@curviate/sdk 0.35.0 → 0.37.0

package/CHANGELOG.md

@@ -9,6 +9,90 @@ Versioning: semantic. Minor for additive changes, patch for bug fixes; no stabil
 
 ## [Unreleased]
 
+## [0.37.0] - 2026-09-22
+
+Fixture and types regenerated against the deployed production document
+(`https://api.curviate.com`, 127 paths, server
+`9d5eb6583e24928eca0c3c8b162ad664e869af99`).
+**BREAKING**: the webhook read summaries no longer carry `headers[].value_prefix`;
+a keyed `headers[].value_fingerprint` takes its place. Pre-1.0 a breaking change
+ships as a minor (as `0.27.0` did), so a caret range on `0.36.x` will not pick
+this up.
+
+### BREAKING
+
+- **`headers[].value_prefix` is removed from every webhook read; `headers[].value_fingerprint` replaces it.**
+  The old field was a masked preview of the configured value: the first 8
+  characters plus `...` for values of 24 characters or more, a fixed `********`
+  below that. It disclosed a leading slice of a credential and leaked the
+  value's length class. The replacement is an 8-character keyed fingerprint that
+  carries no part of the value and no indication of its length.
+
+  It is deterministic **within an account**, which is what makes it useful: two
+  headers with the same fingerprint hold the same value, and a changed
+  fingerprint means a rotation took effect. Fingerprints are not comparable
+  across accounts. It is `string | null`, `null` for a header configured before
+  fingerprints existed, so the member is nullable where `value_prefix` was not.
+
+  Affects `webhooks.create` (201), `webhooks.list` (200), `webhooks.get` (200)
+  and `webhooks.update` (200).
+
+  ```diff
+  - const configured = webhook.headers?.[0]?.value_prefix;   // masked preview, gone
+  + const configured = webhook.headers?.[0]?.value_fingerprint; // 8-char keyed fingerprint, nullable
+  ```
+
+  Any code that read `value_prefix` stops compiling, which is the intended
+  outcome: a masked preview and a fingerprint are not interchangeable, and a
+  silent rename would have left comparisons across accounts looking correct
+  while meaning nothing.
+
+### Changed
+
+- Every `cursor` query parameter in the document now declares `minLength: 1`:
+  all 61 of them, the last 4 landing in this release (`GET /profile/visitors`,
+  `GET /posts/{post_id}/comments`, `GET /posts/{post_id}/reactions`,
+  `GET /saved-posts`). An empty-string cursor is a `400` rather than a silently
+  ignored parameter. No TypeScript type changes: `minLength` is a validation
+  constraint, not a shape, so this reaches callers as server behaviour and as a
+  documented constraint in the generated reference.
+- Regenerated descriptions for `limit_profile`, `limit_profile_source` and
+  `limit_profile_detected_at` on the account and safety-policy surfaces. An
+  operator-set `limit_profile` is now a **pin**: it is no longer released by the
+  account's next connect, and neither a connect, a reconnect nor an account read
+  moves it or advances `limit_profile_detected_at`. Releasing it means sending
+  `limit_profile_source: "default"` **on its own**: changing `limit_profile`
+  and releasing the pin in the same request is refused with `INVALID_REQUEST`.
+  Description-only in this package; the behaviour is the deployed server's.
+
+### Fixed
+
+- `search.getParameters` JSDoc example follows the convention of every other example (no code fence, a fully qualified `curviate.account(...)` call), so generated reference pages render it as one runnable snippet. Documentation only.
+
+## [0.36.0] - 2026-09-20
+
+Fixture and types regenerated against the deployed production document
+(`https://api.curviate.com`, 127 paths, server
+`41d48ed451280c29b0fb6b4b15c44ca70b76af98`). One additive shape change.
+
+### Added
+
+- **`search.getParameters()` accepts `cursor`.** The filter-ID resolver
+  paginates: `SearchParametersQuery` gains an optional `cursor`, and the
+  response's `cursor` field is the token to send back for the next page. Walk
+  until it comes back `null`. `offset` still works and is now described as the
+  numeric fallback for `cursor`. A malformed cursor is a `400`. Additive and
+  backward compatible: a call that passes no `cursor` behaves exactly as
+  before.
+
+### Changed
+
+- Regenerated descriptions on `GET /v1/{account_id}/search/parameters`: the
+  operation description now states how the pages are walked, `offset` names
+  itself the numeric fallback, and the `400` description names a malformed
+  cursor among its causes.
+- `search.getParameters()` carries a paging `@example` in its JSDoc.
+
 ## [0.35.0] - 2026-09-19
 
 Fixture and types regenerated a second time against the deployed production
@@ -25,7 +109,7 @@ nothing added, removed or retyped.
   Present when populated. Reading it back through Curviate stores it in your
   tenant's entity records, with no expiry."
 
-First refresh in this Unreleased batch, against production server
+First refresh in this release, against production server
 `00a1388d42b09db54424de12ecf1c7cbebe2ec12`: 23 description strings and 3
 example values changed, nothing added, removed or retyped.
 

package/dist/index.d.ts

@@ -661,7 +661,7 @@ interface paths {
         };
         /**
          * Resolve search filter IDs
-         * @description Resolves human-readable terms (e.g. 'software development') to opaque filter IDs for use in structured search filters. The type parameter selects the filter category; keywords is required for every type, including EMPLOYMENT_TYPE.
+         * @description Resolves human-readable terms (e.g. 'software development') to opaque filter IDs for use in structured search filters. The type parameter selects the filter category; keywords is required for every type, including EMPLOYMENT_TYPE. Results paginate: send the cursor from the previous response to get the next page, and stop when it comes back null.
          */
         get: operations["getV1AccountIdSearchParameters"];
         put?: never;
@@ -2709,7 +2709,7 @@ interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
+         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here pins it, and the pin wins from then on: no connect, reconnect or account read moves it again until you release it with `limit_profile_source: "default"`, which is sent on its own: changing `limit_profile` and releasing it in the same request is refused. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -8420,10 +8420,12 @@ interface operations {
                 type: "LOCATION" | "PEOPLE" | "RELATION" | "COMPANY" | "SCHOOL" | "INDUSTRY" | "SERVICE" | "JOB_FUNCTION" | "JOB_TITLE" | "EMPLOYMENT_TYPE" | "SKILL";
                 /** @description Human term to resolve to opaque filter IDs (e.g. 'software development'). Required for every type, including EMPLOYMENT_TYPE. */
                 keywords: string;
-                /** @description Zero-based pagination offset (default 0). */
+                /** @description Zero-based pagination offset; a numeric fallback for cursor (default 0). */
                 offset?: number;
                 /** @description Number of parameters to return (1-100, default 10). */
                 limit?: number;
+                /** @description Opaque pagination cursor returned from a previous response. */
+                cursor?: string;
             };
             header?: never;
             path: {
@@ -8461,7 +8463,7 @@ interface operations {
                     };
                 };
             };
-            /** @description Missing or empty account_id, missing or empty type, missing keywords, or type not in the classic allowlist. */
+            /** @description Missing or empty account_id, missing or empty type, missing keywords, type not in the classic allowlist, or malformed cursor. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -29823,11 +29825,11 @@ interface operations {
                             name?: string | null;
                             account_ids?: string[];
                             enabled?: boolean;
-                            /** @description Custom headers added to each delivery POST, with the value masked. */
+                            /** @description Custom headers added to each delivery POST, with a fingerprint in place of the value. */
                             headers?: {
                                 key?: string;
-                                /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                                value_prefix?: string;
+                                /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                                value_fingerprint?: string | null;
                             }[];
                             events?: string[];
                             data?: string[];
@@ -29912,7 +29914,7 @@ interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29941,7 +29943,7 @@ interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29970,7 +29972,7 @@ interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -30012,12 +30014,12 @@ interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is created but delivers nothing. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30290,12 +30292,12 @@ interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30444,7 +30446,7 @@ interface operations {
                     name?: string | null;
                     /** @description Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped. */
                     enabled?: boolean;
-                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured. */
+                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured. */
                     headers?: {
                         key: string;
                         value: string;
@@ -30486,12 +30488,12 @@ interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30598,13 +30600,13 @@ interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**
@@ -30768,7 +30770,7 @@ interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here is an operator override of that result and holds until the next connect. To undo the override, send `limit_profile_source: "default"`: the pin is released, and Curviate re-reads the value from LinkedIn on the account's next read or connect. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here pins it, and the pin wins over detection from then on. None of those paths moves a pinned value, so it holds until you release it. To release the pin, send `limit_profile_source: "default"` on its own: Curviate re-reads the value from LinkedIn on the account's next read or connect. Changing `limit_profile` and releasing it in the same request is refused with `INVALID_REQUEST`, because those are opposite intents. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30858,7 +30860,7 @@ interface operations {
                     /** @description READ-ONLY. The account this document describes; the path names it. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                     account_id?: unknown;
                     /**
-                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (set through this operation). Sending `default` releases an operator override: the value is re-read from LinkedIn on the account's next read or connect. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
+                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (pinned through this operation, and nothing but a release moves it). Sending `default` releases a pin: the value is re-read from LinkedIn on the account's next read or connect. Send it on its own; changing `limit_profile` in the same request is refused. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
                      * @enum {string}
                      */
                     limit_profile_source?: "default" | "detected" | "operator";
@@ -30896,13 +30898,13 @@ interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**
@@ -32138,6 +32140,22 @@ declare class SearchResource {
     /**
      * Resolve human-readable terms to opaque filter IDs for structured search.
      * `GET /v1/{account_id}/search/parameters`
+     *
+     * Paginated: the response carries a `cursor`, and sending it back as
+     * `cursor` returns the next page. Stop when it comes back `null`. `offset`
+     * stays available as the numeric fallback. A malformed cursor is a `400`.
+     *
+     * @example
+     * let cursor: string | null | undefined;
+     * do {
+     *   const page = await curviate.account("acc_123").search.getParameters({
+     *     type: "SKILL",
+     *     keywords: "software development",
+     *     ...(cursor ? { cursor } : {}),
+     *   });
+     *   for (const item of page.items) console.log(item.id, item.name);
+     *   cursor = page.cursor;
+     * } while (cursor);
      */
     getParameters(query: SearchParametersQuery): Promise<SearchParametersResult>;
     /**

package/dist/index.js

@@ -1132,6 +1132,22 @@ var SearchResource = class {
   /**
    * Resolve human-readable terms to opaque filter IDs for structured search.
    * `GET /v1/{account_id}/search/parameters`
+   *
+   * Paginated: the response carries a `cursor`, and sending it back as
+   * `cursor` returns the next page. Stop when it comes back `null`. `offset`
+   * stays available as the numeric fallback. A malformed cursor is a `400`.
+   *
+   * @example
+   * let cursor: string | null | undefined;
+   * do {
+   *   const page = await curviate.account("acc_123").search.getParameters({
+   *     type: "SKILL",
+   *     keywords: "software development",
+   *     ...(cursor ? { cursor } : {}),
+   *   });
+   *   for (const item of page.items) console.log(item.id, item.name);
+   *   cursor = page.cursor;
+   * } while (cursor);
    */
   getParameters(query) {
     return this.ctx.request({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/sdk",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "private": false,
   "description": "TypeScript SDK for the Curviate API.",
   "license": "MIT",

package/src/generated/types.ts

@@ -563,7 +563,7 @@ export interface paths {
         };
         /**
          * Resolve search filter IDs
-         * @description Resolves human-readable terms (e.g. 'software development') to opaque filter IDs for use in structured search filters. The type parameter selects the filter category; keywords is required for every type, including EMPLOYMENT_TYPE.
+         * @description Resolves human-readable terms (e.g. 'software development') to opaque filter IDs for use in structured search filters. The type parameter selects the filter category; keywords is required for every type, including EMPLOYMENT_TYPE. Results paginate: send the cursor from the previous response to get the next page, and stop when it comes back null.
          */
         get: operations["getV1AccountIdSearchParameters"];
         put?: never;
@@ -2611,7 +2611,7 @@ export interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
+         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here pins it, and the pin wins from then on: no connect, reconnect or account read moves it again until you release it with `limit_profile_source: "default"`, which is sent on its own: changing `limit_profile` and releasing it in the same request is refused. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -8324,10 +8324,12 @@ export interface operations {
                 type: "LOCATION" | "PEOPLE" | "RELATION" | "COMPANY" | "SCHOOL" | "INDUSTRY" | "SERVICE" | "JOB_FUNCTION" | "JOB_TITLE" | "EMPLOYMENT_TYPE" | "SKILL";
                 /** @description Human term to resolve to opaque filter IDs (e.g. 'software development'). Required for every type, including EMPLOYMENT_TYPE. */
                 keywords: string;
-                /** @description Zero-based pagination offset (default 0). */
+                /** @description Zero-based pagination offset; a numeric fallback for cursor (default 0). */
                 offset?: number;
                 /** @description Number of parameters to return (1-100, default 10). */
                 limit?: number;
+                /** @description Opaque pagination cursor returned from a previous response. */
+                cursor?: string;
             };
             header?: never;
             path: {
@@ -8365,7 +8367,7 @@ export interface operations {
                     };
                 };
             };
-            /** @description Missing or empty account_id, missing or empty type, missing keywords, or type not in the classic allowlist. */
+            /** @description Missing or empty account_id, missing or empty type, missing keywords, type not in the classic allowlist, or malformed cursor. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -29727,11 +29729,11 @@ export interface operations {
                             name?: string | null;
                             account_ids?: string[];
                             enabled?: boolean;
-                            /** @description Custom headers added to each delivery POST, with the value masked. */
+                            /** @description Custom headers added to each delivery POST, with a fingerprint in place of the value. */
                             headers?: {
                                 key?: string;
-                                /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                                value_prefix?: string;
+                                /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                                value_fingerprint?: string | null;
                             }[];
                             events?: string[];
                             data?: string[];
@@ -29816,7 +29818,7 @@ export interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29845,7 +29847,7 @@ export interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29874,7 +29876,7 @@ export interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29916,12 +29918,12 @@ export interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is created but delivers nothing. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30194,12 +30196,12 @@ export interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30348,7 +30350,7 @@ export interface operations {
                     name?: string | null;
                     /** @description Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped. */
                     enabled?: boolean;
-                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured. */
+                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured. */
                     headers?: {
                         key: string;
                         value: string;
@@ -30390,12 +30392,12 @@ export interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30502,13 +30504,13 @@ export interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**
@@ -30672,7 +30674,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here is an operator override of that result and holds until the next connect. To undo the override, send `limit_profile_source: "default"`: the pin is released, and Curviate re-reads the value from LinkedIn on the account's next read or connect. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here pins it, and the pin wins over detection from then on. None of those paths moves a pinned value, so it holds until you release it. To release the pin, send `limit_profile_source: "default"` on its own: Curviate re-reads the value from LinkedIn on the account's next read or connect. Changing `limit_profile` and releasing it in the same request is refused with `INVALID_REQUEST`, because those are opposite intents. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30762,7 +30764,7 @@ export interface operations {
                     /** @description READ-ONLY. The account this document describes; the path names it. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                     account_id?: unknown;
                     /**
-                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (set through this operation). Sending `default` releases an operator override: the value is re-read from LinkedIn on the account's next read or connect. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
+                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (pinned through this operation, and nothing but a release moves it). Sending `default` releases a pin: the value is re-read from LinkedIn on the account's next read or connect. Send it on its own; changing `limit_profile` in the same request is refused. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
                      * @enum {string}
                      */
                     limit_profile_source?: "default" | "detected" | "operator";
@@ -30800,13 +30802,13 @@ export interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**