@curviate/sdk 0.31.0 → 0.33.0

package/src/generated/types.ts

@@ -749,7 +749,7 @@ export interface paths {
         put?: never;
         /**
          * Start a chat
-         * @description Starts a new chat with one or more members from a connected account. Send application/json; attach files as base64-encoded attachments (max 5 MiB per file, and 9 MiB for the whole request body; base64 makes a file about a third larger in the body than on disk). Message content passes through to the platform and is never stored. Company pages are reply-only and cannot start a conversation; reply using a `COMPANY_` chat id from GET /v1/{account_id}/inboxes/{inbox_id}/chats instead.
+         * @description Starts a new chat with one or more members from a connected account. Send application/json; attach files as base64-encoded attachments (max 5 MiB per file, and 9 MiB for the whole request body; base64 makes a file about a third larger in the body than on disk). This call keeps nothing and logs nothing. Once sent it is a message in the account's inbox, so reading that conversation back through Curviate stores its body in your tenant's inbox records, with no expiry. Company pages are reply-only and cannot start a conversation; reply using a `COMPANY_` chat id from GET /v1/{account_id}/inboxes/{inbox_id}/chats instead.
          */
         post: operations["postV1AccountIdChats"];
         delete?: never;
@@ -797,7 +797,7 @@ export interface paths {
         put?: never;
         /**
          * Send a message
-         * @description Sends a message into an existing chat. Send application/json with text, base64 attachments (max 5 MiB per file, and 9 MiB for the whole request body; base64 makes a file about a third larger in the body than on disk), or both; at least one of text or attachments is required. Message content passes through to the platform and is never stored. Sending on behalf of a company page: use a COMPANY_ chat id (from GET /v1/{account_id}/inboxes/{inbox_id}/chats) and the message sends AS THE PAGE, no separate parameter needed. The response's sent_as field names the acting identity that was actually used. Company pages are reply-only: this endpoint can answer an existing conversation on a page's behalf, but a page can never start a new one.
+         * @description Sends a message into an existing chat. Send application/json with text, base64 attachments (max 5 MiB per file, and 9 MiB for the whole request body; base64 makes a file about a third larger in the body than on disk), or both; at least one of text or attachments is required. This call keeps nothing and logs nothing. Once sent it is a message in the account's inbox, so reading that conversation back through Curviate stores its body in your tenant's inbox records, with no expiry. Sending on behalf of a company page: use a COMPANY_ chat id (from GET /v1/{account_id}/inboxes/{inbox_id}/chats) and the message sends AS THE PAGE, no separate parameter needed. The response's sent_as field names the acting identity that was actually used. Company pages are reply-only: this endpoint can answer an existing conversation on a page's behalf, but a page can never start a new one.
          */
         post: operations["postV1AccountIdChatsChatIdMessages"];
         delete?: never;
@@ -2300,6 +2300,26 @@ export interface paths {
         patch: operations["patchV1AccountsAccountId"];
         trace?: never;
     };
+    "/v1/accounts/seats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List seats
+         * @description List the workspace's seats: each `seat_id`, whether an account occupies it, and that `account_id`. Pass an unoccupied `seat_id` to POST /v1/auth/intent to connect a new account. Every unoccupied seat listed is a valid connect target. Not paginated.
+         */
+        get: operations["getV1AccountsSeats"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/intent": {
         parameters: {
             query?: never;
@@ -2311,7 +2331,7 @@ export interface paths {
         put?: never;
         /**
          * Start a credential/cookie authentication
-         * @description Authenticate a LinkedIn account directly with credentials or a session cookie. The credential fields are NESTED, not top level: `auth_method: "credentials"` reads `credentials: { email, password }`, and `auth_method: "cookie"` reads `cookie: { li_at }` plus a top-level `user_agent`. Omit `account_id` to connect a NEW account into an empty `seat_id` (every seat id is listed with click-to-copy in the seat table on your dashboard); include `account_id` (in the body) to re-authenticate an EXISTING account in place. Returns the account on success (201 new / 200 reconnect), or a checkpoint challenge (202) carrying the account_id when LinkedIn requires verification. Complete the challenge with POST /v1/auth/checkpoint/solve (codes) or POST /v1/auth/checkpoint/poll (mobile-app approval). Connection scope (which LinkedIn products are enabled) is not something you list: the connection asks for every product and LinkedIn activates the ones the account actually has. The recorded scope is readable as `requested_products` on the account. One LinkedIn account can hold only one of the two premium surfaces, and when both are asked for Sales Navigator takes precedence, so pass the optional `linkedin_premium` (`sales_navigator` or `recruiter`) if the account holds both and you want the other one. Omit it and nothing is narrowed. It applies per connection and is not remembered, so state it on every connect and reconnect where Recruiter must win. A reconnect that changes scope must use credentials (a saved cookie cannot change scope), which includes any reconnect of an account connected before the full product set became the default. Pin a managed proxy with the optional `country`/`ip` or supply a `proxy` to override it.
+         * @description Authenticate a LinkedIn account directly with credentials or a session cookie. The credential fields are NESTED, not top level: `auth_method: "credentials"` reads `credentials: { email, password }`, and `auth_method: "cookie"` reads `cookie: { li_at }` plus a top-level `user_agent`. Omit `account_id` to connect a NEW account into an empty `seat_id` (list your seats with GET /v1/accounts/seats, or copy a seat id from the seat table on your dashboard); include `account_id` (in the body) to re-authenticate an EXISTING account in place. Returns the account on success (201 new / 200 reconnect), or a checkpoint challenge (202) carrying the account_id when LinkedIn requires verification. Complete the challenge with POST /v1/auth/checkpoint/solve (codes) or POST /v1/auth/checkpoint/poll (mobile-app approval). Connection scope (which LinkedIn products are enabled) is not something you list: the connection asks for every product and LinkedIn activates the ones the account actually has. The recorded scope is readable as `requested_products` on the account. One LinkedIn account can hold only one of the two premium surfaces, and when both are asked for Sales Navigator takes precedence, so pass the optional `linkedin_premium` (`sales_navigator` or `recruiter`) if the account holds both and you want the other one. Omit it and nothing is narrowed. It applies per connection and is not remembered, so state it on every connect and reconnect where Recruiter must win. A reconnect that changes scope must use credentials (a saved cookie cannot change scope), which includes any reconnect of an account connected before the full product set became the default. Pin a managed proxy with the optional `country`/`ip` or supply a `proxy` to override it.
          */
         post: operations["postV1AuthIntent"];
         delete?: never;
@@ -2581,7 +2601,7 @@ export interface paths {
         };
         /**
          * Read an account's safety policy
-         * @description Returns every configurable safety field for every budget row of one account, in a single response: the ceiling, the green and amber bands, the counting window, the enforcement posture and where it was inherited from, the activity window, warm-up state, the per-row character caps and search per-query cap, and how well calibrated each row's number is. Every value is seeded configuration and every one of them is settable. Where a configured value is above the Curviate default, the row carries an `over_default` entry naming the value, the default and the source class of that default. The response also carries `tenant_default_posture`, the workspace-wide default every account inherits, separately from this account's own effective `posture`, and `limit_profile`, which says which of the four Curviate default sets (`basic`, `premium`, `sales_navigator`, `recruiter`) every row below was resolved from, detected from the platform when the account connected.
+         * @description Returns every configurable safety field for every budget row of one account, in a single response: the ceiling, the green and amber bands, the counting window, the enforcement posture and where it was inherited from, the activity window, warm-up state, the per-row character caps and search per-query cap, and how well calibrated each row's number is. Every value is seeded configuration and every one of them is settable. Each value is this account's own where it set one, otherwise the tenant default for its `limit_profile` (`GET /v1/safety-policy`), otherwise the Curviate default. Where a configured value is above the Curviate default, the row carries an `over_default` entry naming the value, the default and the source class of that default. The response also carries `tenant_default_posture`, the workspace-wide default every account inherits, separately from this account's own effective `posture`, and `limit_profile`, which says which of the four Curviate default sets (`basic`, `premium`, `sales_navigator`, `recruiter`) every row below was resolved from, detected from the platform when the account connected.
          */
         get: operations["getV1AccountIdSafetyPolicy"];
         put?: never;
@@ -2591,7 +2611,7 @@ export interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The single safety-policy write. Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the Curviate default. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
+         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2616,6 +2636,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/safety-policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read the tenant safety defaults
+         * @description Returns the tenant-wide safety defaults, per limit profile and per budget row: the values every account on that profile resolves from unless it sets its own. A value nobody has set here is the Curviate default, and a value set above the Curviate default carries an `over_default` entry naming the value, the default and its source class. Also carries `tenant_default_posture`. Works with no accounts connected, so defaults can be in place before the first one is.
+         */
+        get: operations["getV1SafetyPolicy"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update the tenant safety defaults
+         * @description The tenant-level safety-policy write. Sets defaults per limit profile and per budget row; every account on that profile resolves from them unless it overrides the same field itself, including accounts connected later. THIS CHANGES EVERY ACCOUNT IN THE TENANT THAT HAS NOT OVERRIDDEN THE FIELD, and it applies immediately: under `enforce` posture, lowering a default can start refusing actions across the tenant in one request. The response carries `impact`: how many accounts had a ceiling change, and how many moved into `over`, measured on those accounts before and after the write. Send only what you are changing; `null` clears a default back to the Curviate default. A value equal to the one already in force is not stored and not recorded. Any limit may be set to any value, and a value above the Curviate default is reported rather than refused. Every change is appended to the ledger with the previous value, the new value, the Curviate default, the actor and the time. Per-row posture is not a tenant default: use `tenant_default_posture` here, or `posture` on an account's own policy. Per-account values are set on `PATCH /v1/{account_id}/safety-policy`.
+         */
+        patch: operations["patchV1SafetyPolicy"];
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -2744,7 +2788,7 @@ export interface components {
             chat_id?: string;
             /** @description Identifier of the sender. */
             sender_id?: string;
-            /** @description Full message text (content pass-through, never stored). */
+            /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
             text?: string | null;
             /** @description Attachment descriptors (no bytes, use the attachment endpoint to download). */
             attachments?: {
@@ -2779,6 +2823,11 @@ export interface components {
             reaction_count?: number;
             /** @description The platform this message originates from. */
             provider?: string;
+            /** @description Platform-specific detail on the message. Carries `subject` for an InMail, which is set on the thread's opening message; absent or empty for an ordinary message. */
+            specifics?: {
+                /** @description The InMail subject line, when the platform carries one on this message. Ordinary messages have none. Reading a conversation back stores the subject in your tenant's inbox records alongside the body, with no expiry. */
+                subject?: string | null;
+            };
             /** @description The sender's profile, when the platform returned one alongside the message. sender_id always carries the identifier; this object carries the rest of what is known about that person. */
             sender?: {
                 /** @description Identifier of the counterpart. */
@@ -10196,7 +10245,7 @@ export interface operations {
                             last_message_timestamp?: string;
                             /** @description Identifier of the 1:1 counterpart. */
                             user_id?: string;
-                            /** @description The most recent message in the chat. */
+                            /** @description The most recent message in the chat. Subjects are not previewed here, read the chat's messages for one. */
                             last_message?: {
                                 /**
                                  * @description Response type discriminator.
@@ -10212,7 +10261,7 @@ export interface operations {
                                 chat_id?: string;
                                 /** @description Identifier of the sender. */
                                 sender_id?: string;
-                                /** @description Full message text (content pass-through, never stored). */
+                                /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
                                 text?: string | null;
                                 /** @description Attachment descriptors (no bytes, use the attachment endpoint to download). */
                                 attachments?: {
@@ -10621,7 +10670,7 @@ export interface operations {
                         last_message_timestamp?: string;
                         /** @description Identifier of the 1:1 counterpart. */
                         user_id?: string;
-                        /** @description The most recent message in the chat. */
+                        /** @description The most recent message in the chat. Subjects are not previewed here, read the chat's messages for one. */
                         last_message?: {
                             /**
                              * @description Response type discriminator.
@@ -10637,7 +10686,7 @@ export interface operations {
                             chat_id?: string;
                             /** @description Identifier of the sender. */
                             sender_id?: string;
-                            /** @description Full message text (content pass-through, never stored). */
+                            /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
                             text?: string | null;
                             /** @description Attachment descriptors (no bytes, use the attachment endpoint to download). */
                             attachments?: {
@@ -11007,7 +11056,7 @@ export interface operations {
                             chat_id?: string;
                             /** @description Identifier of the sender. */
                             sender_id?: string;
-                            /** @description Full message text (content pass-through, never stored). */
+                            /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
                             text?: string | null;
                             /** @description Attachment descriptors (no bytes, use the attachment endpoint to download). */
                             attachments?: {
@@ -11042,6 +11091,11 @@ export interface operations {
                             reaction_count?: number;
                             /** @description The platform this message originates from. */
                             provider?: string;
+                            /** @description Platform-specific detail on the message. Carries `subject` for an InMail, which is set on the thread's opening message; absent or empty for an ordinary message. */
+                            specifics?: {
+                                /** @description The InMail subject line, when the platform carries one on this message. Ordinary messages have none. Reading a conversation back stores the subject in your tenant's inbox records alongside the body, with no expiry. */
+                                subject?: string | null;
+                            };
                             /** @description The sender's profile, when the platform returned one alongside the message. sender_id always carries the identifier; this object carries the rest of what is known about that person. */
                             sender?: {
                                 /** @description Identifier of the counterpart. */
@@ -11386,7 +11440,7 @@ export interface operations {
                         chat_id?: string;
                         /** @description Identifier of the sender. */
                         sender_id?: string;
-                        /** @description Full message text (content pass-through, never stored). */
+                        /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
                         text?: string | null;
                         /** @description Attachment descriptors (no bytes, use the attachment endpoint to download). */
                         attachments?: {
@@ -11421,6 +11475,11 @@ export interface operations {
                         reaction_count?: number;
                         /** @description The platform this message originates from. */
                         provider?: string;
+                        /** @description Platform-specific detail on the message. Carries `subject` for an InMail, which is set on the thread's opening message; absent or empty for an ordinary message. */
+                        specifics?: {
+                            /** @description The InMail subject line, when the platform carries one on this message. Ordinary messages have none. Reading a conversation back stores the subject in your tenant's inbox records alongside the body, with no expiry. */
+                            subject?: string | null;
+                        };
                         /** @description The sender's profile, when the platform returned one alongside the message. sender_id always carries the identifier; this object carries the rest of what is known about that person. */
                         sender?: {
                             /** @description Identifier of the counterpart. */
@@ -12078,7 +12137,7 @@ export interface operations {
                                 id?: string;
                                 /** @description Account id that owns this message. */
                                 account_id?: string;
-                                /** @description Full message text (content pass-through, never stored). */
+                                /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
                                 text?: string | null;
                                 /** @description Identifier of the sender. */
                                 sender_id?: string;
@@ -12217,7 +12276,7 @@ export interface operations {
                     recipient_urn: string;
                     /** @description InMail subject line (1-200 chars). */
                     subject: string;
-                    /** @description InMail body text (1-8000 chars). */
+                    /** @description InMail body text (1-8000 chars). This call keeps nothing and logs nothing. Once sent it is a message in the account's InMail inbox, so reading that chat back through Curviate stores its body in your tenant's inbox records, with no expiry. */
                     text: string;
                 };
             };
@@ -12560,7 +12619,7 @@ export interface operations {
                             last_message_timestamp?: string;
                             /** @description Identifier of the 1:1 counterpart. */
                             user_id?: string;
-                            /** @description The most recent message in the chat. */
+                            /** @description The most recent message in the chat. Subjects are not previewed here, read the chat's messages for one. */
                             last_message?: {
                                 /**
                                  * @description Response type discriminator.
@@ -12576,7 +12635,7 @@ export interface operations {
                                 chat_id?: string;
                                 /** @description Identifier of the sender. */
                                 sender_id?: string;
-                                /** @description Full message text (content pass-through, never stored). */
+                                /** @description Full message text. Curviate does not keep it on the way out; reading a conversation back stores its message bodies in your tenant's inbox records, with no expiry. */
                                 text?: string | null;
                                 /** @description Attachment descriptors (no bytes, use the attachment endpoint to download). */
                                 attachments?: {
@@ -17834,7 +17893,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description The résumé is still being generated and was not ready in time. Retry the request shortly. */
+            /** @description LINKEDIN_SERVICE_UNAVAILABLE, the résumé is still being generated and was not ready in time. Retry the request shortly. */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -20040,11 +20099,11 @@ export interface operations {
                 "application/json": {
                     /** @description One or more Recruiter member IDs (AE... format) to include in the chat. */
                     attendees_ids: string[];
-                    /** @description Opening message text (1-8000 chars). Passed to the platform and discarded; never stored or logged. */
+                    /** @description Opening message text (1-8000 chars). This call keeps nothing and logs nothing. Once sent it is a message in the account's InMail inbox, so reading that chat back through Curviate stores its body in your tenant's inbox records, with no expiry. */
                     text: string;
                     /** @description Subject line; REQUIRED for Recruiter (InMail-based messaging), unlike the classic surface (<= 200 chars). */
                     subject: string;
-                    /** @description Sender signature; REQUIRED for Recruiter. Not stored or logged. */
+                    /** @description Sender signature; REQUIRED for Recruiter. Kept as a field by neither this call nor the log. The platform renders it into the sent message body, which is stored if that chat is later read back through Curviate. */
                     signature: string;
                     /**
                      * @description Visibility of the recruiter chat.
@@ -20063,11 +20122,11 @@ export interface operations {
                     send_as?: "INMAIL" | "EMAIL";
                     /** @description Sourcing channel for tracking purposes (e.g. CAREER_SITE, MANUAL_IMPORT, INTERNAL_CANDIDATES, RECRUITER_SEARCH, REFERRAL; the vendor's own vocabulary is broader than this illustrative set, so any non-empty value is accepted rather than a closed enum). */
                     channel_type?: string;
-                    /** @description Recruiter PRO only: schedule a follow-up message. subject/text are not stored or logged. */
+                    /** @description Recruiter PRO only: schedule a follow-up message. subject: This call keeps nothing and logs nothing, and unlike the message body the platform does not render it into what is sent. Once sent it is an InMail in the account's inbox: if a message read surfaces this subject, reading that chat back stores it in your tenant's inbox records like a body, with no expiry. text: This call keeps nothing and logs nothing. Once sent it is a message in the account's InMail inbox, so reading that chat back through Curviate stores its body in your tenant's inbox records, with no expiry. */
                     follow_up?: {
-                        /** @description Follow-up message subject. Not stored or logged. */
+                        /** @description Follow-up message subject. This call keeps nothing and logs nothing, and unlike the message body the platform does not render it into what is sent. Once sent it is an InMail in the account's inbox: if a message read surfaces this subject, reading that chat back stores it in your tenant's inbox records like a body, with no expiry. */
                         subject: string;
-                        /** @description Follow-up message body. Not stored or logged. */
+                        /** @description Follow-up message body. This call keeps nothing and logs nothing. Once sent it is a message in the account's InMail inbox, so reading that chat back through Curviate stores its body in your tenant's inbox records, with no expiry. */
                         text: string;
                         /** @description Optional follow-up attachments. */
                         attachments?: {
@@ -24710,7 +24769,7 @@ export interface operations {
                 "application/json": {
                     /** @description Sales Navigator member IDs for the chat recipients (>= 1, e.g. ACw...). */
                     attendees_ids: string[];
-                    /** @description Opening message text (1-8000 chars). Not stored or logged. */
+                    /** @description Opening message text (1-8000 chars). This call keeps nothing and logs nothing. Once sent it is a message in the account's InMail inbox, so reading that chat back through Curviate stores its body in your tenant's inbox records, with no expiry. */
                     text: string;
                     /** @description Subject line; REQUIRED for Sales Navigator (InMail-based messaging), unlike the classic surface where it is optional (<= 200 chars). Maps into the SN-only specifics branch. */
                     subject: string;
@@ -24814,7 +24873,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description RECIPIENT_UNREACHABLE or ACCOUNT_RESTRICTED, the recipient cannot be messaged or the account is restricted. */
+            /** @description ACCOUNT_RESTRICTED, the connected LinkedIn account cannot perform this operation. */
             422: {
                 headers: {
                     [name: string]: unknown;
@@ -28237,6 +28296,91 @@ export interface operations {
             };
         };
     };
+    getV1AccountsSeats: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Every live seat in the workspace with its occupancy. Empty list when the workspace has no seats. */
+            200: {
+                headers: {
+                    "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
+                    RateLimit: components["headers"]["RateLimit"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description Response type discriminator.
+                         * @enum {string}
+                         */
+                        object: "seat_list";
+                        items: {
+                            /** @description The seat ID (`seat_...`). Pass an unoccupied one as `seat_id` when connecting a new account. */
+                            seat_id: string;
+                            /** @description True when an account is connected on this seat. */
+                            occupied: boolean;
+                            /** @description The account on this seat, or null when unoccupied. */
+                            account_id: string | null;
+                        }[];
+                        safety_warning?: components["schemas"]["SafetyWarning"];
+                    };
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Rate limited, slow down and retry after the hinted delay. */
+            429: {
+                headers: {
+                    "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
+                    RateLimit: components["headers"]["RateLimit"];
+                    "Retry-After": components["headers"]["Retry-After"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Internal error. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Service unavailable. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Gateway timeout. */
+            504: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     postV1AuthIntent: {
         parameters: {
             query?: never;
@@ -28247,7 +28391,7 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description The empty seat this NEW account will occupy. Required on a new connect; omit it and the call returns 400 INVALID_REQUEST with 'seat_id is required'. Seat ids look like seat_01H..., and every seat you own is listed with click-to-copy in the seat table on your dashboard; any seat showing no attached account is free to use. Ignored when account_id is present, because a reconnect keeps the account on its current seat. */
+                    /** @description The empty seat this NEW account will occupy. Required on a new connect; omit it and the call returns 400 INVALID_REQUEST with 'seat_id is required'. Seat ids look like seat_01H..., and every seat you own is listed by GET /v1/accounts/seats (any item with occupied false is free to use) and with click-to-copy in the seat table on your dashboard. Ignored when account_id is present, because a reconnect keeps the account on its current seat. */
                     seat_id?: string;
                     /**
                      * @description How to authenticate. 'credentials' reads the nested `credentials` object (email + password). 'cookie' reads the nested `cookie` object (li_at) and also requires a top-level `user_agent`. Neither set of fields is accepted at the top level.
@@ -28417,7 +28561,7 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description Payment required, an active subscription / seat is needed. */
+            /** @description Either PAYMENT_REQUIRED (an active subscription / seat is needed; update your payment method or purchase a seat) or ACCOUNT_DISPUTED (the tenant's account is under dispute review; contact support). The code field distinguishes the two. */
             402: {
                 headers: {
                     [name: string]: unknown;
@@ -30528,14 +30672,14 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here is an operator override of that result and holds until the next connect. To undo the override, send `limit_profile_source: "default"`: the pin is released, and Curviate re-reads the value from LinkedIn on the account's next read or connect. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here is an operator override of that result and holds until the next connect. To undo the override, send `limit_profile_source: "default"`: the pin is released, and Curviate re-reads the value from LinkedIn on the account's next read or connect. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                     /** @description The IANA zone this account's ACTIVITY window is read in, e.g. `Europe/Berlin`. Must be a real zone; anything else is a 400. Null clears it, which DISABLES the activity window for every row that has not set its own: a guessed zone inverts the window, which is worse than not having one. */
                     timezone?: string | null;
                     /**
-                     * @description The tenant-wide posture default, which every account inherits unless it overrides it. Set it once for a whole workspace of personas. Null clears it back to `warn`.
+                     * @description The tenant-wide posture default, which every account inherits unless it overrides it. Set it once for a whole tenant of personas. Null clears it back to `warn`.
                      * @enum {string|null}
                      */
                     tenant_default_posture?: "warn" | "enforce" | null;
@@ -30604,7 +30748,7 @@ export interface operations {
                         source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded" | null;
                         /** @description READ-ONLY. `ceiling` with the account's warm-up ramp applied, which is what this row is actually held to. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         effective_ceiling?: unknown;
-                        /** @description READ-ONLY. What a call through the matching elevated interface (`/v1/{account_id}/sales-navigator/...`, `/v1/{account_id}/recruiter/...`) is held to on this row, or null when this row and limit profile have no such figure. `ceiling`, `effective_ceiling`, `band` and `over_default` are all the STANDARD-interface figure, so on a `sales_navigator` or `recruiter` account a row can report `over` while a call through the elevated interface still succeeds. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                        /** @description READ-ONLY. What a call through the matching elevated interface (the Sales Navigator and Recruiter operations) is held to on this row, or null when this row and limit profile have no such figure. `ceiling`, `effective_ceiling`, `band` and `over_default` are all the STANDARD-interface figure, so on a `sales_navigator` or `recruiter` account a row can report `over` while a call through the elevated interface still succeeds. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         interface_ceiling?: unknown;
                         /** @description READ-ONLY. `interface_ceiling` with the account's warm-up ramp applied. Read THIS to know where an elevated-interface call stops, for the same reason `effective_ceiling` and not `ceiling` answers that for a standard one. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                         effective_interface_ceiling?: unknown;
@@ -30934,4 +31078,336 @@ export interface operations {
             };
         };
     };
+    getV1SafetyPolicy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The tenant safety defaults, every limit profile and every budget row. */
+            200: {
+                headers: {
+                    "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
+                    RateLimit: components["headers"]["RateLimit"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description Response type discriminator.
+                         * @enum {string}
+                         */
+                        object?: "tenant_safety_policy";
+                        /**
+                         * @description The workspace-wide posture default every account in the tenant inherits, or null when none is set. Always present, and separate from `posture` on purpose: when this account overrides the tenant default, a change to the tenant default does not move `posture`, and this field is how you can still see it took effect.
+                         * @enum {string|null}
+                         */
+                        tenant_default_posture?: "warn" | "enforce" | null;
+                        /** @description One entry per limit profile, always all of them. */
+                        profiles?: {
+                            /**
+                             * @description The limit profile these defaults apply to. An account resolves from its own profile's defaults.
+                             * @enum {string}
+                             */
+                            limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
+                            /** @description Every budget row, always: the tenant default where one is set, the Curviate default otherwise. */
+                            rows?: {
+                                /** @description The counted-action row this policy governs. */
+                                budget_row?: string;
+                                /** @description What `enforce` refuses at and `warn` reports at, in the row's own unit. Null means the row is uncalibrated: Curviate has no figure for it. */
+                                ceiling?: number | null;
+                                /** @description Routine band. */
+                                green?: number | null;
+                                /** @description Warn-louder band. */
+                                amber?: number | null;
+                                /**
+                                 * @description The calendar grain this row is counted in.
+                                 * @enum {string}
+                                 */
+                                window_kind?: "day" | "week" | "month";
+                                /** @description How many grain units one counting window spans. */
+                                window_span?: number;
+                                /** @description IANA zone name the counting window is aligned to. Null counts in UTC. */
+                                window_timezone?: string | null;
+                                /** @description Local HH:MM the activity window opens. */
+                                activity_window_start?: string;
+                                /** @description Local HH:MM the activity window closes. */
+                                activity_window_end?: string;
+                                /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
+                                activity_window_timezone?: string | null;
+                                /**
+                                 * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
+                                 * @enum {string}
+                                 */
+                                activity_window_applies_to?: "writes" | "all";
+                                /** @description The tenant default multiplier for this row, or null when none is set. Null means each account follows its own derived warm-up ramp; 1 pins every account on this profile out of it. */
+                                warm_up_factor?: number | null;
+                                /** @description Length cap on the row's free-text field, in characters. */
+                                character_cap?: number | null;
+                                /** @description Length cap on the row's subject line, in characters. */
+                                subject_character_cap?: number | null;
+                                /** @description Bound on a single query's result lines. Search rows only. */
+                                per_query_cap?: number | null;
+                                /**
+                                 * @description How well calibrated this row's number is. `unseeded` means Curviate has no green, amber or ceiling figure for this row on this profile: the row is reported so nothing is silently missing, but nothing has calibrated it, so no value you set can be `over_default`.
+                                 * @enum {string}
+                                 */
+                                source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
+                                /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                                interface_ceiling?: number | null;
+                                /** @description Empty when nothing on this row is above default. Computed against the STANDARD-interface default, like `band` and for the same reason. */
+                                over_default?: {
+                                    /**
+                                     * @description The field whose configured value is above default.
+                                     * @enum {string}
+                                     */
+                                    field?: "ceiling" | "green" | "amber" | "character_cap" | "subject_character_cap" | "per_query_cap";
+                                    /** @description The configured value. */
+                                    value?: number;
+                                    /** @description The Curviate default it exceeds. */
+                                    default?: number;
+                                    /**
+                                     * @description How well calibrated the DEFAULT is. `substrate` and `linkedin_official` are published figures; `practitioner` is corroborated operator experience; `inferred` is our own reasoning; `unseeded` means we have no figure at all for that row, in which case there is nothing to be above and no entry appears. Read this before deciding whether being above default matters.
+                                     * @enum {string}
+                                     */
+                                    source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
+                                }[];
+                            }[];
+                        }[];
+                        safety_warning?: components["schemas"]["SafetyWarning"];
+                    };
+                };
+            };
+            /** @description Rate limited, slow down and retry after the hinted delay. */
+            429: {
+                headers: {
+                    "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
+                    RateLimit: components["headers"]["RateLimit"];
+                    "Retry-After": components["headers"]["Retry-After"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    patchV1SafetyPolicy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description The tenant-wide posture default every account inherits unless it overrides it. Null clears it back to `warn`.
+                     * @enum {string|null}
+                     */
+                    tenant_default_posture?: "warn" | "enforce" | null;
+                    /** @description Tenant defaults, per limit profile. */
+                    profiles?: {
+                        /**
+                         * @description The limit profile these defaults apply to. An account resolves from the defaults of its own `limit_profile` only.
+                         * @enum {string}
+                         */
+                        limit_profile: "basic" | "premium" | "sales_navigator" | "recruiter";
+                        /** @description Per-row defaults for this profile. Omit a field to leave it; `null` clears the tenant default back to the Curviate default. A row read back from this document may be sent unchanged. */
+                        rows: {
+                            /**
+                             * @description The budget row this patch configures.
+                             * @enum {string}
+                             */
+                            budget_row: "connection_requests_with_note" | "connection_requests_no_note" | "messages_first_degree" | "inmail" | "open_profile_inmail" | "profile_views" | "search" | "comments" | "post_likes" | "follows" | "content_poll" | "job_poll" | "posts" | "endorsements" | "invite_responses" | "withdrawal_sweep" | "total_actions" | "pending_invites";
+                            /** @description What `enforce` refuses at and `warn` reports at, in this row's own unit. Any value up to 9007199254740991 is accepted and stored verbatim; a value above the Curviate default is reported back, never clamped. */
+                            ceiling?: number | null;
+                            /** @description Routine band. Activity at or below it is unremarkable. */
+                            green?: number | null;
+                            /** @description Warn-louder band, between green and the ceiling. */
+                            amber?: number | null;
+                            /**
+                             * @description The calendar grain this row is counted in.
+                             * @enum {string|null}
+                             */
+                            window_kind?: "day" | "week" | "month" | null;
+                            /** @description How many `window_kind` units one counting window spans. */
+                            window_span?: number | null;
+                            /** @description IANA zone name the counting window is aligned to, e.g. `Europe/Berlin` or `UTC`. Must be a real zone; anything else is a 400. Null counts in UTC. */
+                            window_timezone?: string | null;
+                            /** @description Local time the activity window opens, HH:MM. Outside the window, live write operations are reported or refused per posture. */
+                            activity_window_start?: string | null;
+                            /** @description Local time the activity window closes, HH:MM. */
+                            activity_window_end?: string | null;
+                            /** @description IANA zone name the activity window is read in, e.g. `Europe/Berlin`. Must be a real zone; anything else is a 400. Null DISABLES the activity window: a guessed zone inverts it, which is worse than not having one. */
+                            activity_window_timezone?: string | null;
+                            /**
+                             * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads. A read Curviate answers from its own store never reaches LinkedIn and so is never covered; the same read IS covered when the store cannot answer it, or when you ask for it live. Stored reads and inbound events are never subject to the window under either setting, at any hour. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
+                             * @enum {string|null}
+                             */
+                            activity_window_applies_to?: "writes" | "all" | null;
+                            /** @description Multiplier applied to this row's ceiling while ramping. 1 is not ramping. */
+                            warm_up_factor?: number | null;
+                            /** @description Length cap on this row's free-text field, in characters (an invitation note, an InMail body). */
+                            character_cap?: number | null;
+                            /** @description Length cap on this row's subject line, in characters. */
+                            subject_character_cap?: number | null;
+                            /** @description Bound on a single query's result lines. Search rows only. */
+                            per_query_cap?: number | null;
+                            /**
+                             * @description How well calibrated this row's configured number is. Overriding it labels your own figure; the over-default warning always reports the class of the Curviate default.
+                             * @enum {string|null}
+                             */
+                            source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded" | null;
+                            /** @description READ-ONLY. What a call through the matching elevated interface (the Sales Navigator and Recruiter operations) is held to on this row, or null when this row and limit profile have no such figure. `ceiling`, `effective_ceiling`, `band` and `over_default` are all the STANDARD-interface figure, so on a `sales_navigator` or `recruiter` account a row can report `over` while a call through the elevated interface still succeeds. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                            interface_ceiling?: unknown;
+                            /** @description READ-ONLY. The fields on this row configured above the Curviate default. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                            over_default?: unknown;
+                        }[];
+                    }[];
+                    /** @description READ-ONLY. The document's type discriminator. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                    object?: unknown;
+                    /** @description READ-ONLY. What the last write changed across the tenant's accounts. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
+                    impact?: unknown;
+                };
+            };
+        };
+        responses: {
+            /** @description The tenant safety defaults as they now read, plus the `impact` of this write. */
+            200: {
+                headers: {
+                    "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
+                    RateLimit: components["headers"]["RateLimit"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * @description Response type discriminator.
+                         * @enum {string}
+                         */
+                        object?: "tenant_safety_policy";
+                        /**
+                         * @description The workspace-wide posture default every account in the tenant inherits, or null when none is set. Always present, and separate from `posture` on purpose: when this account overrides the tenant default, a change to the tenant default does not move `posture`, and this field is how you can still see it took effect.
+                         * @enum {string|null}
+                         */
+                        tenant_default_posture?: "warn" | "enforce" | null;
+                        /** @description One entry per limit profile, always all of them. */
+                        profiles?: {
+                            /**
+                             * @description The limit profile these defaults apply to. An account resolves from its own profile's defaults.
+                             * @enum {string}
+                             */
+                            limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
+                            /** @description Every budget row, always: the tenant default where one is set, the Curviate default otherwise. */
+                            rows?: {
+                                /** @description The counted-action row this policy governs. */
+                                budget_row?: string;
+                                /** @description What `enforce` refuses at and `warn` reports at, in the row's own unit. Null means the row is uncalibrated: Curviate has no figure for it. */
+                                ceiling?: number | null;
+                                /** @description Routine band. */
+                                green?: number | null;
+                                /** @description Warn-louder band. */
+                                amber?: number | null;
+                                /**
+                                 * @description The calendar grain this row is counted in.
+                                 * @enum {string}
+                                 */
+                                window_kind?: "day" | "week" | "month";
+                                /** @description How many grain units one counting window spans. */
+                                window_span?: number;
+                                /** @description IANA zone name the counting window is aligned to. Null counts in UTC. */
+                                window_timezone?: string | null;
+                                /** @description Local HH:MM the activity window opens. */
+                                activity_window_start?: string;
+                                /** @description Local HH:MM the activity window closes. */
+                                activity_window_end?: string;
+                                /** @description IANA zone name the activity window is read in. Null disables the window entirely. */
+                                activity_window_timezone?: string | null;
+                                /**
+                                 * @description What the activity window governs. `writes` (the default) covers live writes to LinkedIn; `all` widens it to live reads as well, which is the setting for a persona that should not be seen browsing at 03:00. It is broader than it sounds: `all` covers every live read, including the ones about the account itself, so a nightly analytics or invitation-backlog poll is refused at 03:00 too. A read Curviate answers from its own store never reaches LinkedIn, so it is never subject to the window under either setting, at any hour; the same read IS covered when the store cannot answer it, or when you ask for it live. Inbound events are never subject to it either. One action set to `all` reaches the whole account's live reads that spend no budget of their own (notifications, profile analytics, SSI, profile visitors, the invitation and saved-list listings): those calls debit no action type, so they have none to read this setting from and take the account-wide answer instead. Reads that DO debit an action type read that action type's own setting.
+                                 * @enum {string}
+                                 */
+                                activity_window_applies_to?: "writes" | "all";
+                                /** @description The tenant default multiplier for this row, or null when none is set. Null means each account follows its own derived warm-up ramp; 1 pins every account on this profile out of it. */
+                                warm_up_factor?: number | null;
+                                /** @description Length cap on the row's free-text field, in characters. */
+                                character_cap?: number | null;
+                                /** @description Length cap on the row's subject line, in characters. */
+                                subject_character_cap?: number | null;
+                                /** @description Bound on a single query's result lines. Search rows only. */
+                                per_query_cap?: number | null;
+                                /**
+                                 * @description How well calibrated this row's number is. `unseeded` means Curviate has no green, amber or ceiling figure for this row on this profile: the row is reported so nothing is silently missing, but nothing has calibrated it, so no value you set can be `over_default`.
+                                 * @enum {string}
+                                 */
+                                source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
+                                /** @description What a call through the matching ELEVATED interface is held to on this row: the `/v1/{account_id}/sales-navigator/...` and `/v1/{account_id}/recruiter/...` operations. Null when this row and limit profile have no such figure, which is every row on `basic` and `premium` and most rows everywhere. Everything else on this row (`ceiling`, `effective_ceiling`, `band` and `over_default`) is the STANDARD-interface figure, because one counter serves both interfaces and the standard side is the conservative one to band against. The consequence is worth reading: on a `sales_navigator` or `recruiter` account a row can report `band: "over"` with `posture: "enforce"` while a call through the elevated interface still succeeds; the refusal the band predicts is the one a standard call gets. */
+                                interface_ceiling?: number | null;
+                                /** @description Empty when nothing on this row is above default. Computed against the STANDARD-interface default, like `band` and for the same reason. */
+                                over_default?: {
+                                    /**
+                                     * @description The field whose configured value is above default.
+                                     * @enum {string}
+                                     */
+                                    field?: "ceiling" | "green" | "amber" | "character_cap" | "subject_character_cap" | "per_query_cap";
+                                    /** @description The configured value. */
+                                    value?: number;
+                                    /** @description The Curviate default it exceeds. */
+                                    default?: number;
+                                    /**
+                                     * @description How well calibrated the DEFAULT is. `substrate` and `linkedin_official` are published figures; `practitioner` is corroborated operator experience; `inferred` is our own reasoning; `unseeded` means we have no figure at all for that row, in which case there is nothing to be above and no entry appears. Read this before deciding whether being above default matters.
+                                     * @enum {string}
+                                     */
+                                    source_class?: "substrate" | "linkedin_official" | "practitioner" | "inferred" | "unseeded";
+                                }[];
+                            }[];
+                        }[];
+                        /** @description What this write changed across the tenant's accounts, measured on them before and after it applied. */
+                        impact?: {
+                            /** @description Accounts on which at least one budget row's resolved ceiling changed. */
+                            accounts_affected?: number;
+                            /** @description Accounts on which at least one budget row moved into `band: "over"`. */
+                            accounts_moved_into_over?: number;
+                        };
+                        safety_warning?: components["schemas"]["SafetyWarning"];
+                    };
+                };
+            };
+            /** @description INVALID_REQUEST. An unknown limit profile, row name or field, or a value that is not a value (a negative ceiling). A value is never rejected for being unsafe. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Payload too large, the request body exceeds the size limit. */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Rate limited, slow down and retry after the hinted delay. */
+            429: {
+                headers: {
+                    "RateLimit-Policy": components["headers"]["RateLimit-Policy"];
+                    RateLimit: components["headers"]["RateLimit"];
+                    "Retry-After": components["headers"]["Retry-After"];
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
 }