` means the draft is moving to the new store; retry. A `400` is the publish refusing the package itself (an archive it cannot read, a name it does not accept).
+     * @summary Publish the draft
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} workspaceName The unique identifier of the workspace
      * @param {string} draftId The draft package identifier
+     * @param {DraftPublicationRequest} [draftPublicationRequest]
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof DraftsApi
      */
-    writeDraftPullRequest(organizationName, workspaceName, draftId, options) {
-        return (0, exports.DraftsApiFp)(this.configuration).writeDraftPullRequest(organizationName, workspaceName, draftId, options).then((request) => request(this.axios, this.basePath));
+    writeDraftPublication(organizationName, workspaceName, draftId, draftPublicationRequest, options) {
+        return (0, exports.DraftsApiFp)(this.configuration).writeDraftPublication(organizationName, workspaceName, draftId, draftPublicationRequest, options).then((request) => request(this.axios, this.basePath));
     }
 }
 exports.DraftsApi = DraftsApi;
@@ -6230,7 +6324,7 @@ exports.DraftsApi = DraftsApi;
 const EntitiesApiAxiosParamCreator = function (configuration) {
     return {
         /**
-         * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — extracted from the raw model text at publish time by malloy-code-server — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
+         * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — reported by the Publisher when the version is published — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
          * @summary List a version\'s field entities with their Malloy definitions
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} environmentName The unique identifier of the environment
@@ -6299,7 +6393,7 @@ const EntitiesApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.EntitiesApiAxiosParamCreator)(configuration);
     return {
         /**
-         * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — extracted from the raw model text at publish time by malloy-code-server — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
+         * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — reported by the Publisher when the version is published — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
          * @summary List a version\'s field entities with their Malloy definitions
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} environmentName The unique identifier of the environment
@@ -6332,7 +6426,7 @@ const EntitiesApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.EntitiesApiFp)(configuration);
     return {
         /**
-         * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — extracted from the raw model text at publish time by malloy-code-server — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
+         * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — reported by the Publisher when the version is published — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
          * @summary List a version\'s field entities with their Malloy definitions
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} environmentName The unique identifier of the environment
@@ -6359,7 +6453,7 @@ exports.EntitiesApiFactory = EntitiesApiFactory;
  */
 class EntitiesApi extends base_1.BaseAPI {
     /**
-     * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — extracted from the raw model text at publish time by malloy-code-server — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
+     * Lists the field-level entities (dimensions, measures, views, joins) of one model in this version, each carrying the Malloy `code` that defines it. This is a read of the version\'s entities artifact — reported by the Publisher when the version is published — never a recompilation, so it is available the moment the version exists.  `versionId` accepts the literal `latest`, resolved to the package\'s pinned latest version. Filters: `modelPath` (required) selects one model file; `source` optionally narrows to one source\'s entities.  Entities of sources outside the package\'s declared query surface (publisher #833 — not manifest-declared, or not in the model\'s `export {}` closure) are never returned: the serving plane hides those sources, so this endpoint must not leak their definitions. A version published before entities artifacts existed returns an empty list.  **Authorization**: Requires read access to the package (`can_read_package`). Deliberately weaker than `getPackageSource`\'s `can_update_package`: per-field definitions of *queryable* sources are viewer-facing documentation (the retrieval `/get_context` API already serves the same `code` under read access), unlike a raw source dump, which stays edit-gated.
      * @summary List a version\'s field entities with their Malloy definitions
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} environmentName The unique identifier of the environment
@@ -9280,6 +9374,291 @@ class InvitesApi extends base_1.BaseAPI {
     }
 }
 exports.InvitesApi = InvitesApi;
+/**
+ * MarketplaceSignupsApi - axios parameter creator
+ * @export
+ */
+const MarketplaceSignupsApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * The signup URL a marketplace listing names. GCP Marketplace posts the buyer\'s browser here with `x-gcp-marketplace-token`, a JWT that expires five minutes after it is sent, so the request is forwarded to billing (`POST /private/marketplace-signups`) at once. The buyer is not signed in yet, so this path takes the POST unauthenticated; billing checks the token.  The answer is a `303` to the signup app\'s `/marketplace` page, because the caller is a browser: with `#signup=<signupId>.<claim>&provider=<provider>` in the fragment when billing records the signup (`provider` is the marketplace, `gcp`), or `#error=<code>` when it refuses it (`SIGNUP_USED` for a token already used, where a cell consumes each once) or cannot be reached (`BILLING_UNAVAILABLE`). A fragment is never sent to a server, so the claim stays out of every log. A deployment with no signup page configured answers `503 MARKETPLACE_OFF` instead.  Only `x-gcp-marketplace-token` is read, and only up to 8 KB: a missing or longer token is `#error=INVALID_SIGNUP` without a call to billing. Any other field the form carries is ignored.
+         * @summary Receive a buyer sent by a cloud marketplace
+         * @param {string} [xGcpMarketplaceToken] GCP Marketplace\\\&#39;s signed signup token.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createMarketplaceSignup: (xGcpMarketplaceToken_1, ...args_1) => __awaiter(this, [xGcpMarketplaceToken_1, ...args_1], void 0, function* (xGcpMarketplaceToken, options = {}) {
+            const localVarPath = `/marketplace-signups`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'POST' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            const localVarFormParams = new URLSearchParams();
+            if (xGcpMarketplaceToken !== undefined) {
+                localVarFormParams.set('x-gcp-marketplace-token', xGcpMarketplaceToken);
+            }
+            localVarHeaderParameter['Content-Type'] = 'application/x-www-form-urlencoded';
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            localVarRequestOptions.data = localVarFormParams.toString();
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+    };
+};
+exports.MarketplaceSignupsApiAxiosParamCreator = MarketplaceSignupsApiAxiosParamCreator;
+/**
+ * MarketplaceSignupsApi - functional programming interface
+ * @export
+ */
+const MarketplaceSignupsApiFp = function (configuration) {
+    const localVarAxiosParamCreator = (0, exports.MarketplaceSignupsApiAxiosParamCreator)(configuration);
+    return {
+        /**
+         * The signup URL a marketplace listing names. GCP Marketplace posts the buyer\'s browser here with `x-gcp-marketplace-token`, a JWT that expires five minutes after it is sent, so the request is forwarded to billing (`POST /private/marketplace-signups`) at once. The buyer is not signed in yet, so this path takes the POST unauthenticated; billing checks the token.  The answer is a `303` to the signup app\'s `/marketplace` page, because the caller is a browser: with `#signup=<signupId>.<claim>&provider=<provider>` in the fragment when billing records the signup (`provider` is the marketplace, `gcp`), or `#error=<code>` when it refuses it (`SIGNUP_USED` for a token already used, where a cell consumes each once) or cannot be reached (`BILLING_UNAVAILABLE`). A fragment is never sent to a server, so the claim stays out of every log. A deployment with no signup page configured answers `503 MARKETPLACE_OFF` instead.  Only `x-gcp-marketplace-token` is read, and only up to 8 KB: a missing or longer token is `#error=INVALID_SIGNUP` without a call to billing. Any other field the form carries is ignored.
+         * @summary Receive a buyer sent by a cloud marketplace
+         * @param {string} [xGcpMarketplaceToken] GCP Marketplace\\\&#39;s signed signup token.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createMarketplaceSignup(xGcpMarketplaceToken, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.createMarketplaceSignup(xGcpMarketplaceToken, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['MarketplaceSignupsApi.createMarketplaceSignup']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+    };
+};
+exports.MarketplaceSignupsApiFp = MarketplaceSignupsApiFp;
+/**
+ * MarketplaceSignupsApi - factory interface
+ * @export
+ */
+const MarketplaceSignupsApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = (0, exports.MarketplaceSignupsApiFp)(configuration);
+    return {
+        /**
+         * The signup URL a marketplace listing names. GCP Marketplace posts the buyer\'s browser here with `x-gcp-marketplace-token`, a JWT that expires five minutes after it is sent, so the request is forwarded to billing (`POST /private/marketplace-signups`) at once. The buyer is not signed in yet, so this path takes the POST unauthenticated; billing checks the token.  The answer is a `303` to the signup app\'s `/marketplace` page, because the caller is a browser: with `#signup=<signupId>.<claim>&provider=<provider>` in the fragment when billing records the signup (`provider` is the marketplace, `gcp`), or `#error=<code>` when it refuses it (`SIGNUP_USED` for a token already used, where a cell consumes each once) or cannot be reached (`BILLING_UNAVAILABLE`). A fragment is never sent to a server, so the claim stays out of every log. A deployment with no signup page configured answers `503 MARKETPLACE_OFF` instead.  Only `x-gcp-marketplace-token` is read, and only up to 8 KB: a missing or longer token is `#error=INVALID_SIGNUP` without a call to billing. Any other field the form carries is ignored.
+         * @summary Receive a buyer sent by a cloud marketplace
+         * @param {string} [xGcpMarketplaceToken] GCP Marketplace\\\&#39;s signed signup token.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createMarketplaceSignup(xGcpMarketplaceToken, options) {
+            return localVarFp.createMarketplaceSignup(xGcpMarketplaceToken, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+exports.MarketplaceSignupsApiFactory = MarketplaceSignupsApiFactory;
+/**
+ * MarketplaceSignupsApi - object-oriented interface
+ * @export
+ * @class MarketplaceSignupsApi
+ * @extends {BaseAPI}
+ */
+class MarketplaceSignupsApi extends base_1.BaseAPI {
+    /**
+     * The signup URL a marketplace listing names. GCP Marketplace posts the buyer\'s browser here with `x-gcp-marketplace-token`, a JWT that expires five minutes after it is sent, so the request is forwarded to billing (`POST /private/marketplace-signups`) at once. The buyer is not signed in yet, so this path takes the POST unauthenticated; billing checks the token.  The answer is a `303` to the signup app\'s `/marketplace` page, because the caller is a browser: with `#signup=<signupId>.<claim>&provider=<provider>` in the fragment when billing records the signup (`provider` is the marketplace, `gcp`), or `#error=<code>` when it refuses it (`SIGNUP_USED` for a token already used, where a cell consumes each once) or cannot be reached (`BILLING_UNAVAILABLE`). A fragment is never sent to a server, so the claim stays out of every log. A deployment with no signup page configured answers `503 MARKETPLACE_OFF` instead.  Only `x-gcp-marketplace-token` is read, and only up to 8 KB: a missing or longer token is `#error=INVALID_SIGNUP` without a call to billing. Any other field the form carries is ignored.
+     * @summary Receive a buyer sent by a cloud marketplace
+     * @param {string} [xGcpMarketplaceToken] GCP Marketplace\\\&#39;s signed signup token.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof MarketplaceSignupsApi
+     */
+    createMarketplaceSignup(xGcpMarketplaceToken, options) {
+        return (0, exports.MarketplaceSignupsApiFp)(this.configuration).createMarketplaceSignup(xGcpMarketplaceToken, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+exports.MarketplaceSignupsApi = MarketplaceSignupsApi;
+/**
+ * MarketplaceSubscriptionsApi - axios parameter creator
+ * @export
+ */
+const MarketplaceSubscriptionsApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * The organization\'s latest purchase through a cloud marketplace, as billing has it. 404 when the organization is not billed through a marketplace.  **Authorization**: `can_read_organization`.
+         * @summary The organization\'s marketplace subscription
+         * @param {string} organizationName The organization\&#39;s name
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getOrganizationMarketplaceSubscription: (organizationName_1, ...args_1) => __awaiter(this, [organizationName_1, ...args_1], void 0, function* (organizationName, options = {}) {
+            // verify required parameter 'organizationName' is not null or undefined
+            (0, common_1.assertParamExists)('getOrganizationMarketplaceSubscription', 'organizationName', organizationName);
+            const localVarPath = `/organizations/{organizationName}/marketplace-subscription`
+                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+        /**
+         * For a buyer who already administers an organization: attaches the marketplace signup they came with (the `signupId` and `claim` from the signup app\'s fragment) to this organization. Billing consumes the claim and approves the purchase; once the subscription is ACTIVE the organization is billed through the marketplace, without the self-serve limits or an LLM spend cap. Until then it keeps how it is billed, self-serve cap included. A purchase that is already suspended or ended records nothing, and one that is suspended or ends before it was ever ACTIVE puts the organization back to how it was billed: an attached organization is never frozen for a subscription that never started.  **Authorization**: `active_admin` on the organization.
+         * @summary Bill an existing organization through the buyer\'s marketplace purchase
+         * @param {string} organizationName The organization\&#39;s name
+         * @param {MarketplaceSubscriptionLink} marketplaceSubscriptionLink
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        putOrganizationMarketplaceSubscription: (organizationName_1, marketplaceSubscriptionLink_1, ...args_1) => __awaiter(this, [organizationName_1, marketplaceSubscriptionLink_1, ...args_1], void 0, function* (organizationName, marketplaceSubscriptionLink, options = {}) {
+            // verify required parameter 'organizationName' is not null or undefined
+            (0, common_1.assertParamExists)('putOrganizationMarketplaceSubscription', 'organizationName', organizationName);
+            // verify required parameter 'marketplaceSubscriptionLink' is not null or undefined
+            (0, common_1.assertParamExists)('putOrganizationMarketplaceSubscription', 'marketplaceSubscriptionLink', marketplaceSubscriptionLink);
+            const localVarPath = `/organizations/{organizationName}/marketplace-subscription`
+                .replace(`{${"organizationName"}}`, encodeURIComponent(String(organizationName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'PUT' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(marketplaceSubscriptionLink, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        }),
+    };
+};
+exports.MarketplaceSubscriptionsApiAxiosParamCreator = MarketplaceSubscriptionsApiAxiosParamCreator;
+/**
+ * MarketplaceSubscriptionsApi - functional programming interface
+ * @export
+ */
+const MarketplaceSubscriptionsApiFp = function (configuration) {
+    const localVarAxiosParamCreator = (0, exports.MarketplaceSubscriptionsApiAxiosParamCreator)(configuration);
+    return {
+        /**
+         * The organization\'s latest purchase through a cloud marketplace, as billing has it. 404 when the organization is not billed through a marketplace.  **Authorization**: `can_read_organization`.
+         * @summary The organization\'s marketplace subscription
+         * @param {string} organizationName The organization\&#39;s name
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getOrganizationMarketplaceSubscription(organizationName, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.getOrganizationMarketplaceSubscription(organizationName, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['MarketplaceSubscriptionsApi.getOrganizationMarketplaceSubscription']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+        /**
+         * For a buyer who already administers an organization: attaches the marketplace signup they came with (the `signupId` and `claim` from the signup app\'s fragment) to this organization. Billing consumes the claim and approves the purchase; once the subscription is ACTIVE the organization is billed through the marketplace, without the self-serve limits or an LLM spend cap. Until then it keeps how it is billed, self-serve cap included. A purchase that is already suspended or ended records nothing, and one that is suspended or ends before it was ever ACTIVE puts the organization back to how it was billed: an attached organization is never frozen for a subscription that never started.  **Authorization**: `active_admin` on the organization.
+         * @summary Bill an existing organization through the buyer\'s marketplace purchase
+         * @param {string} organizationName The organization\&#39;s name
+         * @param {MarketplaceSubscriptionLink} marketplaceSubscriptionLink
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        putOrganizationMarketplaceSubscription(organizationName, marketplaceSubscriptionLink, options) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                const localVarAxiosArgs = yield localVarAxiosParamCreator.putOrganizationMarketplaceSubscription(organizationName, marketplaceSubscriptionLink, options);
+                const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+                const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['MarketplaceSubscriptionsApi.putOrganizationMarketplaceSubscription']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+                return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+            });
+        },
+    };
+};
+exports.MarketplaceSubscriptionsApiFp = MarketplaceSubscriptionsApiFp;
+/**
+ * MarketplaceSubscriptionsApi - factory interface
+ * @export
+ */
+const MarketplaceSubscriptionsApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = (0, exports.MarketplaceSubscriptionsApiFp)(configuration);
+    return {
+        /**
+         * The organization\'s latest purchase through a cloud marketplace, as billing has it. 404 when the organization is not billed through a marketplace.  **Authorization**: `can_read_organization`.
+         * @summary The organization\'s marketplace subscription
+         * @param {string} organizationName The organization\&#39;s name
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getOrganizationMarketplaceSubscription(organizationName, options) {
+            return localVarFp.getOrganizationMarketplaceSubscription(organizationName, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * For a buyer who already administers an organization: attaches the marketplace signup they came with (the `signupId` and `claim` from the signup app\'s fragment) to this organization. Billing consumes the claim and approves the purchase; once the subscription is ACTIVE the organization is billed through the marketplace, without the self-serve limits or an LLM spend cap. Until then it keeps how it is billed, self-serve cap included. A purchase that is already suspended or ended records nothing, and one that is suspended or ends before it was ever ACTIVE puts the organization back to how it was billed: an attached organization is never frozen for a subscription that never started.  **Authorization**: `active_admin` on the organization.
+         * @summary Bill an existing organization through the buyer\'s marketplace purchase
+         * @param {string} organizationName The organization\&#39;s name
+         * @param {MarketplaceSubscriptionLink} marketplaceSubscriptionLink
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        putOrganizationMarketplaceSubscription(organizationName, marketplaceSubscriptionLink, options) {
+            return localVarFp.putOrganizationMarketplaceSubscription(organizationName, marketplaceSubscriptionLink, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+exports.MarketplaceSubscriptionsApiFactory = MarketplaceSubscriptionsApiFactory;
+/**
+ * MarketplaceSubscriptionsApi - object-oriented interface
+ * @export
+ * @class MarketplaceSubscriptionsApi
+ * @extends {BaseAPI}
+ */
+class MarketplaceSubscriptionsApi extends base_1.BaseAPI {
+    /**
+     * The organization\'s latest purchase through a cloud marketplace, as billing has it. 404 when the organization is not billed through a marketplace.  **Authorization**: `can_read_organization`.
+     * @summary The organization\'s marketplace subscription
+     * @param {string} organizationName The organization\&#39;s name
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof MarketplaceSubscriptionsApi
+     */
+    getOrganizationMarketplaceSubscription(organizationName, options) {
+        return (0, exports.MarketplaceSubscriptionsApiFp)(this.configuration).getOrganizationMarketplaceSubscription(organizationName, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * For a buyer who already administers an organization: attaches the marketplace signup they came with (the `signupId` and `claim` from the signup app\'s fragment) to this organization. Billing consumes the claim and approves the purchase; once the subscription is ACTIVE the organization is billed through the marketplace, without the self-serve limits or an LLM spend cap. Until then it keeps how it is billed, self-serve cap included. A purchase that is already suspended or ended records nothing, and one that is suspended or ends before it was ever ACTIVE puts the organization back to how it was billed: an attached organization is never frozen for a subscription that never started.  **Authorization**: `active_admin` on the organization.
+     * @summary Bill an existing organization through the buyer\'s marketplace purchase
+     * @param {string} organizationName The organization\&#39;s name
+     * @param {MarketplaceSubscriptionLink} marketplaceSubscriptionLink
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof MarketplaceSubscriptionsApi
+     */
+    putOrganizationMarketplaceSubscription(organizationName, marketplaceSubscriptionLink, options) {
+        return (0, exports.MarketplaceSubscriptionsApiFp)(this.configuration).putOrganizationMarketplaceSubscription(organizationName, marketplaceSubscriptionLink, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+exports.MarketplaceSubscriptionsApi = MarketplaceSubscriptionsApi;
 /**
  * MaterializationsApi - axios parameter creator
  * @export
@@ -10087,7 +10466,7 @@ const OrganizationsApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
+         * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  A group access token always lists the organization it belongs to, even when its group holds grants only on single packages there and cannot read the organization itself. It never lists that organization under `userPermission=admin` unless the group is an admin of it.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
          * @summary List all organizations
          * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–100.
          * @param {number} [offset] Number of items to skip before starting to return results
@@ -10291,7 +10670,7 @@ const OrganizationsApiFp = function (configuration) {
             });
         },
         /**
-         * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
+         * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  A group access token always lists the organization it belongs to, even when its group holds grants only on single packages there and cannot read the organization itself. It never lists that organization under `userPermission=admin` unless the group is an admin of it.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
          * @summary List all organizations
          * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–100.
          * @param {number} [offset] Number of items to skip before starting to return results
@@ -10409,7 +10788,7 @@ const OrganizationsApiFactory = function (configuration, basePath, axios) {
             return localVarFp.listOrganizationUsers(organizationName, blocked, limit, offset, options).then((request) => request(axios, basePath));
         },
         /**
-         * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
+         * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  A group access token always lists the organization it belongs to, even when its group holds grants only on single packages there and cannot read the organization itself. It never lists that organization under `userPermission=admin` unless the group is an admin of it.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
          * @summary List all organizations
          * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–100.
          * @param {number} [offset] Number of items to skip before starting to return results
@@ -10514,7 +10893,7 @@ class OrganizationsApi extends base_1.BaseAPI {
         return (0, exports.OrganizationsApiFp)(this.configuration).listOrganizationUsers(organizationName, blocked, limit, offset, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
+     * Retrieves a comprehensive list of all organizations accessible to the authenticated user. This endpoint returns organization metadata including names, display names, and timestamps.  A group access token always lists the organization it belongs to, even when its group holds grants only on single packages there and cannot read the organization itself. It never lists that organization under `userPermission=admin` unless the group is an admin of it.  **Authorization**: Requires appropriate permissions to view organizations.  **Outside the organization**: an organization the caller is not a member of is listed when a package in it is shared with them and it allows sharing outside it. Its row carries `external: true` and only `name`, `displayName`, `createdAt` and `updatedAt`.  **Rate Limiting**: Standard rate limits apply.  **Pagination**: Supports offset-based pagination with limit and offset parameters.
      * @summary List all organizations
      * @param {number} [limit] Maximum number of items to return. Use -1 or omit to return all results. Valid values: -1 (all results) or 1–100.
      * @param {number} [offset] Number of items to skip before starting to return results
@@ -11051,7 +11430,7 @@ exports.PackagePermissionsApi = PackagePermissionsApi;
 const PackagesApiAxiosParamCreator = function (configuration) {
     return {
         /**
-         * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
+         * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **A `version` part without an `id` is assigned.** The server picks the version under the package\'s lock and writes it into the stored archive\'s `publisher.json`: the version `publisher.json` names when it is free and newer than every published version (a floor, so `\"2.0.0\"` written once starts the 2.x line), otherwise the highest published version with its patch bumped, or `1.0.0` for a first publish. The response\'s `publishedVersion` names it, and the package serves it at once (becomes its `latestVersion`), whatever its `autoPromote`: the caller asked to publish, not to stage. A `version` part WITH an `id` publishes exactly that id, and `409`s when it is taken; it serves at once when the request also names it as the package\'s `latestVersion` or creates the package, otherwise when `autoPromote` promotes it. No `version` part updates package metadata only (and a create without one is a `400`). An upload whose `publisher.json` must be rewritten to name its version is a `400` past 512 MiB inflated.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
          * @summary Create or update package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} environmentName The unique identifier of the environment
@@ -11321,7 +11700,7 @@ const PackagesApiAxiosParamCreator = function (configuration) {
             };
         }),
         /**
-         * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires read access to the organization; `public` requires organization admin permissions. **Response**: Returns array of package resource identifiers.
+         * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires that the caller can enter the organization (a member, or a person outside it holding an outside grant on one of its packages), or an API key issued for this organization. Such a key lists the packages its group can read even when the group holds grants only on single packages and cannot read the organization. Any other caller gets 403. `public` requires organization admin permissions. The list holds only packages the caller can read (or share). **Response**: Returns array of package resource identifiers.
          * @summary List accessible packages by organization
          * @param {string} organizationName The unique identifier of the organization
          * @param {boolean} [onlyShareable] When true, returns only packages the user can share (admin/modeler). When false, returns all readable packages.
@@ -11451,7 +11830,7 @@ const PackagesApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.PackagesApiAxiosParamCreator)(configuration);
     return {
         /**
-         * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
+         * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **A `version` part without an `id` is assigned.** The server picks the version under the package\'s lock and writes it into the stored archive\'s `publisher.json`: the version `publisher.json` names when it is free and newer than every published version (a floor, so `\"2.0.0\"` written once starts the 2.x line), otherwise the highest published version with its patch bumped, or `1.0.0` for a first publish. The response\'s `publishedVersion` names it, and the package serves it at once (becomes its `latestVersion`), whatever its `autoPromote`: the caller asked to publish, not to stage. A `version` part WITH an `id` publishes exactly that id, and `409`s when it is taken; it serves at once when the request also names it as the package\'s `latestVersion` or creates the package, otherwise when `autoPromote` promotes it. No `version` part updates package metadata only (and a create without one is a `400`). An upload whose `publisher.json` must be rewritten to name its version is a `400` past 512 MiB inflated.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
          * @summary Create or update package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} environmentName The unique identifier of the environment
@@ -11571,7 +11950,7 @@ const PackagesApiFp = function (configuration) {
             });
         },
         /**
-         * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires read access to the organization; `public` requires organization admin permissions. **Response**: Returns array of package resource identifiers.
+         * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires that the caller can enter the organization (a member, or a person outside it holding an outside grant on one of its packages), or an API key issued for this organization. Such a key lists the packages its group can read even when the group holds grants only on single packages and cannot read the organization. Any other caller gets 403. `public` requires organization admin permissions. The list holds only packages the caller can read (or share). **Response**: Returns array of package resource identifiers.
          * @summary List accessible packages by organization
          * @param {string} organizationName The unique identifier of the organization
          * @param {boolean} [onlyShareable] When true, returns only packages the user can share (admin/modeler). When false, returns all readable packages.
@@ -11637,7 +12016,7 @@ const PackagesApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.PackagesApiFp)(configuration);
     return {
         /**
-         * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
+         * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **A `version` part without an `id` is assigned.** The server picks the version under the package\'s lock and writes it into the stored archive\'s `publisher.json`: the version `publisher.json` names when it is free and newer than every published version (a floor, so `\"2.0.0\"` written once starts the 2.x line), otherwise the highest published version with its patch bumped, or `1.0.0` for a first publish. The response\'s `publishedVersion` names it, and the package serves it at once (becomes its `latestVersion`), whatever its `autoPromote`: the caller asked to publish, not to stage. A `version` part WITH an `id` publishes exactly that id, and `409`s when it is taken; it serves at once when the request also names it as the package\'s `latestVersion` or creates the package, otherwise when `autoPromote` promotes it. No `version` part updates package metadata only (and a create without one is a `400`). An upload whose `publisher.json` must be rewritten to name its version is a `400` past 512 MiB inflated.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
          * @summary Create or update package
          * @param {string} organizationName The unique identifier of the organization
          * @param {string} environmentName The unique identifier of the environment
@@ -11721,7 +12100,7 @@ const PackagesApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getPackageVersionFileContent(organizationName, environmentName, packageName, versionId, documentPath, options).then((request) => request(axios, basePath));
         },
         /**
-         * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires read access to the organization; `public` requires organization admin permissions. **Response**: Returns array of package resource identifiers.
+         * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires that the caller can enter the organization (a member, or a person outside it holding an outside grant on one of its packages), or an API key issued for this organization. Such a key lists the packages its group can read even when the group holds grants only on single packages and cannot read the organization. Any other caller gets 403. `public` requires organization admin permissions. The list holds only packages the caller can read (or share). **Response**: Returns array of package resource identifiers.
          * @summary List accessible packages by organization
          * @param {string} organizationName The unique identifier of the organization
          * @param {boolean} [onlyShareable] When true, returns only packages the user can share (admin/modeler). When false, returns all readable packages.
@@ -11769,7 +12148,7 @@ exports.PackagesApiFactory = PackagesApiFactory;
  */
 class PackagesApi extends base_1.BaseAPI {
     /**
-     * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
+     * Creates a new package or updates an existing one with a new version. This endpoint handles both package metadata and file uploads for package content.  **A `version` part without an `id` is assigned.** The server picks the version under the package\'s lock and writes it into the stored archive\'s `publisher.json`: the version `publisher.json` names when it is free and newer than every published version (a floor, so `\"2.0.0\"` written once starts the 2.x line), otherwise the highest published version with its patch bumped, or `1.0.0` for a first publish. The response\'s `publishedVersion` names it, and the package serves it at once (becomes its `latestVersion`), whatever its `autoPromote`: the caller asked to publish, not to stage. A `version` part WITH an `id` publishes exactly that id, and `409`s when it is taken; it serves at once when the request also names it as the package\'s `latestVersion` or creates the package, otherwise when `autoPromote` promotes it. No `version` part updates package metadata only (and a create without one is a `400`). An upload whose `publisher.json` must be rewritten to name its version is a `400` past 512 MiB inflated.  **Authorization**: Requires package admin or modeler permissions. **Content**: Accepts multipart form data with package metadata and binary file content. **Validation**: Validates package structure and file integrity using MD5 hash.
      * @summary Create or update package
      * @param {string} organizationName The unique identifier of the organization
      * @param {string} environmentName The unique identifier of the environment
@@ -11859,7 +12238,7 @@ class PackagesApi extends base_1.BaseAPI {
         return (0, exports.PackagesApiFp)(this.configuration).getPackageVersionFileContent(organizationName, environmentName, packageName, versionId, documentPath, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires read access to the organization; `public` requires organization admin permissions. **Response**: Returns array of package resource identifiers.
+     * Returns a list of package resource identifiers under the given organization that the current user has access to. By default returns only packages the user can share (admin/modeler role). Set `onlyShareable=false` to include all readable packages (including viewer access), and `public` to filter by whether a package is public.  **Note**: This endpoint provides cross-environment package visibility. It aggregates packages from all environments within the organization that the user has access to.  **Authorization**: Requires that the caller can enter the organization (a member, or a person outside it holding an outside grant on one of its packages), or an API key issued for this organization. Such a key lists the packages its group can read even when the group holds grants only on single packages and cannot read the organization. Any other caller gets 403. `public` requires organization admin permissions. The list holds only packages the caller can read (or share). **Response**: Returns array of package resource identifiers.
      * @summary List accessible packages by organization
      * @param {string} organizationName The unique identifier of the organization
      * @param {boolean} [onlyShareable] When true, returns only packages the user can share (admin/modeler). When false, returns all readable packages.