@curviate/sdk 0.36.0 → 0.37.1

package/CHANGELOG.md

@@ -9,6 +9,108 @@ Versioning: semantic. Minor for additive changes, patch for bug fixes; no stabil
 
 ## [Unreleased]
 
+## [0.37.1] - 2026-09-23
+
+Fixture and types regenerated against the deployed production document
+(`https://api.curviate.com`, 127 paths, server
+`0b33680536a45681ed5ffe420006cb05c85fe683`). Description changes only; no type
+shape changed.
+
+### Changed
+
+- **Generated type descriptions follow the served document.** `is_sender` on
+  chat messages now documents that it is omitted when the connected account
+  cannot yet be identified (treat a missing value as unknown, not as received).
+  Recruiter search and project filters, and the job read's `sections`
+  parameter, are documented as trimmed before use rather than forwarded
+  verbatim.
+
+### Fixed
+
+- **The retry decision now honours `retry_hint.kind: "never"`.** A retryable
+  code (`INTERNAL`, `PLATFORM_ERROR`, `PLATFORM_RATE_LIMIT`,
+  `RATE_LIMIT_ACCOUNT`, `RATE_LIMIT_TENANT`) whose envelope carries
+  `retry_hint: { kind: "never" }`, an explicit server instruction that this
+  exact refusal will not change on a retry (for example, an upstream response
+  in a shape this API cannot read), is no longer retried on GETs. Previously
+  the retry gate consulted only the code table, so a structural-drift 502
+  (`PLATFORM_ERROR` with `retry_likely_to_succeed: false` and
+  `retry_hint.kind: "never"`) was retried up to three times against an answer
+  that could not change.
+
+  `retry_likely_to_succeed` is still not consulted by the retry decision. The
+  server currently defaults it to `false` on several generic
+  "unresolved error" paths that are not a per-cause verdict, and honouring it
+  as written would have silently stopped retrying most undecoded server
+  errors. Filed back rather than shipped; unaffected callers see no
+  behaviour change.
+
+- **An empty but present `Retry-After` header no longer reads as "retry in
+  0ms".** `Number("")` is `0`, which is finite and non-negative, so it passed
+  the same check a real delay does; it now falls back to the same
+  conservative 30s the unparseable HTTP-date form already gets. Found in
+  passing while touching this file for the fix above; unrelated to it.
+
+## [0.37.0] - 2026-09-22
+
+Fixture and types regenerated against the deployed production document
+(`https://api.curviate.com`, 127 paths, server
+`9d5eb6583e24928eca0c3c8b162ad664e869af99`).
+**BREAKING**: the webhook read summaries no longer carry `headers[].value_prefix`;
+a keyed `headers[].value_fingerprint` takes its place. Pre-1.0 a breaking change
+ships as a minor (as `0.27.0` did), so a caret range on `0.36.x` will not pick
+this up.
+
+### BREAKING
+
+- **`headers[].value_prefix` is removed from every webhook read; `headers[].value_fingerprint` replaces it.**
+  The old field was a masked preview of the configured value: the first 8
+  characters plus `...` for values of 24 characters or more, a fixed `********`
+  below that. It disclosed a leading slice of a credential and leaked the
+  value's length class. The replacement is an 8-character keyed fingerprint that
+  carries no part of the value and no indication of its length.
+
+  It is deterministic **within an account**, which is what makes it useful: two
+  headers with the same fingerprint hold the same value, and a changed
+  fingerprint means a rotation took effect. Fingerprints are not comparable
+  across accounts. It is `string | null`, `null` for a header configured before
+  fingerprints existed, so the member is nullable where `value_prefix` was not.
+
+  Affects `webhooks.create` (201), `webhooks.list` (200), `webhooks.get` (200)
+  and `webhooks.update` (200).
+
+  ```diff
+  - const configured = webhook.headers?.[0]?.value_prefix;   // masked preview, gone
+  + const configured = webhook.headers?.[0]?.value_fingerprint; // 8-char keyed fingerprint, nullable
+  ```
+
+  Any code that read `value_prefix` stops compiling, which is the intended
+  outcome: a masked preview and a fingerprint are not interchangeable, and a
+  silent rename would have left comparisons across accounts looking correct
+  while meaning nothing.
+
+### Changed
+
+- Every `cursor` query parameter in the document now declares `minLength: 1`:
+  all 61 of them, the last 4 landing in this release (`GET /profile/visitors`,
+  `GET /posts/{post_id}/comments`, `GET /posts/{post_id}/reactions`,
+  `GET /saved-posts`). An empty-string cursor is a `400` rather than a silently
+  ignored parameter. No TypeScript type changes: `minLength` is a validation
+  constraint, not a shape, so this reaches callers as server behaviour and as a
+  documented constraint in the generated reference.
+- Regenerated descriptions for `limit_profile`, `limit_profile_source` and
+  `limit_profile_detected_at` on the account and safety-policy surfaces. An
+  operator-set `limit_profile` is now a **pin**: it is no longer released by the
+  account's next connect, and neither a connect, a reconnect nor an account read
+  moves it or advances `limit_profile_detected_at`. Releasing it means sending
+  `limit_profile_source: "default"` **on its own**: changing `limit_profile`
+  and releasing the pin in the same request is refused with `INVALID_REQUEST`.
+  Description-only in this package; the behaviour is the deployed server's.
+
+### Fixed
+
+- `search.getParameters` JSDoc example follows the convention of every other example (no code fence, a fully qualified `curviate.account(...)` call), so generated reference pages render it as one runnable snippet. Documentation only.
+
 ## [0.36.0] - 2026-09-20
 
 Fixture and types regenerated against the deployed production document

package/dist/index.d.ts

@@ -2709,7 +2709,7 @@ interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
+         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here pins it, and the pin wins from then on: no connect, reconnect or account read moves it again until you release it with `limit_profile_source: "default"`, which is sent on its own: changing `limit_profile` and releasing it in the same request is refused. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2904,7 +2904,7 @@ interface components {
             }[];
             /** @description ISO-8601 UTC send timestamp. */
             timestamp?: string;
-            /** @description True if the connected account sent this message. */
+            /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
             is_sender?: boolean;
             is_seen?: boolean;
             is_delivered?: boolean;
@@ -10378,7 +10378,7 @@ interface operations {
                                 }[];
                                 /** @description ISO-8601 UTC send timestamp. */
                                 timestamp?: string;
-                                /** @description True if the connected account sent this message. */
+                                /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                                 is_sender?: boolean;
                                 is_seen?: boolean;
                                 is_delivered?: boolean;
@@ -10803,7 +10803,7 @@ interface operations {
                             }[];
                             /** @description ISO-8601 UTC send timestamp. */
                             timestamp?: string;
-                            /** @description True if the connected account sent this message. */
+                            /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                             is_sender?: boolean;
                             is_seen?: boolean;
                             is_delivered?: boolean;
@@ -11173,7 +11173,7 @@ interface operations {
                             }[];
                             /** @description ISO-8601 UTC send timestamp. */
                             timestamp?: string;
-                            /** @description True if the connected account sent this message. */
+                            /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                             is_sender?: boolean;
                             is_seen?: boolean;
                             is_delivered?: boolean;
@@ -11557,7 +11557,7 @@ interface operations {
                         }[];
                         /** @description ISO-8601 UTC send timestamp. */
                         timestamp?: string;
-                        /** @description True if the connected account sent this message. */
+                        /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                         is_sender?: boolean;
                         is_seen?: boolean;
                         is_delivered?: boolean;
@@ -12752,7 +12752,7 @@ interface operations {
                                 }[];
                                 /** @description ISO-8601 UTC send timestamp. */
                                 timestamp?: string;
-                                /** @description True if the connected account sent this message. */
+                                /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                                 is_sender?: boolean;
                                 is_seen?: boolean;
                                 is_delivered?: boolean;
@@ -16514,7 +16514,7 @@ interface operations {
     getV1AccountIdJobsJobId: {
         parameters: {
             query?: {
-                /** @description Which additional sections to include on the response (e.g. hiring_team, salary, benefits). The exact set of accepted values is not finalized, supply the section names you need, comma-separated for more than one, and they are forwarded verbatim. Omit for the base fields only. */
+                /** @description Which additional sections to include on the response (e.g. hiring_team, salary, benefits). The exact set of accepted values is not finalized, supply the section names you need, comma-separated for more than one; each name is trimmed before use. Omit for the base fields only. */
                 with_sections?: string[];
             };
             header?: never;
@@ -20436,7 +20436,7 @@ interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Free-text keyword search. Content, forwarded verbatim, never persisted. */
+                    /** @description Free-text keyword search. Trimmed before use; never persisted. */
                     keywords?: string;
                     /** @description Filter by candidate spotlight tags. */
                     spotlights?: string[];
@@ -20509,9 +20509,9 @@ interface operations {
                     project?: string;
                     /** @description Resolved JOB_FUNCTION parameter ids. */
                     job_function?: string[];
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by first name (trimmed before use; never persisted). */
                     first_name?: string;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by last name (trimmed before use; never persisted). */
                     last_name?: string;
                     /** @description Filter to members who recently joined LinkedIn. */
                     recently_joined?: boolean;
@@ -20534,7 +20534,7 @@ interface operations {
                     group?: string[];
                     /** @description Filter to members who previously applied. */
                     is_past_applicant?: boolean;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by an existing note's content (trimmed before use; never persisted). */
                     notes?: string;
                     /** @description Resolved TAG parameter ids. */
                     tags?: string[];
@@ -20922,7 +20922,7 @@ interface operations {
                 status?: ("ACTIVE" | "CLOSED" | "DRAFT" | "REVIEW")[];
                 /** @description Field to sort results by. Defaults to LAST_USED_BY_ME. */
                 sort_by?: "LAST_USED_BY_ME" | "MOST_USED_BY_ME" | "LAST_VIEWED_BY_ME" | "NEWEST_TO_OLDEST" | "OLDEST_TO_NEWEST" | "ALPHABETICAL" | "REVERSE_ALPHABETICAL";
-                /** @description Filter by project name (content, forwarded verbatim, never persisted). */
+                /** @description Filter by project name (trimmed before use; never persisted). */
                 keywords?: string;
                 /** @description Number of projects to return (1-100). Defaults to 10. */
                 limit?: number;
@@ -21785,7 +21785,7 @@ interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Free-text keyword search. Content, forwarded verbatim, never persisted. */
+                    /** @description Free-text keyword search. Trimmed before use; never persisted. */
                     keywords?: string;
                     /** @description Filter by candidate spotlight tags. */
                     spotlights?: string[];
@@ -21858,9 +21858,9 @@ interface operations {
                     project?: string;
                     /** @description Resolved JOB_FUNCTION parameter ids. */
                     job_function?: string[];
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by first name (trimmed before use; never persisted). */
                     first_name?: string;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by last name (trimmed before use; never persisted). */
                     last_name?: string;
                     /** @description Filter to members who recently joined LinkedIn. */
                     recently_joined?: boolean;
@@ -21883,7 +21883,7 @@ interface operations {
                     group?: string[];
                     /** @description Filter to members who previously applied. */
                     is_past_applicant?: boolean;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by an existing note's content (trimmed before use; never persisted). */
                     notes?: string;
                     /** @description Resolved TAG parameter ids. */
                     tags?: string[];
@@ -23203,7 +23203,7 @@ interface operations {
                         reject_unqualified_applicants?: boolean;
                         reject_out_of_country_applicants?: boolean;
                     };
-                    /** @description Content; the new project's name, forwarded verbatim, never persisted. */
+                    /** @description The new project's name (trimmed before use); never persisted. */
                     project_name: string;
                 };
             };
@@ -24221,7 +24221,7 @@ interface operations {
                 "application/json": {
                     /** @description The ID of the JOB_POSTING channel from the Talent Pool. SDK-confirmed REQUIRED. */
                     channel_id: string;
-                    /** @description Free-text keyword search. Content, forwarded verbatim, never persisted. */
+                    /** @description Free-text keyword search. Trimmed before use; never persisted. */
                     keywords?: string;
                     /**
                      * @description Sort order for the applicant list.
@@ -29825,11 +29825,11 @@ interface operations {
                             name?: string | null;
                             account_ids?: string[];
                             enabled?: boolean;
-                            /** @description Custom headers added to each delivery POST, with the value masked. */
+                            /** @description Custom headers added to each delivery POST, with a fingerprint in place of the value. */
                             headers?: {
                                 key?: string;
-                                /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                                value_prefix?: string;
+                                /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                                value_fingerprint?: string | null;
                             }[];
                             events?: string[];
                             data?: string[];
@@ -29914,7 +29914,7 @@ interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29943,7 +29943,7 @@ interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29972,7 +29972,7 @@ interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -30014,12 +30014,12 @@ interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is created but delivers nothing. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30292,12 +30292,12 @@ interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30446,7 +30446,7 @@ interface operations {
                     name?: string | null;
                     /** @description Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped. */
                     enabled?: boolean;
-                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured. */
+                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured. */
                     headers?: {
                         key: string;
                         value: string;
@@ -30488,12 +30488,12 @@ interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30600,13 +30600,13 @@ interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**
@@ -30770,7 +30770,7 @@ interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here is an operator override of that result and holds until the next connect. To undo the override, send `limit_profile_source: "default"`: the pin is released, and Curviate re-reads the value from LinkedIn on the account's next read or connect. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here pins it, and the pin wins over detection from then on. None of those paths moves a pinned value, so it holds until you release it. To release the pin, send `limit_profile_source: "default"` on its own: Curviate re-reads the value from LinkedIn on the account's next read or connect. Changing `limit_profile` and releasing it in the same request is refused with `INVALID_REQUEST`, because those are opposite intents. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30860,7 +30860,7 @@ interface operations {
                     /** @description READ-ONLY. The account this document describes; the path names it. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                     account_id?: unknown;
                     /**
-                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (set through this operation). Sending `default` releases an operator override: the value is re-read from LinkedIn on the account's next read or connect. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
+                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (pinned through this operation, and nothing but a release moves it). Sending `default` releases a pin: the value is re-read from LinkedIn on the account's next read or connect. Send it on its own; changing `limit_profile` in the same request is refused. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
                      * @enum {string}
                      */
                     limit_profile_source?: "default" | "detected" | "operator";
@@ -30898,13 +30898,13 @@ interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**
@@ -32146,10 +32146,9 @@ declare class SearchResource {
      * stays available as the numeric fallback. A malformed cursor is a `400`.
      *
      * @example
-     * ```ts
      * let cursor: string | null | undefined;
      * do {
-     *   const page = await acc.search.getParameters({
+     *   const page = await curviate.account("acc_123").search.getParameters({
      *     type: "SKILL",
      *     keywords: "software development",
      *     ...(cursor ? { cursor } : {}),
@@ -32157,7 +32156,6 @@ declare class SearchResource {
      *   for (const item of page.items) console.log(item.id, item.name);
      *   cursor = page.cursor;
      * } while (cursor);
-     * ```
      */
     getParameters(query: SearchParametersQuery): Promise<SearchParametersResult>;
     /**

package/dist/index.js

@@ -259,8 +259,11 @@ function defaultSleep(ms) {
 }
 function parseRetryAfterMs(header) {
   if (header == null) return void 0;
-  const seconds = Number(header);
-  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  const trimmed = header.trim();
+  if (trimmed !== "") {
+    const seconds = Number(trimmed);
+    if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  }
   return 3e4;
 }
 function backoffDelay(n, jitter) {
@@ -404,7 +407,8 @@ async function execute(method, path, opts) {
     }
     const err = await errorFromResponse(res);
     const namesBudgetRow = err.budgetRow !== void 0;
-    const retryable = !isWrite && !namesBudgetRow && RETRYABLE_CODES.has(err.code) && attempt < opts.maxRetries;
+    const neverRetry = err.retryHint?.kind === "never";
+    const retryable = !isWrite && !namesBudgetRow && !neverRetry && RETRYABLE_CODES.has(err.code) && attempt < opts.maxRetries;
     if (retryable) {
       await sleep(retryDelay(err, attempt + 1, jitterFn()));
       attempt += 1;
@@ -1138,10 +1142,9 @@ var SearchResource = class {
    * stays available as the numeric fallback. A malformed cursor is a `400`.
    *
    * @example
-   * ```ts
    * let cursor: string | null | undefined;
    * do {
-   *   const page = await acc.search.getParameters({
+   *   const page = await curviate.account("acc_123").search.getParameters({
    *     type: "SKILL",
    *     keywords: "software development",
    *     ...(cursor ? { cursor } : {}),
@@ -1149,7 +1152,6 @@ var SearchResource = class {
    *   for (const item of page.items) console.log(item.id, item.name);
    *   cursor = page.cursor;
    * } while (cursor);
-   * ```
    */
   getParameters(query) {
     return this.ctx.request({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/sdk",
-  "version": "0.36.0",
+  "version": "0.37.1",
   "private": false,
   "description": "TypeScript SDK for the Curviate API.",
   "license": "MIT",

package/src/generated/types.ts

@@ -2611,7 +2611,7 @@ export interface paths {
         head?: never;
         /**
          * Update an account's safety policy
-         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here is an operator override of that result, and it holds until the next connect. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
+         * @description The account-level safety-policy write (tenant-wide defaults are set on `PATCH /v1/safety-policy`). Send only the fields you are changing: everything you omit is left byte-identical, and sending `null` for a field clears your override and restores the tenant default where one is set, the Curviate default otherwise. Any limit may be set to any value: Curviate does not clamp, cap or refuse a change on the grounds that the number is unsafe. A value above the Curviate default is reported back in the response, and on every later read, with the default and its source class attached; there is no way to acknowledge it away, and setting the value back to the default removes it. A value that is not a value, such as a negative ceiling or an unknown row name, is a 400. Every field whose value CHANGES is appended to the account's action ledger with the previous value, the new value, the Curviate default, the actor and the time; a field you send whose value already equals its current effective value is not ledgered and is not stored as an override, so reading the policy and sending the document back changes nothing. Six fields on the read are derived rather than configured: `effective_ceiling`, `interface_ceiling`, `effective_interface_ceiling`, `posture_source`, `over_default` and each row's `warm_up_state`. Send them and they are accepted and ignored, never stored and never ledgered, so the document you read can go straight back. To pin a row's ramp, set `warm_up_factor`. `activity_window` is not accepted: send its settable subfields instead, the top-level `timezone` for the zone, and per row `activity_window_start`, `activity_window_end`, `activity_window_timezone` and `activity_window_applies_to`. The 400 this produces names those subfields, not just the refused object. And read `changes nothing` as `changes no limit`: the `posture` fields are OVERRIDES at every scope, so writing back a posture a scope merely inherits PINS it there and appends one ledger entry per pinned scope. That is what stops a later account- or tenant-wide change from moving it. A pin already in place is a no-op. An agent-authenticated write is accepted on exactly the same footing as an operator's. There is no bulk import, file upload or policy template: configuring many rows or many accounts is a loop over this operation. One field is not account-scoped: `tenant_default_posture` sets the default for EVERY account in the tenant, not just the one in the path, which is what makes it a one-call change for a whole workspace of personas. It is reported back at the top of every policy response, so a change to it is visible even on an account that overrides it. One other field is not row-scoped: `limit_profile` selects which of the four Curviate default sets this account's rows resolve from, so it moves the default under every row at once while leaving every value you have configured explicitly exactly as you set it. It is the platform product active on the account, not your Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it when the account connects and re-detects it on every reconnect; setting it here pins it, and the pin wins from then on: no connect, reconnect or account read moves it again until you release it with `limit_profile_source: "default"`, which is sent on its own: changing `limit_profile` and releasing it in the same request is refused. One field on this operation does not configure anything: `clear_halts` lifts the platform pause on the action types you name. When the platform refuses a call on an account, Curviate pauses that action type for the platform's own retry-after or a seeded cooldown, and every later call on it is refused locally without reaching the platform; the account resource reports the live pauses as `quotas[].halt`. Naming an action type here lifts its pause immediately, so the next call goes out. An action type with no active pause is accepted and does nothing, which makes it safe to send for a set you have not checked, and only the ones actually lifted are ledgered, each with the expiry it cut short, the actor and the time, readable afterwards on `GET /v1/{account_id}/safety-events` with `reason: "halt_cleared"`. Clearing disarms nothing: if the platform refuses the account again the pause returns, and a 429 or a refused write returns it for the full cooldown. Clear one when you have reason to believe the refusal was a transient upstream fault rather than the platform pushing back on this account.
          */
         patch: operations["patchV1AccountIdSafetyPolicy"];
         trace?: never;
@@ -2807,7 +2807,7 @@ export interface components {
             }[];
             /** @description ISO-8601 UTC send timestamp. */
             timestamp?: string;
-            /** @description True if the connected account sent this message. */
+            /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
             is_sender?: boolean;
             is_seen?: boolean;
             is_delivered?: boolean;
@@ -10282,7 +10282,7 @@ export interface operations {
                                 }[];
                                 /** @description ISO-8601 UTC send timestamp. */
                                 timestamp?: string;
-                                /** @description True if the connected account sent this message. */
+                                /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                                 is_sender?: boolean;
                                 is_seen?: boolean;
                                 is_delivered?: boolean;
@@ -10707,7 +10707,7 @@ export interface operations {
                             }[];
                             /** @description ISO-8601 UTC send timestamp. */
                             timestamp?: string;
-                            /** @description True if the connected account sent this message. */
+                            /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                             is_sender?: boolean;
                             is_seen?: boolean;
                             is_delivered?: boolean;
@@ -11077,7 +11077,7 @@ export interface operations {
                             }[];
                             /** @description ISO-8601 UTC send timestamp. */
                             timestamp?: string;
-                            /** @description True if the connected account sent this message. */
+                            /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                             is_sender?: boolean;
                             is_seen?: boolean;
                             is_delivered?: boolean;
@@ -11461,7 +11461,7 @@ export interface operations {
                         }[];
                         /** @description ISO-8601 UTC send timestamp. */
                         timestamp?: string;
-                        /** @description True if the connected account sent this message. */
+                        /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                         is_sender?: boolean;
                         is_seen?: boolean;
                         is_delivered?: boolean;
@@ -12656,7 +12656,7 @@ export interface operations {
                                 }[];
                                 /** @description ISO-8601 UTC send timestamp. */
                                 timestamp?: string;
-                                /** @description True if the connected account sent this message. */
+                                /** @description True if the connected account sent this message. Omitted when Curviate cannot yet identify the connected account; treat a missing value as unknown, not as received. */
                                 is_sender?: boolean;
                                 is_seen?: boolean;
                                 is_delivered?: boolean;
@@ -16418,7 +16418,7 @@ export interface operations {
     getV1AccountIdJobsJobId: {
         parameters: {
             query?: {
-                /** @description Which additional sections to include on the response (e.g. hiring_team, salary, benefits). The exact set of accepted values is not finalized, supply the section names you need, comma-separated for more than one, and they are forwarded verbatim. Omit for the base fields only. */
+                /** @description Which additional sections to include on the response (e.g. hiring_team, salary, benefits). The exact set of accepted values is not finalized, supply the section names you need, comma-separated for more than one; each name is trimmed before use. Omit for the base fields only. */
                 with_sections?: string[];
             };
             header?: never;
@@ -20340,7 +20340,7 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Free-text keyword search. Content, forwarded verbatim, never persisted. */
+                    /** @description Free-text keyword search. Trimmed before use; never persisted. */
                     keywords?: string;
                     /** @description Filter by candidate spotlight tags. */
                     spotlights?: string[];
@@ -20413,9 +20413,9 @@ export interface operations {
                     project?: string;
                     /** @description Resolved JOB_FUNCTION parameter ids. */
                     job_function?: string[];
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by first name (trimmed before use; never persisted). */
                     first_name?: string;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by last name (trimmed before use; never persisted). */
                     last_name?: string;
                     /** @description Filter to members who recently joined LinkedIn. */
                     recently_joined?: boolean;
@@ -20438,7 +20438,7 @@ export interface operations {
                     group?: string[];
                     /** @description Filter to members who previously applied. */
                     is_past_applicant?: boolean;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by an existing note's content (trimmed before use; never persisted). */
                     notes?: string;
                     /** @description Resolved TAG parameter ids. */
                     tags?: string[];
@@ -20826,7 +20826,7 @@ export interface operations {
                 status?: ("ACTIVE" | "CLOSED" | "DRAFT" | "REVIEW")[];
                 /** @description Field to sort results by. Defaults to LAST_USED_BY_ME. */
                 sort_by?: "LAST_USED_BY_ME" | "MOST_USED_BY_ME" | "LAST_VIEWED_BY_ME" | "NEWEST_TO_OLDEST" | "OLDEST_TO_NEWEST" | "ALPHABETICAL" | "REVERSE_ALPHABETICAL";
-                /** @description Filter by project name (content, forwarded verbatim, never persisted). */
+                /** @description Filter by project name (trimmed before use; never persisted). */
                 keywords?: string;
                 /** @description Number of projects to return (1-100). Defaults to 10. */
                 limit?: number;
@@ -21689,7 +21689,7 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Free-text keyword search. Content, forwarded verbatim, never persisted. */
+                    /** @description Free-text keyword search. Trimmed before use; never persisted. */
                     keywords?: string;
                     /** @description Filter by candidate spotlight tags. */
                     spotlights?: string[];
@@ -21762,9 +21762,9 @@ export interface operations {
                     project?: string;
                     /** @description Resolved JOB_FUNCTION parameter ids. */
                     job_function?: string[];
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by first name (trimmed before use; never persisted). */
                     first_name?: string;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by last name (trimmed before use; never persisted). */
                     last_name?: string;
                     /** @description Filter to members who recently joined LinkedIn. */
                     recently_joined?: boolean;
@@ -21787,7 +21787,7 @@ export interface operations {
                     group?: string[];
                     /** @description Filter to members who previously applied. */
                     is_past_applicant?: boolean;
-                    /** @description Content, forwarded verbatim, never persisted. */
+                    /** @description Filter by an existing note's content (trimmed before use; never persisted). */
                     notes?: string;
                     /** @description Resolved TAG parameter ids. */
                     tags?: string[];
@@ -23107,7 +23107,7 @@ export interface operations {
                         reject_unqualified_applicants?: boolean;
                         reject_out_of_country_applicants?: boolean;
                     };
-                    /** @description Content; the new project's name, forwarded verbatim, never persisted. */
+                    /** @description The new project's name (trimmed before use); never persisted. */
                     project_name: string;
                 };
             };
@@ -24125,7 +24125,7 @@ export interface operations {
                 "application/json": {
                     /** @description The ID of the JOB_POSTING channel from the Talent Pool. SDK-confirmed REQUIRED. */
                     channel_id: string;
-                    /** @description Free-text keyword search. Content, forwarded verbatim, never persisted. */
+                    /** @description Free-text keyword search. Trimmed before use; never persisted. */
                     keywords?: string;
                     /**
                      * @description Sort order for the applicant list.
@@ -29729,11 +29729,11 @@ export interface operations {
                             name?: string | null;
                             account_ids?: string[];
                             enabled?: boolean;
-                            /** @description Custom headers added to each delivery POST, with the value masked. */
+                            /** @description Custom headers added to each delivery POST, with a fingerprint in place of the value. */
                             headers?: {
                                 key?: string;
-                                /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                                value_prefix?: string;
+                                /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                                value_fingerprint?: string | null;
                             }[];
                             events?: string[];
                             data?: string[];
@@ -29818,7 +29818,7 @@ export interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29847,7 +29847,7 @@ export interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29876,7 +29876,7 @@ export interface operations {
                      */
                     enabled?: boolean;
                     /**
-                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured.
+                     * @description Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
                      * @default []
                      */
                     headers?: {
@@ -29918,12 +29918,12 @@ export interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is created but delivers nothing. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30196,12 +30196,12 @@ export interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30350,7 +30350,7 @@ export interface operations {
                     name?: string | null;
                     /** @description Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped. */
                     enabled?: boolean;
-                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a masked value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter, so a short value is never disclosed by its own preview. The header name is what identifies which credential is configured. */
+                    /** @description Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured. */
                     headers?: {
                         key: string;
                         value: string;
@@ -30392,12 +30392,12 @@ export interface operations {
                         account_ids?: string[];
                         /** @description A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped. */
                         enabled?: boolean;
-                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest, so a read shows the name and a masked value only. */
+                        /** @description Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value. */
                         headers?: {
                             /** @description The header name, as configured. */
                             key?: string;
-                            /** @description A masked view of the configured value: the first 8 characters followed by "..." when the value is at least 24 characters long, and a fixed "********" for anything shorter. The full value is never returned; the header name is what identifies which credential is configured. */
-                            value_prefix?: string;
+                            /** @description A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured. */
+                            value_fingerprint?: string | null;
                         }[];
                         /** @description Canonical event names this webhook subscribes to. */
                         events?: string[];
@@ -30504,13 +30504,13 @@ export interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**
@@ -30674,7 +30674,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /**
-                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here is an operator override of that result and holds until the next connect. To undo the override, send `limit_profile_source: "default"`: the pin is released, and Curviate re-reads the value from LinkedIn on the account's next read or connect. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
+                     * @description Which set of Curviate defaults this account's rows resolve from: `basic`, `premium`, `sales_navigator` or `recruiter`. Each inherits the one before it and raises a few rows. This is the platform product active on the account, NOT the Curviate seat entitlement, and the two can disagree: a lapsed subscription leaves the seat untouched. Curviate detects it from the platform when the account connects, re-detects it on every reconnect and, at most once a day, on an account read; setting it here pins it, and the pin wins over detection from then on. None of those paths moves a pinned value, so it holds until you release it. To release the pin, send `limit_profile_source: "default"` on its own: Curviate re-reads the value from LinkedIn on the account's next read or connect. Changing `limit_profile` and releasing it in the same request is refused with `INVALID_REQUEST`, because those are opposite intents. Sending the value the account already holds changes nothing and pins nothing. The change is recorded in the ledger and it moves the defaults under every row at once, so any row you have configured explicitly keeps your value. The elevated Sales Navigator and Recruiter figures apply only to calls made through the matching interface, the Sales Navigator and Recruiter operations, and Curviate holds each call to the figure for the interface it goes through. The numbers here are therefore the ones a standard-interface call is held to, on every profile; a call through one of those operations resolves from the elevated set instead, and each row publishes that figure as `interface_ceiling`.
                      * @enum {string}
                      */
                     limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
@@ -30764,7 +30764,7 @@ export interface operations {
                     /** @description READ-ONLY. The account this document describes; the path names it. Sent back on a write it is accepted and ignored, so the whole document round-trips; it is never stored and never ledgered. */
                     account_id?: unknown;
                     /**
-                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (set through this operation). Sending `default` releases an operator override: the value is re-read from LinkedIn on the account's next read or connect. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
+                     * @description Where `limit_profile` came from: `default` (never observed), `detected` (read from LinkedIn) or `operator` (pinned through this operation, and nothing but a release moves it). Sending `default` releases a pin: the value is re-read from LinkedIn on the account's next read or connect. Send it on its own; changing `limit_profile` in the same request is refused. Sending `detected` or `operator` is accepted and ignored, so the whole document round-trips.
                      * @enum {string}
                      */
                     limit_profile_source?: "default" | "detected" | "operator";
@@ -30802,13 +30802,13 @@ export interface operations {
                          */
                         limit_profile?: "basic" | "premium" | "sales_navigator" | "recruiter";
                         /**
-                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until the account next connects, or until you send `limit_profile_source: "default"` on this operation, which releases it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
+                         * @description Where `limit_profile` came from. `detected`: Curviate read it from LinkedIn, at `limit_profile_detected_at`. `operator`: it was set through this operation and holds until you release it by sending `limit_profile_source: "default"` on this operation, on its own (changing `limit_profile` and releasing it in the same request is refused). Nothing else overrides it: a connect, a reconnect and an account read all leave a pinned value exactly as you set it. `default`: it has never been observed, so the value is the seeded `basic` and says nothing about the account; Curviate detects it on the account's next read or connect.
                          * @enum {string}
                          */
                         limit_profile_source?: "default" | "detected" | "operator";
                         /**
                          * Format: date-time
-                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect.
+                         * @description When Curviate last read `limit_profile` from LinkedIn, whether or not the value changed. Null until it has. Curviate re-reads it on connect and, at most once a day, on an account read, so a subscription change reaches the numbers without a reconnect. While `limit_profile_source` is `operator` neither the value nor this timestamp moves, until you release the pin.
                          */
                         limit_profile_detected_at?: string | null;
                         /**