@geolens/sdk 1.17.0 → 1.19.0

package/dist/client/sdk.gen.js

@@ -216,7 +216,7 @@ export const bulkRevokeAdminEmbedTokensBulkRevokePost = (options) => (options.cl
 /**
  * Get Embedding Stats
  *
- * Return semantic-search embedding coverage statistics (admin only).
+ * Return embedding coverage and the state of the backfill runs (admin only).
  */
 export const getEmbeddingStatsAdminEmbeddingStatsGet = (options) => (options?.client ?? client).get({
     security: [
@@ -531,10 +531,48 @@ export const rejectUserAdminUsersUserIdRejectPost = (options) => (options.client
     url: '/admin/users/{user_id}/reject/',
     ...options
 });
+/**
+ * Reset User Password
+ *
+ * Set a user's password (admin only).
+ *
+ * feat(#1715): the login page tells a locked-out user to ask an
+ * administrator, and there was nothing for the administrator to do. This is
+ * the recovery path, so it asks for no current password -- holding
+ * manage_users is the whole authorization, and the audit row is what makes
+ * the action answerable for. The submitted value reaches the hash column and
+ * nowhere else: not the audit details, not a log line, not the response.
+ *
+ * 422 when the target signs in through an identity provider (no local
+ * password to replace), 404 when no such user exists -- both via the shared
+ * _raise_on_error mapping the sibling lifecycle routes use.
+ *
+ * Resetting your own password is permitted and ends every session the
+ * account holds, including the one making this request, because the reset
+ * revokes the account's credentials. That is the same consequence
+ * POST /auth/change-password/ has for the caller who invokes it.
+ */
+export const resetUserPasswordAdminUsersUserIdResetPasswordPost = (options) => (options.client ?? client).post({
+    security: [
+        { scheme: 'bearer', type: 'http' },
+        { name: 'X-Api-Key', type: 'apiKey' },
+        {
+            in: 'query',
+            name: 'api_key',
+            type: 'apiKey'
+        }
+    ],
+    url: '/admin/users/{user_id}/reset-password/',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * Ai Availability Endpoint
  *
- * Report whether builder AI chat is usable (builder-audit #338 P1-11).
+ * Report whether builder AI chat is usable (#338).
  *
  * Permission-gated on ``use_ai_chat`` so non-admin editors (who cannot read
  * ``/admin/ai-status``) can learn availability. Returns ``available=false``
@@ -764,14 +802,14 @@ export const generateMetadataSummaryAiMetadataSummaryPost = (options) => (option
  *
  * Return the column-DDL audit history for a dataset.
  *
- * SEC-FU-08: Surfaces the column-DDL events written by SEC-S03 (Phase 1061)
- * to dataset owners so they can detect editor-initiated schema changes.
+ * Surfaces the column-DDL events to dataset owners so they can detect
+ * editor-initiated schema changes.
  *
  * Access control (AGENTS.md Pre-Commit Checklist Rule 1):
  * - Owner: 200 with their own dataset's DDL history
  * - Admin: 200 (admin access is always allowed)
  * - Anyone else — including authenticated readers of a PUBLIC dataset: 404
- * via check_dataset_write_access. fix(#458 E-37): the feed previously used
+ * via check_dataset_write_access. fix(#458): the feed previously used
  * check_dataset_access (read visibility), which let any logged-in user
  * enumerate editor usernames/user_ids on public datasets, contradicting
  * this owner-facing contract.
@@ -886,7 +924,7 @@ export const configAuthConfigGet = (options) => (options?.client ?? client).get(
  *
  * Mint a short-lived download-scoped JWT for a single dataset.
  *
- * IA-P0-01 / SEC-04: the existing COG download URL path requires a
+ * The COG download URL path requires a
  * ``typ='download'`` JWT on the ``?token=`` query parameter — session JWTs
  * are rejected. This endpoint issues that token after verifying the caller
  * has read access to the dataset.
@@ -931,7 +969,7 @@ export const loginAuthLoginPost = (options) => (options.client ?? client).post({
  *
  * Revoke all refresh tokens and bump token_version for the current user.
  *
- * SEC-S15 (Phase 1062-01): revoke_all_tokens bumps User.token_version so the
+ * revoke_all_tokens bumps User.token_version so the
  * access JWT used for this logout call (and any other outstanding access JWTs)
  * are rejected on the next authenticated request — closing the
  * "logout doesn't invalidate the access JWT" gap.
@@ -1029,7 +1067,7 @@ export const listPublicProvidersAuthOauthProvidersGet = (options) => (options?.c
  *
  * Handle IdP callback: exchange code, find/create user, issue JWT, redirect to frontend.
  *
- * Phase 268 H-27: the frontend redirect carries access tokens in the URL
+ * The frontend redirect carries access tokens in the URL
  * fragment. Without explicit-config resolution, an attacker controlling
  * ``X-Forwarded-Host`` could steer the post-callback redirect to
  * attacker.com and capture the tokens. Force explicit-config resolution
@@ -1041,7 +1079,7 @@ export const oauthCallbackAuthOauthProviderSlugCallbackGet = (options) => (optio
  *
  * Redirect user to the IdP authorization URL with PKCE parameters.
  *
- * Phase 268 H-27: the redirect_uri is handed to the IdP, where an
+ * The redirect_uri is handed to the IdP, where an
  * attacker-controlled origin (via ``X-Forwarded-Host``) would otherwise
  * enable auth-code theft. We force explicit-config resolution by
  * passing ``for_external_use=True``; falling back to the request-origin
@@ -1092,7 +1130,7 @@ export const registerAuthRegisterPost = (options) => (options.client ?? client).
  *
  * Re-issue and re-send a verification email.
  *
- * SIGNUP-05 / T-1231-05 (enumeration-safe): ALWAYS returns the same 200 body
+ * Enumeration-safe: ALWAYS returns the same 200 body
  * regardless of whether the email exists, is unknown, or is already verified.
  * Send errors are logged server-side only and never branch the HTTP response.
  */
@@ -1109,12 +1147,12 @@ export const resendVerificationAuthResendVerificationPost = (options) => (option
  *
  * Redeem a verification token to activate the account.
  *
- * SIGNUP-03: a valid single-use expiring token flips email_verified=True,
+ * A valid single-use expiring token flips email_verified=True,
  * is_active=True, and status="active" so the user can log in via the
  * existing auth gate in dependencies.py.
  *
  * Expired, unknown, and already-consumed tokens all return the same
- * "Invalid or expired" error (enumeration-safe, SIGNUP-05 / T-1231-06).
+ * "Invalid or expired" error (enumeration-safe).
  */
 export const verifyEmailAuthVerifyEmailPost = (options) => (options.client ?? client).post({
     url: '/auth/verify-email/',
@@ -1488,7 +1526,7 @@ export const dryRunConfigurationConfigOpsDryRunPost = (options) => (options.clie
  * Returns a downloadable JSON payload with Content-Disposition header. This is a
  * file-download endpoint — the previous ``response_model=ConfigExportResponse``
  * was silently ignored because the handler returns a raw JSONResponse with custom
- * headers (TYPE-N3). Using ``response_class=JSONResponse`` is the correct way to
+ * headers. Using ``response_class=JSONResponse`` is the correct way to
  * document a download endpoint in OpenAPI.
  */
 export const exportConfigurationConfigOpsExportGet = (options) => (options?.client ?? client).get({
@@ -2054,7 +2092,7 @@ export const validateDcat3RecordDatasetsDatasetIdDcatValidationGet = (options) =
  * S3 storage: returns a 302 redirect to a presigned GET URL (1-hour expiry).
  * Accepts standard auth or ?token= JWT query parameter for browser downloads.
  *
- * KNOWN-01 (Phase 1071): ``user`` may be None when a no-sub anonymous
+ * ``user`` may be None when a no-sub anonymous
  * download token (issued by POST /auth/download-token/{id} for a public
  * dataset) is presented on ``?token=``. The function branches on
  * user-None to enforce public visibility and emit the audit row with
@@ -2102,7 +2140,7 @@ export const exportDatasetEndpointDatasetsDatasetIdExportGet = (options) => (opt
  * Return up to 5,000 features as RFC 7946 GeoJSON with Z coordinates.
  *
  * fix(#394) codex P2: the viewer's bounded-GeoJSON path (small 3D layers,
- * eligible cluster layers) already sends ``X-Embed-Token``, and the B-023
+ * eligible cluster layers) already sends ``X-Embed-Token``, and the
  * shared-map union now exposes embed-scoped private layers to embeds — so
  * this endpoint accepts the token as fallback authorization via the SAME
  * ``validate_embed_token_access`` capability check as tile serving.
@@ -2137,7 +2175,7 @@ export const getFeaturesGeojsonZEndpointDatasetsDatasetIdFeaturesGeojsonGet = (o
  *
  * Get paginated GeoJSON features for a dataset.
  *
- * Pagination is OFFSET-based (fix(#458 E-40), documented limitation): rows can
+ * Pagination is OFFSET-based (fix(#458), documented limitation): rows can
  * skip or duplicate across pages under concurrent writes, though feature ids
  * stay stable (ORDER BY gid, the primary key). Clients that need stable
  * cursoring should use the OGC API Features endpoint, which supports keyset
@@ -2470,7 +2508,7 @@ export const listRelatedDatasetsDatasetsDatasetIdRelatedGet = (options) => (opti
  * Paginated via ``skip`` and ``limit`` to bound response size for datasets
  * with large numbers of auto-detected relationships. Returns the standard
  * list envelope (``relationships`` + ``total``) so callers can detect whether
- * more pages exist (GAP-033); ``total`` counts the visible relationships before
+ * more pages exist; ``total`` counts the visible relationships before
  * pagination.
  */
 export const listDatasetRelationshipsDatasetsDatasetIdRelationshipsGet = (options) => (options.client ?? client).get({
@@ -2813,6 +2851,11 @@ export const listVrtSourcesDatasetsDatasetIdVrtSourcesGet = (options) => (option
  * List Vrt Generations
  *
  * Return paginated generation history for a VRT dataset.
+ *
+ * Not every caller gets every field. Seeing the dataset decides whether there
+ * is a history at all; the provenance predicate decides whether its rows carry
+ * their failure text and the id of whoever triggered them. See
+ * ``_vrt_generation_item``.
  */
 export const listVrtGenerationsDatasetsDatasetIdVrtGenerationsGet = (options) => (options.client ?? client).get({
     security: [
@@ -3031,7 +3074,7 @@ export const registerTableIngestRegisterPost = (options) => (options.client ?? c
  * Each table is registered independently -- one failure does not block
  * others. Tables are processed in parallel via ``asyncio.gather`` with
  * a fresh session per task, which keeps transaction isolation while
- * removing the sequential per-table latency (PERF-3).
+ * removing the sequential per-table latency.
  */
 export const bulkRegisterTablesIngestRegisterBulkPost = (options) => (options.client ?? client).post({
     security: [
@@ -3141,16 +3184,23 @@ export const completePresignedUploadIngestUploadPresignedJobIdCompletePost = (op
 /**
  * Upload From Url
  *
- * Import a geospatial file from an HTTP(S) URL for staging.
+ * Start importing a geospatial file from an HTTP(S) URL.
  *
  * feat(#1705): the URL variant of ``POST /ingest/upload`` — NOT a new
  * source type. The server fetches the file itself and the staged bytes
- * enter the normal pipeline unchanged (preview → commit). Rule 2 posture:
- * ``validate_url_for_ssrf`` gates the URL at submission, the download runs
- * through ``make_safe_client()`` (connect-time IP pinning plus per-hop
- * redirect revalidation), the size cap is enforced while streaming, the
- * staged file passes the same extension allowlist and content sniff as a
- * direct upload, and GDAL only ever sees the staged local file.
+ * enter the normal pipeline unchanged (preview then commit).
+ *
+ * feat(#1710): the download is a background job. This call validates the
+ * URL and returns a job id immediately; poll ``GET /jobs/{job_id}`` and
+ * preview once the job reaches ``pending``. While the file is downloading
+ * the job reports status ``running`` with step ``downloading``.
+ *
+ * Rule 2 posture: ``validate_url_for_ssrf`` gates the URL here, the worker
+ * downloads through ``make_safe_client()`` (connect-time IP pinning plus
+ * per-hop redirect revalidation), the size cap is enforced while
+ * streaming, the staged file passes the same extension allowlist and
+ * content sniff as a direct upload, and GDAL only ever sees the staged
+ * local file.
  */
 export const uploadFromUrlIngestUploadUrlPost = (options) => (options.client ?? client).post({
     security: [
@@ -3202,7 +3252,7 @@ export const createVrtIngestVrtCreatePost = (options) => (options.client ?? clie
  *
  * Validates the new source against existing sources synchronously.
  * Returns 202 Accepted with a job_id for polling.
- * Returns 409 if the VRT is currently regenerating (SRC-05) or source already linked.
+ * Returns 409 if the VRT is currently regenerating or the source is already linked.
  * Returns 422 if the source is incompatible with existing sources.
  */
 export const addVrtSourceIngestVrtDatasetIdSourcesPost = (options) => (options.client ?? client).post({
@@ -3228,7 +3278,7 @@ export const addVrtSourceIngestVrtDatasetIdSourcesPost = (options) => (options.c
  * Remove a COG source from an existing VRT and trigger async regeneration.
  *
  * Returns 202 Accepted with a job_id for polling.
- * Returns 409 if the VRT is currently regenerating (SRC-05).
+ * Returns 409 if the VRT is currently regenerating.
  * Returns 422 if removing would leave fewer than 2 sources.
  * Returns 404 if the source is not linked to the VRT.
  */
@@ -3262,6 +3312,16 @@ export const removeVrtSourceIngestVrtDatasetIdSourcesSourceDatasetIdDelete = (op
  * 404 would needlessly pollute the browser console on the dataset detail
  * page. A genuine 404 is still raised when the dataset is not visible to the
  * user, to avoid leaking job existence (see visibility check below).
+ *
+ * Not every caller gets every field. Seeing the dataset decides whether there
+ * is an answer at all; who ran the job decides how much of the answer is
+ * filled in. The dataset's owner, an admin, and the job's own creator get the
+ * full payload. Any other reader of a visible dataset gets the job id, its
+ * status and its timestamps, with the run's own detail nulled: no
+ * ``error_message``, ``source_filename``, warnings, step, row counts or
+ * retry hint. That is the redaction ``GET /datasets/{dataset_id}/refresh-runs``
+ * already applies to the same failure text, and ``_redacted_job_status``
+ * documents the decision field by field.
  */
 export const getJobStatusByDatasetJobsByDatasetDatasetIdGet = (options) => (options.client ?? client).get({
     security: [
@@ -3469,7 +3529,7 @@ export const renameColumnEndpointLayersDatasetIdColumnsColumnNameNamePatch = (op
  *
  * Count saved maps whose layer config references a column.
  *
- * fix(#458 E-06): surfaced in the schema editor before a rename/drop so the
+ * fix(#458): surfaced in the schema editor before a rename/drop so the
  * editor knows how many saved maps depend on the column. Count only — map
  * titles may belong to other users and are not exposed here.
  */
@@ -3600,7 +3660,7 @@ export const uploadMapIconEndpointMapsIconsPost = (options) => (options.client ?
  *
  * Serve an uploaded or bundled icon asset by stable icon ID.
  *
- * SEC-01 / M-63: SVG responses carry Content-Security-Policy
+ * SVG responses carry Content-Security-Policy
  * ``default-src 'none'; sandbox`` so an uploaded SVG cannot fetch other
  * origins, run scripts, or read auth cookies even if validation is bypassed
  * in the future. Browsers (Chromium, Firefox) honor the sandbox directive on
@@ -3613,8 +3673,7 @@ export const getMapIconAssetEndpointMapsIconsIconIdAssetGet = (options) => (opti
  *
  * Import a MapLibre style JSON document into a new GeoLens map.
  *
- * API-01 (M-05): the request body is now a typed Pydantic model instead of
- * a bare ``dict``. ``MapStyleImportRequest`` mirrors the MapLibre style
+ * The request body is a typed Pydantic model rather than a bare ``dict``. ``MapStyleImportRequest`` mirrors the MapLibre style
  * spec top-level keys with ``extra="allow"``, so existing payloads keep
  * working byte-identically while the OpenAPI schema gains a named class
  * and the auto-generated SDKs stop emitting an opaque ``Mapping[str, Any]``
@@ -3642,14 +3701,14 @@ export const importMapStyleEndpointMapsImportPost = (options) => (options.client
  *
  * Get a shared map by token. Optionally authenticated for non-public layers.
  *
- * SEC-S08 (Phase 1062-05): emits ``Content-Security-Policy: frame-ancestors
+ * Emits ``Content-Security-Policy: frame-ancestors
  * 'self' [<allowed_origins>...]`` on the response, derived from the active
  * EmbedToken for this map. When no EmbedToken exists or allowed_origins is
  * empty, defaults to ``frame-ancestors 'self'``. The SecurityHeadersMiddleware
  * respects this route-level CSP and skips emitting X-Frame-Options: DENY.
  *
- * fix(#394) SH-01/B-023: accepts ``X-Embed-Token`` so embed viewers get the
- * layers the token's scope authorizes (SEC-022 capability posture).
+ * fix(#394): accepts ``X-Embed-Token`` so embed viewers get the layers the
+ * token's scope authorizes, as a capability rather than a role.
  */
 export const getSharedMapEndpointMapsSharedTokenGet = (options) => (options.client ?? client).get({
     security: [
@@ -3878,14 +3937,14 @@ export const getMapHistoryEndpointMapsMapIdHistoryGet = (options) => (options.cl
  *
  * Apply incremental layer additions, patches, removals, and ordering.
  *
- * v13.14 fixup: declared on both slash variants directly (mirrors the
- * Phase 280 fix on POST). FastAPI's default redirect_slashes builds a
- * relative Location header that resolves against the request's Host
- * header, which would leak the in-container ``api:8000`` hostname
- * through Vite's dev proxy on a 307 redirect. The canonical
- * (OpenAPI-published) form is the no-slash sub-collection convention
- * documented in the GeoLens API guide (https://docs.getgeolens.com/guides/api/);
- * the trailing-slash form is a hidden alias.
+ * Declared on both slash variants directly, mirroring the POST route
+ * below. FastAPI's default redirect_slashes builds a relative Location
+ * header that resolves against the request's Host header, which would
+ * leak the in-container ``api:8000`` hostname through Vite's dev proxy
+ * on a 307 redirect. The canonical (OpenAPI-published) form is the
+ * no-slash sub-collection convention documented in the GeoLens API guide
+ * (https://docs.getgeolens.com/guides/api/); the trailing-slash form is
+ * a hidden alias.
  */
 export const patchMapLayersEndpointMapsMapIdLayersPatch = (options) => (options.client ?? client).patch({
     security: [
@@ -3909,9 +3968,9 @@ export const patchMapLayersEndpointMapsMapIdLayersPatch = (options) => (options.
  *
  * Add a layer to a map.
  *
- * Phase 280: declared on both slash variants directly so neither emits a
- * 307. FastAPI's default redirect_slashes builds a relative Location
- * header that resolves against the request's Host header, leaking the
+ * Declared on both slash variants directly so neither emits a 307.
+ * FastAPI's default redirect_slashes builds a relative Location header
+ * that resolves against the request's Host header, leaking the
  * in-container ``api:8000`` hostname through Vite's dev proxy. The
  * canonical (OpenAPI-published) form is the no-slash sub-collection
  * convention documented in the GeoLens API guide
@@ -3940,9 +3999,8 @@ export const addLayerEndpointMapsMapIdLayersPost = (options) => (options.client
  *
  * Batch-delete multiple layers from a map in a single request.
  *
- * Milestone exception (v1010 Phase 1047): one additive endpoint permitted
- * per REQUIREMENTS.md Out-of-Scope to reduce N sequential DELETEs to one
- * batched call for bulk-delete UX (PB-03 / PERF-03).
+ * One additive endpoint that reduces N sequential DELETEs to a single
+ * batched call for bulk-delete UX.
  *
  * Returns 200 with deleted/failed arrays in all cases (partial failures
  * surface inline, not as HTTP errors).  Full rollback is the caller's
@@ -4015,7 +4073,7 @@ export const getOgImageMapsMapIdOgImageGet = (options) => (options.client ?? cli
  * ``maps/og-images/{map_id}.{ext}``, and persists the storage key to
  * ``catalog.maps.og_image_uri``.
  *
- * Intended for 1200x630 JPEG captures (SHARE-08). The payload cap
+ * Intended for 1200x630 JPEG captures. The payload cap
  * (750KB) is larger than the thumbnail cap (100KB) to accommodate the
  * larger canvas export — they are separate schemas (OgImageUploadRequest
  * vs ThumbnailUploadRequest) to avoid relaxing the locked thumbnail
@@ -4189,7 +4247,7 @@ export const uploadThumbnailMapsMapIdThumbnailPut = (options) => (options.client
  * Owner-or-admin like the other sharing mutations: the response names
  * non-public dataset titles, which read access alone must not reveal.
  * Read access is checked first so unreadable maps keep answering 404
- * (SEC-007 existence-hiding); readable non-owners get 403.
+ * (existence-hiding); readable non-owners get 403.
  */
 export const visibilityCheckEndpointMapsMapIdVisibilityCheckGet = (options) => (options.client ?? client).get({
     security: [
@@ -4619,6 +4677,38 @@ export const getSavedSearchEndpointSearchSavedSearchIdGet = (options) => (option
     url: '/search/saved/{search_id}',
     ...options
 });
+/**
+ * Arcgis Signin
+ *
+ * Sign in to an ArcGIS portal and return a short-lived token.
+ *
+ * Asks the portal's own token service for a token valid for 60 minutes and
+ * returns it. Put that token in the `token` field on probe, preview, commit
+ * and refresh; an import that runs longer than the token lives fails with a
+ * credential error and has to start over.
+ *
+ * An account that signs in through an identity provider, or that has
+ * multifactor authentication turned on, cannot use this. Paste a token or
+ * an API key instead. A portal on a private network is unreachable either
+ * way.
+ */
+export const arcgisSigninServicesArcgisSigninPost = (options) => (options.client ?? client).post({
+    security: [
+        { scheme: 'bearer', type: 'http' },
+        { name: 'X-Api-Key', type: 'apiKey' },
+        {
+            in: 'query',
+            name: 'api_key',
+            type: 'apiKey'
+        }
+    ],
+    url: '/services/arcgis/signin/',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * List Connectors Endpoint
  *
@@ -4739,6 +4829,8 @@ export const probeServiceUrlServicesProbePost = (options) => (options.client ??
  * Stac Collections
  *
  * List collections from a connected STAC API.
+ *
+ * Accepts a credential for a protected catalog, applied to this call.
  */
 export const stacCollectionsServicesStacCollectionsPost = (options) => (options.client ?? client).post({
     security: [
@@ -4761,6 +4853,8 @@ export const stacCollectionsServicesStacCollectionsPost = (options) => (options.
  * Stac Connect
  *
  * Connect to a STAC API and validate the endpoint.
+ *
+ * Accepts a credential for a protected catalog, applied to this call.
  */
 export const stacConnectServicesStacConnectPost = (options) => (options.client ?? client).post({
     security: [
@@ -4809,6 +4903,8 @@ export const stacImportServicesStacImportPost = (options) => (options.client ??
  * Stac Search
  *
  * Search items in a STAC API with spatial/temporal filters.
+ *
+ * Accepts a credential for a protected catalog, applied to this call.
  */
 export const stacSearchServicesStacSearchPost = (options) => (options.client ?? client).post({
     security: [
@@ -4894,7 +4990,7 @@ export const getApiKeyStatusSettingsApiKeyStatusGet = (options) => (options?.cli
  * configured.  When a key IS set the placeholder is resolved server-side.
  * The response uses ``BasemapPublicResponse`` which excludes ``api_key``.
  *
- * SEC-S10 (2026-05-20 audit): the resolved ``url`` field intentionally
+ * The resolved ``url`` field intentionally
  * includes the substituted ``api_key`` value when configured. Client-side
  * tile-provider keys (Mapbox, Stadia, MapTiler) are designed for browser
  * exposure and the frontend MUST receive them to load tiles. Do NOT put a
@@ -4992,7 +5088,7 @@ export const getMapDefaultsSettingsMapDefaultsGet = (options) => (options?.clien
  *
  * Mirrors get_api_key_status: returns presence flags derived from env/settings
  * without ever echoing the SMTP password, webhook URL, or webhook secret
- * (NOTIF-05 / T-1229-09).
+ * without secrets.
  */
 export const getNotificationStatusSettingsNotificationsStatusGet = (options) => (options?.client ?? client).get({
     security: [
@@ -5014,7 +5110,7 @@ export const getNotificationStatusSettingsNotificationsStatusGet = (options) =>
  *
  * Mirrors detect_embedding_dims: admin-gated probe that reports per-channel
  * reachable/error in a 200 body without leaking secrets or raising 5xx on a
- * bad channel (NOTIF-06 / T-1229-08 / T-1229-09 / T-1229-10).
+ * bad channel.
  *
  * Per-channel approach (not EnvConfiguredNotificationSink.deliver) is used so
  * each channel's success/failure is captured in its own
@@ -5058,7 +5154,7 @@ export const listOauthProvidersSettingsOauthProvidersGet = (options) => (options
  *
  * Audit-log payload includes the full ``created`` snapshot with non-secret
  * fields verbatim and ``<redacted>`` markers for secrets that were submitted
- * in the request body (SAML-12 / Pitfall 9 / T-217-03-AUDIT-LEAK).
+ * in the request body.
  */
 export const createOauthProviderSettingsOauthProvidersPost = (options) => (options.client ?? client).post({
     security: [
@@ -5084,8 +5180,7 @@ export const createOauthProviderSettingsOauthProvidersPost = (options) => (optio
  *
  * Audit-log payload contains a ``deleted`` snapshot with the pre-delete
  * state — non-secret fields verbatim, secret fields marked ``<redacted>``
- * if they were previously set (T-217-03-AUDIT-LEAK mitigation extends to
- * delete events too).
+ * if they were previously set; the same redaction applies to delete events.
  */
 export const deleteOauthProviderSettingsOauthProvidersProviderIdDelete = (options) => (options.client ?? client).delete({
     security: [
@@ -5108,8 +5203,7 @@ export const deleteOauthProviderSettingsOauthProvidersProviderIdDelete = (option
  * Audit-log payload contains ``details.changes`` with per-field
  * ``{"old": ..., "new": ...}`` diffs. Secret fields (idp_certificate,
  * client_secret_encrypted, client_secret) are redacted as
- * ``{"old": "<redacted>", "new": "<redacted>"}`` (Pitfall 9 / SAML-12 /
- * T-217-03-AUDIT-LEAK HIGH severity).
+ * ``{"old": "<redacted>", "new": "<redacted>"}``.
  */
 export const updateOauthProviderSettingsOauthProvidersProviderIdPut = (options) => (options.client ?? client).put({
     security: [
@@ -5277,17 +5371,40 @@ export const searchPostStacSearchPost = (options) => (options.client ?? client).
 /**
  * Cluster Tile Endpoint
  *
- * Serve a server-side clustered vector tile for point datasets.
- *
- * URL pattern: /tiles/clusters/data.{table_name}/{z}/{x}/{y}.pbf
- *
- * This route deliberately reuses the normal vector tile auth model:
- * public datasets are readable directly, non-public datasets require either
- * valid HMAC tile params or a valid embed token scoped to the dataset.
- *
- * fix(#403): `cols` mirrors the vector endpoint's runtime column opt-in;
- * the columns are projected onto UNCLUSTERED features so data-driven
- * styling and popups keep working on the server-cluster path.
+ * Serve a server-side clustered vector tile for a point dataset.
+ *
+ * URL pattern: ``/tiles/clusters/data.{table_name}/{z}/{x}/{y}.pbf``
+ *
+ * Authorization matches the plain vector tile route, in three cases. A
+ * public, published dataset is readable without credentials. A non-public
+ * dataset needs either valid signature parameters (``sig``, ``exp``,
+ * ``scope``) or an embed token scoped to it, and answers 403 without one. A
+ * public dataset that is not yet published is readable by its owner, by an
+ * admin, with an embed token, or with valid signature parameters, and answers
+ * 404 to other callers, so a refusal keeps its existence undisclosed. An
+ * unknown table is 404 too.
+ *
+ * A request that no capability authorized and that carried a credential which
+ * did not resolve is refused with 401 rather than served as an anonymous
+ * read, so an expired token is rejected instead of being silently downgraded.
+ * A request sending no credential is served normally.
+ *
+ * ``cluster_radius`` is a screen-pixel distance, the same units MapLibre's
+ * ``clusterRadius`` uses, and ``cluster_max_zoom`` is the last zoom at which
+ * features are grouped. ``cols`` works as it does on the vector route, and
+ * the named columns are projected onto the unclustered features, so
+ * data-driven styling and popups keep working here too.
+ *
+ * Requires a vector point dataset; another record type responds 400, as does
+ * a malformed table path or an out-of-range tile coordinate.
+ *
+ * A tile holding no features answers 204, and a repeat request whose
+ * ``If-None-Match`` matches answers 304. Where a deployment runs cold storage,
+ * a dataset still being restored answers 202 with a job id to poll. Three
+ * cases answer 429 with ``Retry-After``: waiting past the tile pool's
+ * connection budget, a tile query that outruns the pool's per-command
+ * timeout, and exceeding a configured per-tenant concurrency limit. Any other
+ * failure serving the tile answers 503.
  */
 export const clusterTileEndpointTilesClustersTablePathZXYPbfGet = (options) => (options.client ?? client).get({
     security: [
@@ -5305,28 +5422,46 @@ export const clusterTileEndpointTilesClustersTablePathZXYPbfGet = (options) => (
 /**
  * Raster Tile Proxy
  *
- * API-side raster tile proxy: auth check + fetch from Titiler.
- *
- * Used by Vite dev proxy and as a fallback for deployments without nginx.
- * Production deployments with nginx should use the nginx raster-tiles path
- * for better caching and performance.
- *
- * colormap_name: Optional Titiler colormap for single-band display. Validated
- * against _ALLOWED_COLORMAPS (T-1140-01). Gray is the Titiler default for
- * single-band — passing gray is a no-op (not forwarded). colormap_name is not
- * forwarded for DEM layers (render_params starts with 'algorithm=').
- *
- * stretch: Optional stretch strategy. percentile/stddev compute a stats-based
- * rescale from Titiler band statistics. Multi-band rasters produce one rescale=
- * fragment per band (up to 3, RASTER-STRETCH-03).
- *
- * pmin/pmax: Configurable percentile clip bounds (default 2/98). Must satisfy
- * 0 <= pmin < pmax <= 100. Forwarded as repeated p= params to /cog/statistics.
- * The _band_stats_cache key includes pmin/pmax so different bounds never serve
- * stale cached stats (RASTER-STRETCH-UI-01 / Phase 1153 cache-key isolation).
- *
- * sigma: Standard-deviation multiplier for stretch=stddev (default 2.0).
- * Must be > 0.
+ * Render one raster tile and return the image.
+ *
+ * Returns the image itself rather than a redirect: the dataset is
+ * authorized, then the rendered tile comes back in the response body. Used by
+ * the development proxy and by deployments that run without nginx in front.
+ *
+ * ``colormap_name`` applies a colormap to a single-band raster. Passing
+ * ``gray`` leaves the rendering unchanged, and a digital elevation model
+ * ignores the parameter, because its terrain encoding cannot be recoloured.
+ *
+ * ``stretch`` chooses how pixel values map to the output range. ``minmax``
+ * keeps the range the dataset already implies: the recorded per-band minimum
+ * and maximum for a raster imported from a remote source that published
+ * statistics, a range derived from the data type for most others, and no
+ * rescale parameter for 8-bit data, which needs none. ``percentile`` and
+ * ``stddev`` instead derive a range from band statistics read at request
+ * time, for up to three bands. A digital elevation model ignores the
+ * parameter, and so does a request whose band statistics cannot be read,
+ * which falls back to ``minmax`` rather than failing.
+ *
+ * ``pmin`` and ``pmax`` (2 and 98 by default) are read when ``stretch`` is
+ * ``percentile``, and ``sigma`` (2.0 by default) when it is ``stddev``. A
+ * parameter that does not apply to the selected stretch is ignored, and its
+ * default is used in place of the value sent.
+ *
+ * Responds 204 when the tile falls outside the raster, 400 for an
+ * unsupported format, 401 when authentication is required, or when a request
+ * that no capability authorized carried a credential which did not resolve,
+ * 403 when the embed token is invalid or expired
+ * or a multi-tenant request arrives with no tenant context, 422 for an
+ * out-of-range stretch parameter, and 503 when the renderer cannot be
+ * reached. A different failure from the renderer is passed through with its
+ * own status.
+ *
+ * 404 covers more than a missing dataset. A dataset that is unknown, is not a
+ * raster or has no image answers 404. Where no capability authorized the
+ * request, so does a dataset the caller may not read: an authorization denial
+ * on a non-public raster, and an unpublished raster asked for by a caller who
+ * is neither its owner nor an admin. That is deliberate, so a refusal keeps a
+ * dataset's existence undisclosed.
  */
 export const rasterTileProxyTilesRasterProxyDatasetIdZXYFmtGet = (options) => (options.client ?? client).get({
     security: [
@@ -5370,20 +5505,26 @@ export const getTileTokenTilesTokenDatasetIdGet = (options) => (options.client ?
 /**
  * Get Tile Tokens Batch
  *
- * Batch-generate tile tokens for up to 50 datasets in one request.
+ * Generate tile tokens for up to 50 datasets in one request.
+ *
+ * The list must hold between 1 and 50 ids, and a request outside that is 422.
  *
- * Optimization for multi-layer maps: a 20-layer builder map previously
- * fired 20 parallel GET /token/{id}/ requests (20 HTTP + 20 RBAC + 20 HMAC
- * signatures). This endpoint does the same work in a single round trip
- * with one DB query for dataset metadata (PERF-N5).
+ * One round trip in place of one request per dataset, which is what a map
+ * with many layers would otherwise need.
  *
- * Per-dataset errors (404, 403) do not fail the batch — instead the
- * response maps the offending dataset_id to ``{"error": "..."}``. Clients
- * should check each entry for the ``error`` key.
+ * A dataset that cannot be found or cannot be authorized does not fail the
+ * batch: that id maps to ``{"error": "..."}`` in the response instead, so
+ * check each entry for an ``error`` key before using it. Duplicate ids are
+ * collapsed.
  *
- * fix(#394) SH-04: ``X-Embed-Token`` is accepted as per-dataset fallback
- * authorization (same capability check as tile serving), so embed terrain
- * builds its raster-dem source from the real bounds/maxzoom descriptor.
+ * The request as a whole still fails 401 in one case: a request that carried
+ * a credential which did not resolve and that no capability authorized
+ * answers 401 rather than a body of per-dataset errors. A request carrying no
+ * credential is served normally.
+ *
+ * ``X-Embed-Token`` is accepted as a fallback authorization for the datasets
+ * inside that token's scope, so an embedded map can build a terrain source
+ * from real bounds and zoom limits.
  */
 export const getTileTokensBatchTilesTokensPost = (options) => (options.client ?? client).post({
     security: [
@@ -5407,10 +5548,19 @@ export const getTileTokensBatchTilesTokensPost = (options) => (options.client ??
  *
  * Serve a vector tile as gzipped MVT binary.
  *
- * URL pattern: /tiles/data.{table_name}/{z}/{x}/{y}.pbf
+ * URL pattern: ``/tiles/data.{table_name}/{z}/{x}/{y}.pbf``
+ *
+ * A public, published dataset is readable without credentials. A non-public
+ * dataset needs either valid signature parameters (``sig``, ``exp``,
+ * ``scope``) or an embed token scoped to it, and answers 403 without one. A
+ * public dataset that is not yet published is readable by its owner, by an
+ * admin, with an embed token, or with valid signature parameters, and answers
+ * 404 to other callers, so a refusal keeps its existence undisclosed. An
+ * unknown table is 404 too.
  *
- * Non-public datasets require valid HMAC signature params (sig, exp, scope).
- * Public datasets can be accessed without any signature.
+ * A request that no capability authorized and that carried a credential which
+ * did not resolve is refused with 401 rather than served as an anonymous
+ * read. A request sending no credential is served normally.
  *
  * `cols` is a runtime opt-in for additional attribute columns the client
  * needs at all zooms (e.g. data-driven styling columns referenced by
@@ -5420,6 +5570,15 @@ export const getTileTokensBatchTilesTokensPost = (options) => (options.client ??
  * Does not need to be signed — `sig` already authorizes dataset
  * access and `cols` can only project columns the caller already has
  * REST access to.
+ *
+ * A malformed table path or an out-of-range tile coordinate answers 400. A
+ * tile holding no features answers 204, and a repeat request whose
+ * ``If-None-Match`` matches answers 304. Where a deployment runs cold storage,
+ * a dataset still being restored answers 202 with a job id to poll. Three
+ * cases answer 429 with ``Retry-After``: waiting past the tile pool's
+ * connection budget, a tile query that outruns the pool's per-command
+ * timeout, and exceeding a configured per-tenant concurrency limit. Any other
+ * failure serving the tile answers 503.
  */
 export const tileEndpointTilesTablePathZXYPbfGet = (options) => (options.client ?? client).get({
     security: [