npm - @hablala/api-contract - Versions diffs - 0.9.0 → 0.10.0 - Mend

@hablala/api-contract 0.9.0 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/openapi.json CHANGED Viewed

@@ -730,6 +730,48 @@
       "AccountManifestSections": {
         "description": "Las secciones declarables de una cuenta (ADR-027). El `kind` fija la SUPERFICIE: una `organization` declara el diccionario (objects…), la mensajería (spaces/channels) y el acceso (roles, sso, domains, invitations); un `individual` declara su `profile` y su `privacy` (singletons). Cada sección es opcional (ausente = no gestionada). Gobernanza: la mayoría es AUTORITATIVA (lo no declarado se archiva — policies/roles/sso se BORRAN); son ADITIVAS (siembra, no expulsa) los `initialMembers` de un canal, los `domains` y las `invitations` — lifecycle, no estado deseado. Los datos (records/mensajes) no son configuración.",
         "properties": {
+          "actions": {
+            "oneOf": [
+              {
+                "items": {
+                  "$ref": "#/components/schemas/ManifestAction"
+                },
+                "type": "array",
+                "x-struct": null,
+                "x-validate": null
+              },
+              {
+                "properties": {
+                  "items": {
+                    "items": {
+                      "$ref": "#/components/schemas/ManifestAction"
+                    },
+                    "type": "array",
+                    "x-struct": null,
+                    "x-validate": null
+                  },
+                  "mode": {
+                    "description": "`authoritative` (default): lo no declarado se archiva/borra. `additive`: solo crea/actualiza lo declarado, sin expulsar lo demás (least astonishment).",
+                    "enum": [
+                      "authoritative",
+                      "additive"
+                    ],
+                    "type": "string",
+                    "x-struct": null,
+                    "x-validate": null
+                  }
+                },
+                "required": [
+                  "items"
+                ],
+                "type": "object",
+                "x-struct": null,
+                "x-validate": null
+              }
+            ],
+            "x-struct": null,
+            "x-validate": null
+          },
           "agents": {
             "oneOf": [
               {
@@ -1277,6 +1319,54 @@
         "x-struct": "Elixir.HablalaApiWeb.Schemas.AccountManifestSections",
         "x-validate": null
       },
+      "ActionRunRequest": {
+        "description": "Input de una action transaccional. `input` es el mapa que interpolan los steps (`{{input.…}}`, y `{{item.…}}` en los steps con for_each).",
+        "properties": {
+          "idempotency_key": {
+            "description": "Clave natural para reintentos seguros (se propaga a cada step creado).",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "input": {
+            "description": "Los valores de entrada de la action (forma libre, definida por sus steps).",
+            "type": "object",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "title": "ActionRunRequest",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.ActionRunRequest",
+        "x-validate": null
+      },
+      "ActionRunResponse": {
+        "properties": {
+          "data": {
+            "properties": {
+              "results": {
+                "description": "Por step_id, el/los records creados (`{id, properties}`). Un step con for_each devuelve una lista; uno simple, un objeto.",
+                "type": "object",
+                "x-struct": null,
+                "x-validate": null
+              }
+            },
+            "required": [
+              "results"
+            ],
+            "type": "object",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "title": "ActionRunResponse",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.ActionRunResponse",
+        "x-validate": null
+      },
       "AddMemberRequest": {
         "description": "Añade un usuario del tenant a una conversación (invitar a un canal).",
         "properties": {
@@ -1698,6 +1788,134 @@
         "x-struct": "Elixir.HablalaApiWeb.Schemas.AgentsResponse",
         "x-validate": null
       },
+      "AggregateQueryRequest": {
+        "description": "Aggregation query: agrupa records por `dimensions` y calcula `measures` (count/sum/avg/min/max), bajo la misma gobernanza (RBAC + ABAC default-deny) que la lectura puntual. El par canónico measures + dimensions del semantic layer (Cube.dev).",
+        "properties": {
+          "dimensions": {
+            "description": "Los attributes por los que agrupar (GROUP BY).",
+            "items": {
+              "properties": {
+                "attr": {
+                  "description": "Slug del attribute a agrupar.",
+                  "type": "string",
+                  "x-struct": null,
+                  "x-validate": null
+                },
+                "granularity": {
+                  "description": "Solo para date/timestamp (time dimension): trunca el valor a ese bucket.",
+                  "enum": [
+                    "day",
+                    "week",
+                    "month",
+                    "quarter",
+                    "year"
+                  ],
+                  "type": "string",
+                  "x-struct": null,
+                  "x-validate": null
+                }
+              },
+              "required": [
+                "attr"
+              ],
+              "type": "object",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "measures": {
+            "description": "Las agregaciones a calcular (al menos una).",
+            "items": {
+              "properties": {
+                "as": {
+                  "description": "Alias de salida (default: `count` o `<fn>_<attr>`).",
+                  "type": "string",
+                  "x-struct": null,
+                  "x-validate": null
+                },
+                "attr": {
+                  "description": "Slug del attribute a agregar (number para sum/avg; number/date/timestamp para min/max). Omitido solo en `count`.",
+                  "type": "string",
+                  "x-struct": null,
+                  "x-validate": null
+                },
+                "fn": {
+                  "description": "La función de agregación. `count` no lleva `attr`.",
+                  "enum": [
+                    "count",
+                    "sum",
+                    "avg",
+                    "min",
+                    "max"
+                  ],
+                  "type": "string",
+                  "x-struct": null,
+                  "x-validate": null
+                }
+              },
+              "required": [
+                "fn"
+              ],
+              "type": "object",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "object": {
+            "description": "Slug del objeto raíz (requerido).",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "where": {
+            "description": "Mismo formato que en la consulta puntual: filtra ANTES de agregar.",
+            "items": {
+              "type": "object",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "required": [
+          "object",
+          "measures"
+        ],
+        "title": "AggregateQueryRequest",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.AggregateQueryRequest",
+        "x-validate": null
+      },
+      "AggregateResultResponse": {
+        "properties": {
+          "data": {
+            "description": "Un grupo por combinación de dimensions (o un solo grupo con los totales si no hay dimensions). Cada grupo es un mapa: cada dimension por su slug y cada measure por su alias de salida.",
+            "items": {
+              "type": "object",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "title": "AggregateResultResponse",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.AggregateResultResponse",
+        "x-validate": null
+      },
       "ApiKey": {
         "description": "Metadatos de una API key de la Public API. El secreto en claro NO se incluye aquí — solo se devuelve una vez, al crearla.",
         "properties": {
@@ -2030,6 +2248,13 @@
             "x-struct": null,
             "x-validate": null
           },
+          "seatsPerSlot": {
+            "description": "Capacidad del slot: cuántas citas solapadas del mismo organizador caben a la vez (Cal.com seats per time slot). 1 = no-solape estricto; N = hasta N concurrentes.",
+            "minimum": 1,
+            "type": "integer",
+            "x-struct": null,
+            "x-validate": null
+          },
           "startsAt": {
             "format": "date-time",
             "type": "string",
@@ -2100,6 +2325,13 @@
             "x-struct": null,
             "x-validate": null
           },
+          "seatsPerSlot": {
+            "description": "Capacidad del slot (default 1 = no-solape estricto). N permite hasta N citas solapadas del mismo organizador (aforo, clases, atención en paralelo).",
+            "minimum": 1,
+            "type": "integer",
+            "x-struct": null,
+            "x-validate": null
+          },
           "startsAt": {
             "format": "date-time",
             "type": "string",
@@ -6734,6 +6966,60 @@
         "x-struct": "Elixir.HablalaApiWeb.Schemas.MachineOrganizationResponse",
         "x-validate": null
       },
+      "ManifestAction": {
+        "description": "Una action transaccional del tenant declarada (sección `actions/`), identificada por `slug`. Ejecuta sus `steps` en UNA transacción (todo-o-nada) al invocar `POST /v1/actions/:slug`: crear una cabecera + N líneas de forma atómica (el caso `create_rental` de una app interna). Cada step declara un `object` del diccionario y las `properties` a escribir, con interpolación `{{input.…}}`, `{{steps.<id>.id}}` (ref entre steps) y `{{item.…}}` en un step con `for_each`. Sección AUTORITATIVA: retirarla del manifiesto la archiva. `description`/`synonyms` son el contexto con el que los agentes LLM la descubren vía MCP (obligatoria la descripción, como el resto del diccionario).",
+        "properties": {
+          "description": {
+            "description": "Qué hace la action (contexto para humanos y agentes LLM). Obligatoria al crear.",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "slug": {
+            "description": "Identidad estable snake_case, única por organización (match key).",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "steps": {
+            "description": "Lista NO vacía de pasos. Cada paso: `id` (opcional, para refs `{{steps.<id>.id}}`), `object` (slug del diccionario), `properties` (mapa slug→valor con interpolación) y opcionalmente `for_each` (una ruta del input que expande el step en N records).",
+            "items": {
+              "additionalProperties": true,
+              "type": "object",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "synonyms": {
+            "description": "Sinónimos para el descubrimiento por búsqueda/LLM.",
+            "items": {
+              "type": "string",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "title": {
+            "description": "Nombre visible; si se omite, se deriva del slug.",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "required": [
+          "slug",
+          "steps"
+        ],
+        "title": "ManifestAction",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.ManifestAction",
+        "x-validate": null
+      },
       "ManifestAgent": {
         "description": "Un agente de IA declarado, identificado por `handle`. Archivar (no declararlo) lo revoca. `ownerUserId` (id público `user_…`) es obligatorio al crear con un access token de máquina; con un usuario, el creador es el dueño por defecto.",
         "properties": {
@@ -7845,49 +8131,178 @@
         "x-struct": "Elixir.HablalaApiWeb.Schemas.MediaResponse",
         "x-validate": null
       },
-      "Membership": {
+      "Member": {
+        "description": "Un miembro de la organización: identidad legible + sus roles (sin secretos).",
         "properties": {
-          "avatarUrl": {
-            "description": "Avatar override para esta org; `null` usa el global del usuario.",
-            "nullable": true,
-            "type": "string",
-            "x-struct": null,
-            "x-validate": null
-          },
           "displayName": {
-            "description": "Nombre visible en esta org (override del `name` global).",
             "nullable": true,
             "type": "string",
             "x-struct": null,
             "x-validate": null
           },
           "email": {
-            "description": "Email corporativo del miembro (dato de org entre colegas, acotado al tenant). `null` si la cuenta no tiene email. No confundir con el perfil público `user`, que no lleva PII.",
-            "format": "email",
             "nullable": true,
             "type": "string",
             "x-struct": null,
             "x-validate": null
           },
           "id": {
+            "description": "Id de la membresía (`mbr_…`).",
             "type": "string",
             "x-struct": null,
             "x-validate": null
           },
-          "insertedAt": {
-            "format": "date-time",
+          "roles": {
+            "description": "Los roles del miembro por nombre (owner/admin/member o custom).",
+            "items": {
+              "type": "string",
+              "x-struct": null,
+              "x-validate": null
+            },
+            "type": "array",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "required": [
+          "id",
+          "roles"
+        ],
+        "title": "Member",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.Member",
+        "x-validate": null
+      },
+      "MemberLoginRequest": {
+        "description": "Credenciales de un miembro (empleado que opera la org). La organización sale de la API key.",
+        "properties": {
+          "email": {
+            "format": "email",
             "type": "string",
             "x-struct": null,
             "x-validate": null
           },
-          "organizationId": {
+          "password": {
+            "format": "password",
             "type": "string",
             "x-struct": null,
             "x-validate": null
-          },
-          "roles": {
-            "items": {
-              "$ref": "#/components/schemas/RoleRef"
+          }
+        },
+        "required": [
+          "email",
+          "password"
+        ],
+        "title": "MemberLoginRequest",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.MemberLoginRequest",
+        "x-validate": null
+      },
+      "MemberResponse": {
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/Member"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "title": "MemberResponse",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.MemberResponse",
+        "x-validate": null
+      },
+      "MemberSession": {
+        "properties": {
+          "expiresAt": {
+            "format": "date-time",
+            "nullable": true,
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "member": {
+            "$ref": "#/components/schemas/Member"
+          },
+          "prefix": {
+            "nullable": true,
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "token": {
+            "description": "El member session token en claro (`mem_…`), legible SOLO en esta respuesta.",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          }
+        },
+        "required": [
+          "token",
+          "member"
+        ],
+        "title": "MemberSession",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.MemberSession",
+        "x-validate": null
+      },
+      "MemberSessionResponse": {
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/MemberSession"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "title": "MemberSessionResponse",
+        "type": "object",
+        "x-struct": "Elixir.HablalaApiWeb.Schemas.MemberSessionResponse",
+        "x-validate": null
+      },
+      "Membership": {
+        "properties": {
+          "avatarUrl": {
+            "description": "Avatar override para esta org; `null` usa el global del usuario.",
+            "nullable": true,
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "displayName": {
+            "description": "Nombre visible en esta org (override del `name` global).",
+            "nullable": true,
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "email": {
+            "description": "Email corporativo del miembro (dato de org entre colegas, acotado al tenant). `null` si la cuenta no tiene email. No confundir con el perfil público `user`, que no lleva PII.",
+            "format": "email",
+            "nullable": true,
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "id": {
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "insertedAt": {
+            "format": "date-time",
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "organizationId": {
+            "type": "string",
+            "x-struct": null,
+            "x-validate": null
+          },
+          "roles": {
+            "items": {
+              "$ref": "#/components/schemas/RoleRef"
             },
             "type": "array",
             "x-struct": null,
@@ -9780,7 +10195,8 @@
               "read",
               "create",
               "update",
-              "delete"
+              "delete",
+              "signal"
             ],
             "type": "string",
             "x-struct": null,
@@ -9824,6 +10240,8 @@
             "x-validate": null
           },
           "principalId": {
+            "description": "null para los principales de clase (public/end_user/access_token).",
+            "nullable": true,
             "type": "string",
             "x-struct": null,
             "x-validate": null
@@ -9832,7 +10250,10 @@
             "enum": [
               "role",
               "user",
-              "agent"
+              "agent",
+              "public",
+              "end_user",
+              "access_token"
             ],
             "type": "string",
             "x-struct": null,
@@ -9867,7 +10288,6 @@
           "effect",
           "action",
           "principalType",
-          "principalId",
           "resourceType"
         ],
         "title": "Policy",
@@ -9882,7 +10302,8 @@
               "read",
               "create",
               "update",
-              "delete"
+              "delete",
+              "signal"
             ],
             "type": "string",
             "x-struct": null,
@@ -9915,6 +10336,8 @@
             "x-validate": null
           },
           "principalId": {
+            "description": "null/omitido para los principales de clase (public/end_user/access_token).",
+            "nullable": true,
             "type": "string",
             "x-struct": null,
             "x-validate": null
@@ -9923,7 +10346,10 @@
             "enum": [
               "role",
               "user",
-              "agent"
+              "agent",
+              "public",
+              "end_user",
+              "access_token"
             ],
             "type": "string",
             "x-struct": null,
@@ -9955,7 +10381,6 @@
           "effect",
           "action",
           "principalType",
-          "principalId",
           "resourceType"
         ],
         "title": "PolicyInput",
@@ -13351,6 +13776,11 @@
         "description": "End-user session token: `Authorization: Bearer <sess_…>`.",
         "scheme": "bearer",
         "type": "http"
+      },
+      "memberToken": {
+        "description": "Member session token: `Authorization: Bearer <mem_…>` (empleado que opera la org).",
+        "scheme": "bearer",
+        "type": "http"
       }
     }
   },
@@ -13365,7 +13795,7 @@
       "get": {
         "callbacks": {},
         "description": "Como el GET humano, pero la cuenta sale del access token. Es lo que `hablala pull`/`init` llama.",
-        "operationId": "HablalaApiWeb.Machine.AccountConfigController.show",
+        "operationId": "get /v1/account-config",
         "parameters": [],
         "responses": {
           "200": {
@@ -13397,7 +13827,7 @@
       "put": {
         "callbacks": {},
         "description": "Como el PUT humano: reconciliación transaccional crear/actualizar/archivar; `?dry_run=true` devuelve el diff sin aplicar. Con un access token no hay usuario creador: los agentes nuevos deben declarar `ownerUserId`.",
-        "operationId": "HablalaApiWeb.Machine.AccountConfigController.update",
+        "operationId": "put /v1/account-config",
         "parameters": [
           {
             "description": "Devuelve el plan (diff) sin aplicar nada.",
@@ -13475,7 +13905,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve el catálogo de activities declarables (enum cerrado, con su contrato de `config`) y los tipos de estado. El agente lo lee ANTES de escribir el manifiesto para no adivinar nombres ni claves — el espacio válido vive en el contrato, no en su memoria.",
-        "operationId": "HablalaApiWeb.Machine.AccountConfigController.capabilities",
+        "operationId": "get /v1/account-config/capabilities",
         "parameters": [],
         "responses": {
           "200": {
@@ -13509,7 +13939,7 @@
       "post": {
         "callbacks": {},
         "description": "Corre los casos `evals` de cada agente del manifiesto (patrón promptfoo): valida el manifiesto, resuelve cada agente aplicado y comprueba las aserciones sobre su comportamiento. Determinista por defecto (proveedor stub); `?live=true` corre contra el LLM real del agente. Es lo que `hablala eval` llama.",
-        "operationId": "HablalaApiWeb.Machine.AccountConfigController.eval",
+        "operationId": "post /v1/account-config/eval",
         "parameters": [
           {
             "description": "Corre contra el LLM real (no determinista) en vez del stub.",
@@ -13572,11 +14002,153 @@
         ]
       }
     },
+    "/v1/actions/{slug}": {
+      "post": {
+        "callbacks": {},
+        "description": "Corre los steps de la action `slug` en UNA transacción (todo-o-nada), interpolando el input, y devuelve los records creados por step. `create_rental`/`register_return` y similares. Gate: records:create.",
+        "operationId": "post /v1/actions/{slug}",
+        "parameters": [
+          {
+            "description": "Slug de la action a ejecutar.",
+            "in": "path",
+            "name": "slug",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "x-struct": null,
+              "x-validate": null
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ActionRunRequest"
+              }
+            }
+          },
+          "description": "Input de la action",
+          "required": false
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ActionRunResponse"
+                }
+              }
+            },
+            "description": "Resultado por step"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Sin permiso"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Action desconocida"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Fallo de un step (rollback total)"
+          }
+        },
+        "summary": "Ejecutar una action transaccional",
+        "tags": [
+          "actions"
+        ]
+      }
+    },
+    "/v1/aggregate": {
+      "post": {
+        "callbacks": {},
+        "description": "Agrupa records por `dimensions` y calcula `measures` (count/sum/avg/min/max), bajo la misma gobernanza (RBAC + ABAC default-deny) que la lectura puntual. Reemplaza los reportes que serían RPCs de SQL por-tenant.",
+        "operationId": "post /v1/aggregate",
+        "parameters": [],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AggregateQueryRequest"
+              }
+            }
+          },
+          "description": "Aggregation query",
+          "required": false
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AggregateResultResponse"
+                }
+              }
+            },
+            "description": "Grupos agregados"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Sin permiso"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Objeto desconocido"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Consulta inválida"
+          }
+        },
+        "summary": "Ejecutar una aggregation query",
+        "tags": [
+          "query"
+        ]
+      }
+    },
     "/v1/device-links": {
       "post": {
         "callbacks": {},
         "description": "Inicia la vinculación de la web: devuelve un `linkCode` para pintar el QR que el teléfono escaneará. Público (es un flujo de login). El teléfono es la raíz de identidad; la web hereda la sesión al aprobarse (modelo WhatsApp *linked devices*).",
-        "operationId": "HablalaApiWeb.Accounts.DeviceLinkController.create",
+        "operationId": "post /v1/device-links",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -13622,7 +14194,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve `pending` (sigue esperando), `linked` (aprobado: incluye `user` y el `token` de sesión web, SOLO en el primer poll) o `denied`. Público: el `linkCode` es la credencial.",
-        "operationId": "HablalaApiWeb.Accounts.DeviceLinkController.status",
+        "operationId": "get /v1/device-links/{link_code}",
         "parameters": [
           {
             "description": "El `linkCode` del QR (`dlnk_…`).",
@@ -13679,7 +14251,7 @@
       "post": {
         "callbacks": {},
         "description": "El teléfono AUTENTICADO aprueba la vinculación de la web (tras escanear el QR). Crea la sesión web y emite su token. Acción sensible: la app debe mostrar qué se está vinculando.",
-        "operationId": "HablalaApiWeb.Accounts.DeviceLinkController.approve",
+        "operationId": "post /v1/device-links/{link_code}/approve",
         "parameters": [
           {
             "description": "El `linkCode` escaneado.",
@@ -13728,7 +14300,7 @@
       "post": {
         "callbacks": {},
         "description": "El teléfono AUTENTICADO rechaza la vinculación de la web.",
-        "operationId": "HablalaApiWeb.Accounts.DeviceLinkController.deny",
+        "operationId": "post /v1/device-links/{link_code}/deny",
         "parameters": [
           {
             "description": "El `linkCode` escaneado.",
@@ -13777,7 +14349,7 @@
       "post": {
         "callbacks": {},
         "description": "Conecta dos records vía un tipo de relación (`relationship` = slug). Idempotente: crear la misma arista dos veces no falla.",
-        "operationId": "HablalaApiWeb.Machine.EdgeController.create",
+        "operationId": "post /v1/edges",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -13831,7 +14403,7 @@
     "/v1/edges/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.EdgeController.delete",
+        "operationId": "delete /v1/edges/{id}",
         "parameters": [
           {
             "description": "",
@@ -13860,7 +14432,7 @@
       "post": {
         "callbacks": {},
         "description": "Devuelve el grafo de datos del tenant como `nodes` + `edges` planos (knowledge graph), acotado por `limit` y ordenado por grado desc (los nodos más conectados primero). Filtra por el ABAC del scope. Base de la vista de grafo global.",
-        "operationId": "HablalaApiWeb.Machine.GraphController.overview",
+        "operationId": "post /v1/graph",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -13905,7 +14477,7 @@
       "post": {
         "callbacks": {},
         "description": "Devuelve el vecindario de un nodo — sus vecinos directos (1 salto) + las aristas que los unen — como `nodes` + `edges`. Es el *expand-on-demand* (progressive disclosure) para explorar el grafo sin cargarlo entero.",
-        "operationId": "HablalaApiWeb.Machine.GraphController.expand",
+        "operationId": "post /v1/graph/expand",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -13960,7 +14532,7 @@
       "post": {
         "callbacks": {},
         "description": "Canjea el token de una invitación (enviado por email) para unirse a la organización. Requiere que el email autenticado coincida con el invitado.",
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.accept",
+        "operationId": "post /v1/invitations/accept",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -14025,7 +14597,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve los datos públicos de una invitación (organización y quién invita) a partir de su token, sin consumirla ni requerir sesión. Sirve para mostrar el contexto antes de que el invitado entre.",
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.preview",
+        "operationId": "get /v1/invitations/preview",
         "parameters": [
           {
             "description": "",
@@ -14072,7 +14644,7 @@
       "post": {
         "callbacks": {},
         "description": "Canjea el secreto de un organization invite link para unirse a la organización con el rol configurado en el link. A diferencia de la invitación por email, no requiere email-match: el link es el secreto.",
-        "operationId": "HablalaApiWeb.Orgs.InviteLinkController.accept",
+        "operationId": "post /v1/invite-links/accept",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -14127,7 +14699,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve la organización (nombre + icono) a la que lleva un organization invite link, sin consumirlo ni requerir sesión. Sirve para mostrar a dónde te unes en `/join` antes de confirmar. Siempre 200: el `status` del cuerpo distingue `valid` de `invalid`.",
-        "operationId": "HablalaApiWeb.Orgs.InviteLinkController.preview",
+        "operationId": "get /v1/invite-links/preview",
         "parameters": [
           {
             "description": "",
@@ -14164,7 +14736,7 @@
       "get": {
         "callbacks": {},
         "description": "Lista las sesiones web/desktop vinculadas del usuario autenticado.",
-        "operationId": "HablalaApiWeb.Accounts.DeviceLinkController.index",
+        "operationId": "get /v1/linked-devices",
         "parameters": [],
         "responses": {
           "200": {
@@ -14188,7 +14760,7 @@
       "delete": {
         "callbacks": {},
         "description": "Mata la sesión web/desktop de un dispositivo vinculado (borra su token en cascada). Idempotente. Solo dispositivos propios.",
-        "operationId": "HablalaApiWeb.Accounts.DeviceLinkController.revoke",
+        "operationId": "delete /v1/linked-devices/{id}",
         "parameters": [
           {
             "description": "Id público del dispositivo (`dev_…`).",
@@ -14226,7 +14798,7 @@
     "/v1/me/blocks": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.BlockController.index",
+        "operationId": "get /v1/me/blocks",
         "parameters": [],
         "responses": {
           "200": {
@@ -14248,7 +14820,7 @@
       "post": {
         "callbacks": {},
         "description": "Idempotente: bloquear a quien ya está bloqueado no falla. Corta el DM en ambos sentidos.",
-        "operationId": "HablalaApiWeb.Me.BlockController.create",
+        "operationId": "post /v1/me/blocks",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -14285,7 +14857,7 @@
     "/v1/me/blocks/{user_id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.BlockController.delete",
+        "operationId": "delete /v1/me/blocks/{user_id}",
         "parameters": [
           {
             "description": "",
@@ -14313,7 +14885,7 @@
     "/v1/me/conversations": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.index",
+        "operationId": "get /v1/me/conversations",
         "parameters": [],
         "responses": {
           "200": {
@@ -14335,7 +14907,7 @@
       "post": {
         "callbacks": {},
         "description": "Grupo de consumo (estilo app de consumo): un grupo con nombre + foto SIN organización. Los miembros iniciales se validan por bloqueos (no por tenant). Nace visible para sus miembros.",
-        "operationId": "HablalaApiWeb.Me.ConversationController.create",
+        "operationId": "post /v1/me/conversations",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -14380,7 +14952,7 @@
       "post": {
         "callbacks": {},
         "description": "Idempotente por conjunto de participantes en toda la plataforma. Destinatarios validados por bloqueos (default abierto), no por membresía de organización.",
-        "operationId": "HablalaApiWeb.Me.ConversationController.create_direct",
+        "operationId": "post /v1/me/conversations/direct",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -14425,7 +14997,7 @@
       "post": {
         "callbacks": {},
         "description": "Flujo de 'nueva conversación' de consumo (estilo app de consumo): el DM personal no existe hasta su primer mensaje. Idempotente por conjunto de participantes en toda la plataforma. Los destinatarios se validan por bloqueos (default abierto), no por membresía de organización.",
-        "operationId": "HablalaApiWeb.Me.ConversationController.create_direct_message",
+        "operationId": "post /v1/me/conversations/direct/messages",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -14470,7 +15042,7 @@
       "get": {
         "callbacks": {},
         "description": "Las conversaciones donde un no-contacto te escribió (estilo Instagram): aparte del inbox, no marcan no-leídos hasta que las aceptas. Ver ADR-022.",
-        "operationId": "HablalaApiWeb.Me.ConversationController.requests",
+        "operationId": "get /v1/me/conversations/requests",
         "parameters": [],
         "responses": {
           "200": {
@@ -14493,7 +15065,7 @@
     "/v1/me/conversations/{conversation_id}/accept": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.accept_request",
+        "operationId": "post /v1/me/conversations/{conversation_id}/accept",
         "parameters": [
           {
             "description": "",
@@ -14538,7 +15110,7 @@
     "/v1/me/conversations/{conversation_id}/archive": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.unarchive",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/archive",
         "parameters": [
           {
             "description": "",
@@ -14571,7 +15143,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.archive",
+        "operationId": "post /v1/me/conversations/{conversation_id}/archive",
         "parameters": [
           {
             "description": "",
@@ -14606,7 +15178,7 @@
     "/v1/me/conversations/{conversation_id}/media": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.media",
+        "operationId": "get /v1/me/conversations/{conversation_id}/media",
         "parameters": [
           {
             "description": "",
@@ -14674,7 +15246,7 @@
     "/v1/me/conversations/{conversation_id}/members": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.members",
+        "operationId": "get /v1/me/conversations/{conversation_id}/members",
         "parameters": [
           {
             "description": "",
@@ -14708,7 +15280,7 @@
       "post": {
         "callbacks": {},
         "description": "Idempotente. El destinatario debe ser alcanzable: existente/activo y sin bloqueo con quien invita (gate simétrico de consumo).",
-        "operationId": "HablalaApiWeb.Me.ConversationController.add_member",
+        "operationId": "post /v1/me/conversations/{conversation_id}/members",
         "parameters": [
           {
             "description": "",
@@ -14764,7 +15336,7 @@
     "/v1/me/conversations/{conversation_id}/members/{user_id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.remove_member",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/members/{user_id}",
         "parameters": [
           {
             "description": "",
@@ -14813,7 +15385,7 @@
     "/v1/me/conversations/{conversation_id}/members/{user_id}/ban": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.unban",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/members/{user_id}/ban",
         "parameters": [
           {
             "description": "",
@@ -14861,7 +15433,7 @@
       "post": {
         "callbacks": {},
         "description": "Solo admins. Bloquea al usuario: no puede volver ni ser re-agregado mientras el ban siga vigente. Sin `until` = permanente; con `until` (ISO 8601) = temporal.",
-        "operationId": "HablalaApiWeb.Me.ConversationController.ban",
+        "operationId": "post /v1/me/conversations/{conversation_id}/members/{user_id}/ban",
         "parameters": [
           {
             "description": "",
@@ -14921,7 +15493,7 @@
     "/v1/me/conversations/{conversation_id}/members/{user_id}/role": {
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.change_role",
+        "operationId": "patch /v1/me/conversations/{conversation_id}/members/{user_id}/role",
         "parameters": [
           {
             "description": "",
@@ -14988,7 +15560,7 @@
     "/v1/me/conversations/{conversation_id}/messages": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.MessageController.index",
+        "operationId": "get /v1/me/conversations/{conversation_id}/messages",
         "parameters": [
           {
             "description": "",
@@ -15032,7 +15604,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.MessageController.create",
+        "operationId": "post /v1/me/conversations/{conversation_id}/messages",
         "parameters": [
           {
             "description": "",
@@ -15088,7 +15660,7 @@
     "/v1/me/conversations/{conversation_id}/messages/changes": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.MessageController.changes",
+        "operationId": "get /v1/me/conversations/{conversation_id}/messages/changes",
         "parameters": [
           {
             "description": "",
@@ -15144,7 +15716,7 @@
     "/v1/me/conversations/{conversation_id}/messages/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.MessageController.delete",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/messages/{id}",
         "parameters": [
           {
             "description": "",
@@ -15191,7 +15763,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.MessageController.update (2)",
+        "operationId": "patch /v1/me/conversations/{conversation_id}/messages/{id}",
         "parameters": [
           {
             "description": "",
@@ -15256,7 +15828,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.MessageController.update",
+        "operationId": "put /v1/me/conversations/{conversation_id}/messages/{id}",
         "parameters": [
           {
             "description": "",
@@ -15323,7 +15895,7 @@
     "/v1/me/conversations/{conversation_id}/messages/{message_id}/reactions": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ReactionController.create",
+        "operationId": "post /v1/me/conversations/{conversation_id}/messages/{message_id}/reactions",
         "parameters": [
           {
             "description": "",
@@ -15383,7 +15955,7 @@
     "/v1/me/conversations/{conversation_id}/messages/{message_id}/reactions/{emoji}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ReactionController.delete",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/messages/{message_id}/reactions/{emoji}",
         "parameters": [
           {
             "description": "",
@@ -15443,7 +16015,7 @@
     "/v1/me/conversations/{conversation_id}/mute": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.unmute",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/mute",
         "parameters": [
           {
             "description": "",
@@ -15476,7 +16048,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.mute",
+        "operationId": "post /v1/me/conversations/{conversation_id}/mute",
         "parameters": [
           {
             "description": "",
@@ -15522,7 +16094,7 @@
     "/v1/me/conversations/{conversation_id}/pin": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.unpin",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/pin",
         "parameters": [
           {
             "description": "",
@@ -15555,7 +16127,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.pin",
+        "operationId": "post /v1/me/conversations/{conversation_id}/pin",
         "parameters": [
           {
             "description": "",
@@ -15590,7 +16162,7 @@
     "/v1/me/conversations/{conversation_id}/read": {
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.mark_read",
+        "operationId": "put /v1/me/conversations/{conversation_id}/read",
         "parameters": [
           {
             "description": "",
@@ -15629,7 +16201,7 @@
     "/v1/me/conversations/{conversation_id}/report": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.report",
+        "operationId": "post /v1/me/conversations/{conversation_id}/report",
         "parameters": [
           {
             "description": "",
@@ -15669,7 +16241,7 @@
       "delete": {
         "callbacks": {},
         "description": "Estilo Instagram 'Eliminar': quita la conversación de MI bandeja de solicitudes (borra mi membresía de solicitud). No la borra para quien la envió. Ver ADR-022.",
-        "operationId": "HablalaApiWeb.Me.ConversationController.decline_request",
+        "operationId": "delete /v1/me/conversations/{conversation_id}/request",
         "parameters": [
           {
             "description": "",
@@ -15707,7 +16279,7 @@
     "/v1/me/conversations/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.show",
+        "operationId": "get /v1/me/conversations/{id}",
         "parameters": [
           {
             "description": "",
@@ -15750,7 +16322,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ConversationController.update",
+        "operationId": "patch /v1/me/conversations/{id}",
         "parameters": [
           {
             "description": "",
@@ -15806,7 +16378,7 @@
     "/v1/me/friends": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.FriendController.index",
+        "operationId": "get /v1/me/friends",
         "parameters": [],
         "responses": {
           "200": {
@@ -15830,7 +16402,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve las relaciones (libreta + solicitudes entrantes) mutadas desde `since`, INCLUYENDO tombstones (`deletedAt` no nulo) para propagar borrados. Es el carril de sincronización del cliente local-first (ADR-021/022): pinta desde su caché y aplica este delta detrás. Sin `since`, equivale al primer sync completo.",
-        "operationId": "HablalaApiWeb.Me.FriendController.changes",
+        "operationId": "get /v1/me/friends/changes",
         "parameters": [
           {
             "description": "Cursor ISO-8601 (UTC): trae solo lo mutado después de este instante.",
@@ -15865,7 +16437,7 @@
     "/v1/me/friends/requests": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.FriendController.requests",
+        "operationId": "get /v1/me/friends/requests",
         "parameters": [],
         "responses": {
           "200": {
@@ -15886,7 +16458,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.FriendController.send_request",
+        "operationId": "post /v1/me/friends/requests",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -15930,7 +16502,7 @@
     "/v1/me/friends/requests/{id}/accept": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.FriendController.accept_request",
+        "operationId": "post /v1/me/friends/requests/{id}/accept",
         "parameters": [
           {
             "description": "",
@@ -15958,7 +16530,7 @@
     "/v1/me/friends/requests/{id}/reject": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.FriendController.reject_request",
+        "operationId": "post /v1/me/friends/requests/{id}/reject",
         "parameters": [
           {
             "description": "",
@@ -15987,7 +16559,7 @@
       "post": {
         "callbacks": {},
         "description": "El cliente sube hashes de pares (base64 de SHA-256 de 32 bytes) de su agenda —NO números—. Devuelve los amigos que también lo tienen agendado (match mutuo, consentimiento mutuo). El servidor no ve ni almacena números de contactos. Rate-limited.",
-        "operationId": "HablalaApiWeb.Me.FriendController.sync",
+        "operationId": "post /v1/me/friends/sync",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -16021,7 +16593,7 @@
     "/v1/me/friends/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.FriendController.delete",
+        "operationId": "delete /v1/me/friends/{id}",
         "parameters": [
           {
             "description": "",
@@ -16050,7 +16622,7 @@
       "get": {
         "callbacks": {},
         "description": "Lista las invitaciones de organización vigentes (pendientes, no caducadas) que otras personas me enviaron por mi username. Las acepto o rechazo desde la app.",
-        "operationId": "HablalaApiWeb.Me.InvitationController.index",
+        "operationId": "get /v1/me/invitations",
         "parameters": [],
         "responses": {
           "200": {
@@ -16074,7 +16646,7 @@
       "post": {
         "callbacks": {},
         "description": "Me une a la organización que me invitó (crea la membresía y asigna el rol ofrecido).",
-        "operationId": "HablalaApiWeb.Me.InvitationController.accept",
+        "operationId": "post /v1/me/invitations/{id}/accept",
         "parameters": [
           {
             "description": "",
@@ -16130,7 +16702,7 @@
       "post": {
         "callbacks": {},
         "description": "Descarta la invitación sin unirme (no crea membresía). Doctrina anti-spam.",
-        "operationId": "HablalaApiWeb.Me.InvitationController.decline",
+        "operationId": "post /v1/me/invitations/{id}/decline",
         "parameters": [
           {
             "description": "",
@@ -16169,7 +16741,7 @@
       "get": {
         "callbacks": {},
         "description": "Descubrimiento personal. Manda **o** `username` (handle público, estilo Discord; identifier principal independiente del método de login) **o** `phone` (E.164; raíz de identidad de consumo, ADR-022). Devuelve la persona a la que puedes enviar una solicitud, o `data: null` si no corresponde a nadie alcanzable (no existe, inactivo o bloqueo). La indistinción es deliberada (no filtra existencia de cuentas). Rate-limited contra enumeración.",
-        "operationId": "HablalaApiWeb.Me.PeopleController.lookup",
+        "operationId": "get /v1/me/people/lookup",
         "parameters": [
           {
             "description": "Handle público a resolver (case-insensitive).",
@@ -16216,7 +16788,7 @@
       "get": {
         "callbacks": {},
         "description": "Búsqueda estilo red social. Manda `q`. Si `q` es un `@username` (o coincide exacto con un handle), resuelve esa persona globalmente (clave exacta, alcanza a cualquiera). Además busca por **nombre** —substring, case-insensitive— pero **solo entre gente con la que ya compartes contexto** (contactos, orgs, chats): el nombre no enumera desconocidos, por privacidad (ADR-022/024). Devuelve una lista (posiblemente vacía). Rate-limited.",
-        "operationId": "HablalaApiWeb.Me.PeopleController.search",
+        "operationId": "get /v1/me/people/search",
         "parameters": [
           {
             "description": "Texto a buscar: un `@username` (exacto) y/o un nombre (substring en contexto).",
@@ -16267,7 +16839,7 @@
     "/v1/me/reports/users/{user_id}": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.ReportController.report_user",
+        "operationId": "post /v1/me/reports/users/{user_id}",
         "parameters": [
           {
             "description": "",
@@ -16317,7 +16889,7 @@
       "post": {
         "callbacks": {},
         "description": "Como el presign de organización, pero el blob se namespacea por usuario. Devuelve un sobre auto-descriptivo (`method`/`url`/`fields`/`headers`); el cliente sube según `method` y referencia `fileUrl` en los adjuntos del mensaje.",
-        "operationId": "HablalaApiWeb.Me.UploadController.presign",
+        "operationId": "post /v1/me/uploads/presign",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -16331,17 +16903,205 @@
           "required": false
         },
         "responses": {
-          "200": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PresignResponse"
+                }
+              }
+            },
+            "description": "Sobre de subida prefirmado"
+          },
+          "415": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Tipo de archivo no soportado"
+          }
+        },
+        "summary": "Pedir un sobre de subida prefirmado (adjunto personal)",
+        "tags": [
+          "personal uploads"
+        ]
+      }
+    },
+    "/v1/me/usernames/available": {
+      "get": {
+        "callbacks": {},
+        "operationId": "get /v1/me/usernames/available",
+        "parameters": [
+          {
+            "description": "Handle a comprobar.",
+            "in": "query",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "x-struct": null,
+              "x-validate": null
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UsernameAvailableResponse"
+                }
+              }
+            },
+            "description": "Disponibilidad"
+          }
+        },
+        "summary": "¿Está disponible este username? (check en vivo del alta/cambio)",
+        "tags": [
+          "people"
+        ]
+      }
+    },
+    "/v1/members/me": {
+      "get": {
+        "callbacks": {},
+        "description": "Devuelve el miembro de la member session actual: id, email, nombre visible y sus roles. El equivalente a `getCurrentUser` de una app interna.",
+        "operationId": "get /v1/members/me",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MemberResponse"
+                }
+              }
+            },
+            "description": "El miembro actual"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Sesión inválida"
+          }
+        },
+        "security": [
+          {
+            "memberToken": []
+          }
+        ],
+        "summary": "El miembro autenticado (quién soy)",
+        "tags": [
+          "members"
+        ]
+      }
+    },
+    "/v1/members/session": {
+      "delete": {
+        "callbacks": {},
+        "description": "Revoca el member session token. Idempotente.",
+        "operationId": "delete /v1/members/session",
+        "parameters": [],
+        "responses": {
+          "204": {
+            "description": "Sesión cerrada"
+          }
+        },
+        "security": [
+          {
+            "memberToken": []
+          }
+        ],
+        "summary": "Cerrar la sesión de miembro (logout)",
+        "tags": [
+          "members"
+        ]
+      },
+      "post": {
+        "callbacks": {},
+        "description": "Autentica a un miembro humano (empleado que opera la org) por email+password y devuelve un member session token (`mem_…`) que porta su rol. La organización sale de la API key de la app. Es el login de operador de una app interna (patrón Organizations+Members).",
+        "operationId": "post /v1/members/session",
+        "parameters": [],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MemberLoginRequest"
+              }
+            }
+          },
+          "description": "Credenciales del miembro",
+          "required": false
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MemberSessionResponse"
+                }
+              }
+            },
+            "description": "Sesión de miembro"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "API key o credenciales inválidas"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Datos inválidos"
+          }
+        },
+        "security": [
+          {
+            "apiKey": []
+          }
+        ],
+        "summary": "Iniciar sesión de un miembro de la organización (login)",
+        "tags": [
+          "members"
+        ]
+      }
+    },
+    "/v1/members/session/refresh": {
+      "post": {
+        "callbacks": {},
+        "description": "Rota el member session token: revoca el actual y emite uno nuevo para la misma membresía (patrón WorkOS refresh). Autenticado por el `mem_` actual.",
+        "operationId": "post /v1/members/session/refresh",
+        "parameters": [],
+        "responses": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PresignResponse"
+                  "$ref": "#/components/schemas/MemberSessionResponse"
                 }
               }
             },
-            "description": "Sobre de subida prefirmado"
+            "description": "Nueva sesión"
           },
-          "415": {
+          "401": {
             "content": {
               "application/json": {
                 "schema": {
@@ -16349,47 +17109,17 @@
                 }
               }
             },
-            "description": "Tipo de archivo no soportado"
+            "description": "Sesión inválida"
           }
         },
-        "summary": "Pedir un sobre de subida prefirmado (adjunto personal)",
-        "tags": [
-          "personal uploads"
-        ]
-      }
-    },
-    "/v1/me/usernames/available": {
-      "get": {
-        "callbacks": {},
-        "operationId": "HablalaApiWeb.Me.PeopleController.available",
-        "parameters": [
+        "security": [
           {
-            "description": "Handle a comprobar.",
-            "in": "query",
-            "name": "username",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "x-struct": null,
-              "x-validate": null
-            }
+            "memberToken": []
           }
         ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/UsernameAvailableResponse"
-                }
-              }
-            },
-            "description": "Disponibilidad"
-          }
-        },
-        "summary": "¿Está disponible este username? (check en vivo del alta/cambio)",
+        "summary": "Renovar la sesión de miembro",
         "tags": [
-          "people"
+          "members"
         ]
       }
     },
@@ -16397,7 +17127,7 @@
       "post": {
         "callbacks": {},
         "description": "Crea un device authorization grant y devuelve `device_code` + `user_code` + `verification_uri`. El CLI muestra el código, abre la URI y sondea el token endpoint.",
-        "operationId": "HablalaApiWeb.Oauth.DeviceAuthorizationController.create",
+        "operationId": "post /v1/oauth/device/code",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -16442,7 +17172,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve el login del CLI pendiente detrás de un `user_code` para que la web pinte el consent (cliente, dispositivo, expiración). 404 si no existe, 410 si venció, 409 si ya se procesó.",
-        "operationId": "HablalaApiWeb.Oauth.GrantController.show",
+        "operationId": "get /v1/oauth/grants/{user_code}",
         "parameters": [
           {
             "description": "",
@@ -16508,7 +17238,7 @@
       "post": {
         "callbacks": {},
         "description": "El CLI que sondea recibe `access_denied` y termina.",
-        "operationId": "HablalaApiWeb.Oauth.GrantController.deny",
+        "operationId": "post /v1/oauth/grants/{user_code}/deny",
         "parameters": [
           {
             "description": "",
@@ -16554,7 +17284,7 @@
       "post": {
         "callbacks": {},
         "description": "`grant_type=authorization_code` (loopback + PKCE) o `grant_type=urn:ietf:params:oauth:grant-type:device_code` (polling del device flow). El `access_token` devuelto es un `mat_…` normal; guárdalo, no se puede recuperar.",
-        "operationId": "HablalaApiWeb.Oauth.TokenController.create",
+        "operationId": "post /v1/oauth/token",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -16608,7 +17338,7 @@
     "/v1/objects": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.ObjectController.index",
+        "operationId": "get /v1/objects",
         "parameters": [],
         "responses": {
           "200": {
@@ -16629,7 +17359,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.ObjectController.create",
+        "operationId": "post /v1/objects",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -16674,7 +17404,7 @@
       "delete": {
         "callbacks": {},
         "description": "Soft delete: marca `isArchived` en vez de borrar (los records persisten).",
-        "operationId": "HablalaApiWeb.Machine.ObjectController.delete",
+        "operationId": "delete /v1/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -16700,7 +17430,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.ObjectController.show",
+        "operationId": "get /v1/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -16743,7 +17473,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.ObjectController.update (2)",
+        "operationId": "patch /v1/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -16797,7 +17527,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.ObjectController.update",
+        "operationId": "put /v1/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -16853,7 +17583,7 @@
     "/v1/objects/{object_id}/attributes": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.AttributeController.index",
+        "operationId": "get /v1/objects/{object_id}/attributes",
         "parameters": [
           {
             "description": "",
@@ -16886,7 +17616,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.AttributeController.create",
+        "operationId": "post /v1/objects/{object_id}/attributes",
         "parameters": [
           {
             "description": "",
@@ -16942,7 +17672,7 @@
     "/v1/objects/{object_id}/attributes/{id}": {
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.AttributeController.update (2)",
+        "operationId": "patch /v1/objects/{object_id}/attributes/{id}",
         "parameters": [
           {
             "description": "",
@@ -17007,7 +17737,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.AttributeController.update",
+        "operationId": "put /v1/objects/{object_id}/attributes/{id}",
         "parameters": [
           {
             "description": "",
@@ -17074,7 +17804,7 @@
     "/v1/objects/{object_slug}/records": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RecordController.create",
+        "operationId": "post /v1/objects/{object_slug}/records",
         "parameters": [
           {
             "description": "",
@@ -17141,7 +17871,7 @@
       "get": {
         "callbacks": {},
         "description": "Lista los records SOFT-DELETED del objeto (`deleted_at IS NOT NULL`), para restaurarlos. Misma lectura gobernada que `POST /query` (RBAC + ABAC por fila + field_mask + paginación keyset), sobre el otro lado de `deleted_at`. Gate RBAC: `records:delete`.",
-        "operationId": "HablalaApiWeb.Machine.RecordController.trash",
+        "operationId": "get /v1/objects/{object_slug}/records/trash",
         "parameters": [
           {
             "description": "",
@@ -17218,7 +17948,7 @@
     "/v1/objects/{object_slug}/records/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RecordController.delete",
+        "operationId": "delete /v1/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -17275,7 +18005,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RecordController.show",
+        "operationId": "get /v1/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -17339,7 +18069,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RecordController.update (2)",
+        "operationId": "patch /v1/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -17424,7 +18154,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RecordController.update",
+        "operationId": "put /v1/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -17512,7 +18242,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve cuántos edges se desvincularían y qué referencias core BLOQUEARÍAN el borrado (restrict-on-delete), sin mutar nada. Alimenta la confirmación dependent-aware de la UI. Misma fuente que el guard del borrado real, así que preview y borrado no divergen. Gate `records:delete` + ABAC de escritura por fila.",
-        "operationId": "HablalaApiWeb.Machine.RecordController.dependencies",
+        "operationId": "get /v1/objects/{object_slug}/records/{record_id}/dependencies",
         "parameters": [
           {
             "description": "",
@@ -17578,7 +18308,7 @@
     "/v1/objects/{object_slug}/records/{record_id}/events": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.EventController.index",
+        "operationId": "get /v1/objects/{object_slug}/records/{record_id}/events",
         "parameters": [
           {
             "description": "",
@@ -17624,7 +18354,7 @@
     "/v1/objects/{object_slug}/records/{record_id}/restore": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RecordController.restore",
+        "operationId": "post /v1/objects/{object_slug}/records/{record_id}/restore",
         "parameters": [
           {
             "description": "",
@@ -17701,7 +18431,7 @@
       "post": {
         "callbacks": {},
         "description": "Fase 1 del flujo de archivos de un record: valida el archivo declarado contra el config del attribute `file` (`accepted_content_types` con comodines `image/*`, `max_size_bytes`) y devuelve el destino de subida prefirmado. Luego: (2) `PUT` del blob crudo a `uploadUrl` con `headers`; (3) confirmar escribiendo el record con `fileUrl` en el envelope del attribute (`{\"url\": fileUrl, …}`) — el servidor verifica el blob contra el storage (tamaño/tipo REALES) y lo promueve a su ubicación definitiva. Un blob nunca confirmado expira solo. Gate `records:create`.",
-        "operationId": "HablalaApiWeb.Machine.UploadController.create",
+        "operationId": "post /v1/objects/{object_slug}/uploads",
         "parameters": [
           {
             "description": "",
@@ -17768,7 +18498,7 @@
       "get": {
         "callbacks": {},
         "description": "La organización a la que pertenece la credencial de máquina, con su `status` (`active`/`unclaimed`/`claimed`) y sus relojes. Es el endpoint de polling del agente que provisionó una claimable org: mientras responda `unclaimed`, nadie la reclamó; un `401` posterior significa que se reclamó (los tokens del agente se rotaron) o venció.",
-        "operationId": "HablalaApiWeb.Machine.OrganizationController.show",
+        "operationId": "get /v1/organization",
         "parameters": [],
         "responses": {
           "200": {
@@ -17802,7 +18532,7 @@
       "post": {
         "callbacks": {},
         "description": "Emite un claim link nuevo (el anterior deja de canjear al instante) con su TTL corto, SIN extender el TTL del recurso. Falla si la org ya fue reclamada (`409`) o si el recurso venció (`410`).",
-        "operationId": "HablalaApiWeb.Machine.OrganizationController.refresh_claim_url",
+        "operationId": "post /v1/organization/refresh-claim-url",
         "parameters": [],
         "responses": {
           "200": {
@@ -17845,7 +18575,7 @@
     "/v1/organizations": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.index",
+        "operationId": "get /v1/organizations",
         "parameters": [],
         "responses": {
           "200": {
@@ -17866,7 +18596,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.create",
+        "operationId": "post /v1/organizations",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -17911,7 +18641,7 @@
       "post": {
         "callbacks": {},
         "description": "Consuma la **transferencia**: el usuario autenticado se vuelve `owner` de la org del claim token, la org pasa a `claimed` y los secretos del agente se ROTAN (todos los `mat_` y API keys activos se revocan; se emite un par nuevo que se revela aquí una única vez). Registra el evento `organization.claimed`.",
-        "operationId": "HablalaApiWeb.Orgs.ClaimableOrganizationController.claim",
+        "operationId": "post /v1/organizations/claim",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -17966,7 +18696,7 @@
       "post": {
         "callbacks": {},
         "description": "El **signup invertido** para agentes: crea una organización real `unclaimed` (sin dueño) y devuelve — UNA sola vez — el par de API keys (`pk_`/`sk_`), el machine access token (`mat_`, preset `account_as_code`) y el `claimUrl` con el que un humano la reclama. La org caduca (`expiresAt`, 72 h) si nadie la reclama; el claim link tiene su propio TTL renovable. Al reclamarse, los secretos del agente se ROTAN. Sin autenticación; rate limit estricto por IP.",
-        "operationId": "HablalaApiWeb.Orgs.ClaimableOrganizationController.create",
+        "operationId": "post /v1/organizations/claimable",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -18021,7 +18751,7 @@
       "get": {
         "callbacks": {},
         "description": "A qué organización lleva un claim token, sin consumirlo ni requerir sesión (la pantalla de claim lo muestra antes de pedir login). Siempre `200`: `status` distingue un token válido de uno inválido/vencido/ya reclamado (sin filtrar el motivo).",
-        "operationId": "HablalaApiWeb.Orgs.ClaimableOrganizationController.preview",
+        "operationId": "get /v1/organizations/claimable/preview",
         "parameters": [
           {
             "description": "",
@@ -18056,7 +18786,7 @@
     "/v1/organizations/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.delete",
+        "operationId": "delete /v1/organizations/{id}",
         "parameters": [
           {
             "description": "",
@@ -18082,7 +18812,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.show",
+        "operationId": "get /v1/organizations/{id}",
         "parameters": [
           {
             "description": "",
@@ -18125,7 +18855,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.update (2)",
+        "operationId": "patch /v1/organizations/{id}",
         "parameters": [
           {
             "description": "",
@@ -18179,7 +18909,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.update",
+        "operationId": "put /v1/organizations/{id}",
         "parameters": [
           {
             "description": "",
@@ -18236,7 +18966,7 @@
       "post": {
         "callbacks": {},
         "description": "El owner/admin envía los datos legales del negocio (razón social, tax id, email de contacto) y la organización pasa a estado `pending`. La aprueba/rechaza un admin de plataforma. Requiere el permiso `organizations:update`.",
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.request_verification",
+        "operationId": "post /v1/organizations/{id}/verification",
         "parameters": [
           {
             "description": "",
@@ -18303,7 +19033,7 @@
       "post": {
         "callbacks": {},
         "description": "Marca el negocio como `verified`. Requiere el permiso de plataforma `organizations:verify` (un owner NO puede autoverificarse).",
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.approve_verification",
+        "operationId": "post /v1/organizations/{id}/verification/approve",
         "parameters": [
           {
             "description": "",
@@ -18359,7 +19089,7 @@
       "post": {
         "callbacks": {},
         "description": "Marca el negocio como `rejected` con un motivo legible. Requiere `organizations:verify`.",
-        "operationId": "HablalaApiWeb.Orgs.OrganizationController.reject_verification",
+        "operationId": "post /v1/organizations/{id}/verification/reject",
         "parameters": [
           {
             "description": "",
@@ -18426,7 +19156,7 @@
       "get": {
         "callbacks": {},
         "description": "Los access tokens de máquina de la organización (solo metadatos; el secreto no se recupera).",
-        "operationId": "HablalaApiWeb.AccessTokens.TokenController.index",
+        "operationId": "get /v1/organizations/{organization_id}/access-tokens",
         "parameters": [
           {
             "description": "",
@@ -18460,7 +19190,7 @@
       "post": {
         "callbacks": {},
         "description": "Emite una credencial de máquina (`mat_…`) con la que un agente (Claude Code) o un script CI escribe el modelo de datos por HTTP. La respuesta incluye el secreto en claro UNA sola vez (`token`); guárdalo, no se puede recuperar. Los permisos se intersectan con los del creador (un token nunca puede más que quien lo emite).",
-        "operationId": "HablalaApiWeb.AccessTokens.TokenController.create",
+        "operationId": "post /v1/organizations/{organization_id}/access-tokens",
         "parameters": [
           {
             "description": "",
@@ -18527,7 +19257,7 @@
       "get": {
         "callbacks": {},
         "description": "Los conjuntos de permisos nombrados que la UI ofrece al emitir un token (lenguaje humano, sin permisos RBAC crudos). El `key` de un preset se manda como `preset` en el create.",
-        "operationId": "HablalaApiWeb.AccessTokens.TokenController.presets",
+        "operationId": "get /v1/organizations/{organization_id}/access-tokens/presets",
         "parameters": [
           {
             "description": "",
@@ -18563,7 +19293,7 @@
       "delete": {
         "callbacks": {},
         "description": "Revoca la credencial (irreversible). Las requests que la usen dejan de autenticar.",
-        "operationId": "HablalaApiWeb.AccessTokens.TokenController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/access-tokens/{id}",
         "parameters": [
           {
             "description": "",
@@ -18613,7 +19343,7 @@
       "get": {
         "callbacks": {},
         "description": "Los agentes activos de la organización.",
-        "operationId": "HablalaApiWeb.Agents.AgentController.index",
+        "operationId": "get /v1/organizations/{organization_id}/agents",
         "parameters": [
           {
             "description": "",
@@ -18657,7 +19387,7 @@
       "post": {
         "callbacks": {},
         "description": "Crea un agente por dato: su bot user (identidad de mensajería), su fila core y su proyección en el diccionario. El agent loop que lo corre es una definición de sistema.",
-        "operationId": "HablalaApiWeb.Agents.AgentController.create",
+        "operationId": "post /v1/organizations/{organization_id}/agents",
         "parameters": [
           {
             "description": "",
@@ -18724,7 +19454,7 @@
       "delete": {
         "callbacks": {},
         "description": "Soft-delete + revocación: el agente deja de correr (fail-closed) y su bot user se desactiva.",
-        "operationId": "HablalaApiWeb.Agents.AgentController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/agents/{id}",
         "parameters": [
           {
             "description": "",
@@ -18771,7 +19501,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Agents.AgentController.show",
+        "operationId": "get /v1/organizations/{organization_id}/agents/{id}",
         "parameters": [
           {
             "description": "",
@@ -18826,7 +19556,7 @@
       "patch": {
         "callbacks": {},
         "description": "Edita prompt/tools/modelo/permisos/nombre. El handle y la identidad no cambian.",
-        "operationId": "HablalaApiWeb.Agents.AgentController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/agents/{id}",
         "parameters": [
           {
             "description": "",
@@ -18892,7 +19622,7 @@
       "put": {
         "callbacks": {},
         "description": "Edita prompt/tools/modelo/permisos/nombre. El handle y la identidad no cambian.",
-        "operationId": "HablalaApiWeb.Agents.AgentController.update",
+        "operationId": "put /v1/organizations/{organization_id}/agents/{id}",
         "parameters": [
           {
             "description": "",
@@ -18956,11 +19686,88 @@
         ]
       }
     },
+    "/v1/organizations/{organization_id}/aggregate": {
+      "post": {
+        "callbacks": {},
+        "description": "Agrupa records por `dimensions` y calcula `measures` (count/sum/avg/min/max), bajo la misma gobernanza (RBAC + ABAC default-deny) que la lectura puntual. Reemplaza los reportes que serían RPCs de SQL por-tenant.",
+        "operationId": "post /v1/organizations/{organization_id}/aggregate",
+        "parameters": [
+          {
+            "description": "",
+            "in": "path",
+            "name": "organization_id",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "x-struct": null,
+              "x-validate": null
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AggregateQueryRequest"
+              }
+            }
+          },
+          "description": "Aggregation query",
+          "required": false
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AggregateResultResponse"
+                }
+              }
+            },
+            "description": "Grupos agregados"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Sin permiso"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Objeto desconocido"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Consulta inválida"
+          }
+        },
+        "summary": "Ejecutar una aggregation query",
+        "tags": [
+          "query"
+        ]
+      }
+    },
     "/v1/organizations/{organization_id}/api-keys": {
       "get": {
         "callbacks": {},
         "description": "Las API keys de la organización (solo metadatos; el secreto no se recupera).",
-        "operationId": "HablalaApiWeb.PublicApi.ApiKeyController.index",
+        "operationId": "get /v1/organizations/{organization_id}/api-keys",
         "parameters": [
           {
             "description": "",
@@ -18994,7 +19801,7 @@
       "post": {
         "callbacks": {},
         "description": "Emite el **par** de API keys del canal público en una operación: una **publishable** (`pk_`, client-side) y una **secret** (`sk_`, server-side). La respuesta incluye el secreto en claro de AMBAS una sola vez (`publishable.token`/`secret.token`); guárdalos, no se pueden recuperar. Es el flujo del panel: se muestran completos para copiar/pegar en el `.env` de la app cliente. `name` por defecto \"Default\".",
-        "operationId": "HablalaApiWeb.PublicApi.ApiKeyController.create",
+        "operationId": "post /v1/organizations/{organization_id}/api-keys",
         "parameters": [
           {
             "description": "",
@@ -19061,7 +19868,7 @@
       "delete": {
         "callbacks": {},
         "description": "Revoca la credencial (irreversible). Las requests que la usen dejan de autenticar.",
-        "operationId": "HablalaApiWeb.PublicApi.ApiKeyController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/api-keys/{id}",
         "parameters": [
           {
             "description": "",
@@ -19111,7 +19918,7 @@
       "post": {
         "callbacks": {},
         "description": "Rota la key (modelo Stripe *roll*): emite un reemplazo del mismo tipo y nombre y revoca la original de inmediato. La respuesta incluye el nuevo secreto en claro UNA sola vez (`token`); guárdalo. Las requests que usaban la key vieja dejan de autenticar.",
-        "operationId": "HablalaApiWeb.PublicApi.ApiKeyController.rotate",
+        "operationId": "post /v1/organizations/{organization_id}/api-keys/{id}/rotate",
         "parameters": [
           {
             "description": "",
@@ -19167,7 +19974,7 @@
     "/v1/organizations/{organization_id}/appointments": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.index",
+        "operationId": "get /v1/organizations/{organization_id}/appointments",
         "parameters": [
           {
             "description": "",
@@ -19233,7 +20040,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.create",
+        "operationId": "post /v1/organizations/{organization_id}/appointments",
         "parameters": [
           {
             "description": "",
@@ -19289,7 +20096,7 @@
     "/v1/organizations/{organization_id}/appointments/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.show",
+        "operationId": "get /v1/organizations/{organization_id}/appointments/{id}",
         "parameters": [
           {
             "description": "",
@@ -19345,7 +20152,7 @@
     "/v1/organizations/{organization_id}/appointments/{id}/cancel": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.cancel",
+        "operationId": "post /v1/organizations/{organization_id}/appointments/{id}/cancel",
         "parameters": [
           {
             "description": "",
@@ -19412,7 +20219,7 @@
     "/v1/organizations/{organization_id}/appointments/{id}/confirm": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.confirm",
+        "operationId": "post /v1/organizations/{organization_id}/appointments/{id}/confirm",
         "parameters": [
           {
             "description": "",
@@ -19469,7 +20276,7 @@
       "post": {
         "callbacks": {},
         "description": "Flag ortogonal al estado; la cita no libera su hueco.",
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.no_show",
+        "operationId": "post /v1/organizations/{organization_id}/appointments/{id}/no-show",
         "parameters": [
           {
             "description": "",
@@ -19527,7 +20334,7 @@
       "post": {
         "callbacks": {},
         "description": "Cancela la cita y crea una nueva enlazada, en una transacción: si el hueco nuevo está tomado, la original queda intacta.",
-        "operationId": "HablalaApiWeb.Scheduling.AppointmentController.reschedule",
+        "operationId": "post /v1/organizations/{organization_id}/appointments/{id}/reschedule",
         "parameters": [
           {
             "description": "",
@@ -19594,7 +20401,7 @@
     "/v1/organizations/{organization_id}/bookings": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.index",
+        "operationId": "get /v1/organizations/{organization_id}/bookings",
         "parameters": [
           {
             "description": "",
@@ -19671,7 +20478,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.create",
+        "operationId": "post /v1/organizations/{organization_id}/bookings",
         "parameters": [
           {
             "description": "",
@@ -19728,7 +20535,7 @@
       "get": {
         "callbacks": {},
         "description": "Derivado de las reservas bloqueantes (pending/reserved/picked_up), turnaround incluido. Lectura de conveniencia: la garantía real ante carreras es el constraint al crear.",
-        "operationId": "HablalaApiWeb.Bookings.BookingController.availability",
+        "operationId": "get /v1/organizations/{organization_id}/bookings/availability",
         "parameters": [
           {
             "description": "",
@@ -19817,7 +20624,7 @@
     "/v1/organizations/{organization_id}/bookings/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.show",
+        "operationId": "get /v1/organizations/{organization_id}/bookings/{id}",
         "parameters": [
           {
             "description": "",
@@ -19873,7 +20680,7 @@
     "/v1/organizations/{organization_id}/bookings/{id}/cancel": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.cancel",
+        "operationId": "post /v1/organizations/{organization_id}/bookings/{id}/cancel",
         "parameters": [
           {
             "description": "",
@@ -19929,7 +20736,7 @@
     "/v1/organizations/{organization_id}/bookings/{id}/pick-up": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.pick_up",
+        "operationId": "post /v1/organizations/{organization_id}/bookings/{id}/pick-up",
         "parameters": [
           {
             "description": "",
@@ -19985,7 +20792,7 @@
     "/v1/organizations/{organization_id}/bookings/{id}/reserve": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.reserve",
+        "operationId": "post /v1/organizations/{organization_id}/bookings/{id}/reserve",
         "parameters": [
           {
             "description": "",
@@ -20041,7 +20848,7 @@
     "/v1/organizations/{organization_id}/bookings/{id}/return": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Bookings.BookingController.return",
+        "operationId": "post /v1/organizations/{organization_id}/bookings/{id}/return",
         "parameters": [
           {
             "description": "",
@@ -20098,7 +20905,7 @@
       "get": {
         "callbacks": {},
         "description": "El estado real de lo declarable (objetos, workflows, agentes) como manifiesto. Es lo que `hablala pull`/`init` baja a archivos.",
-        "operationId": "HablalaApiWeb.Data.AccountConfigController.show",
+        "operationId": "get /v1/organizations/{organization_id}/config",
         "parameters": [
           {
             "description": "",
@@ -20142,7 +20949,7 @@
       "put": {
         "callbacks": {},
         "description": "Reconcilia el manifiesto contra la cuenta: crear / actualizar / archivar (nunca borrar), en UNA transacción síncrona. `?dry_run=true` devuelve el diff sin tocar nada (es lo que `hablala plan` llama). El mismo manifiesto dos veces = no-op (idempotencia estructural; el header `Idempotency-Key` se acepta por consistencia pero no hace falta deduplicar).",
-        "operationId": "HablalaApiWeb.Data.AccountConfigController.update",
+        "operationId": "put /v1/organizations/{organization_id}/config",
         "parameters": [
           {
             "description": "",
@@ -20230,7 +21037,7 @@
     "/v1/organizations/{organization_id}/conversations": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.index",
+        "operationId": "get /v1/organizations/{organization_id}/conversations",
         "parameters": [
           {
             "description": "",
@@ -20263,7 +21070,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.create",
+        "operationId": "post /v1/organizations/{organization_id}/conversations",
         "parameters": [
           {
             "description": "",
@@ -20320,7 +21127,7 @@
       "post": {
         "callbacks": {},
         "description": "Idempotente por conjunto de participantes (patrón estándar de mensajería): abrir un DM con las mismas personas —1:1 o grupo— reabre el existente en vez de duplicarlo.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.create_direct",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/direct",
         "parameters": [
           {
             "description": "",
@@ -20377,7 +21184,7 @@
       "post": {
         "callbacks": {},
         "description": "Flujo estándar de 'nueva conversación': el DM no existe para nadie hasta su primer mensaje. Resuelve el DM (idempotente por conjunto de miembros) y envía el mensaje en una sola operación; solo entonces la conversación aparece —en vivo— en el sidebar de todos sus miembros. Devuelve la conversación y el mensaje creado.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.create_direct_message",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/direct/messages",
         "parameters": [
           {
             "description": "",
@@ -20433,7 +21240,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/archive": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.unarchive",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/archive",
         "parameters": [
           {
             "description": "",
@@ -20477,7 +21284,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.archive",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/archive",
         "parameters": [
           {
             "description": "",
@@ -20524,7 +21331,7 @@
       "get": {
         "callbacks": {},
         "description": "Adjuntos de la conversación (imágenes/documentos), más recientes primero.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.media",
+        "operationId": "get /v1/organizations/{organization_id}/conversations/{conversation_id}/media",
         "parameters": [
           {
             "description": "",
@@ -20603,7 +21410,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/members": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.members",
+        "operationId": "get /v1/organizations/{organization_id}/conversations/{conversation_id}/members",
         "parameters": [
           {
             "description": "",
@@ -20658,7 +21465,7 @@
       "post": {
         "callbacks": {},
         "description": "Invita a un usuario del tenant a un canal (flujo estándar: crear y luego 'añadir personas'). Idempotente: si ya es miembro, devuelve la membresía existente.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.add_member",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/members",
         "parameters": [
           {
             "description": "",
@@ -20735,7 +21542,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/members/{user_id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.remove_member",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/members/{user_id}",
         "parameters": [
           {
             "description": "",
@@ -20795,7 +21602,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/members/{user_id}/ban": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.unban",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/members/{user_id}/ban",
         "parameters": [
           {
             "description": "",
@@ -20854,7 +21661,7 @@
       "post": {
         "callbacks": {},
         "description": "Solo admins (owner/admin). Bloquea al usuario: no puede volver ni ser re-agregado mientras el ban siga vigente. Sin `until` = permanente; con `until` (ISO 8601) = temporal.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.ban",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/members/{user_id}/ban",
         "parameters": [
           {
             "description": "",
@@ -20926,7 +21733,7 @@
       "patch": {
         "callbacks": {},
         "description": "Solo el owner. No se puede tocar al owner.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.change_role",
+        "operationId": "patch /v1/organizations/{organization_id}/conversations/{conversation_id}/members/{user_id}/role",
         "parameters": [
           {
             "description": "",
@@ -21004,7 +21811,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/messages": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MessageController.index",
+        "operationId": "get /v1/organizations/{organization_id}/conversations/{conversation_id}/messages",
         "parameters": [
           {
             "description": "",
@@ -21059,7 +21866,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MessageController.create",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/messages",
         "parameters": [
           {
             "description": "",
@@ -21126,7 +21933,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/messages/changes": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MessageController.changes",
+        "operationId": "get /v1/organizations/{organization_id}/conversations/{conversation_id}/messages/changes",
         "parameters": [
           {
             "description": "",
@@ -21193,7 +22000,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MessageController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{id}",
         "parameters": [
           {
             "description": "",
@@ -21251,7 +22058,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MessageController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{id}",
         "parameters": [
           {
             "description": "",
@@ -21327,7 +22134,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MessageController.update",
+        "operationId": "put /v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{id}",
         "parameters": [
           {
             "description": "",
@@ -21405,7 +22212,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{message_id}/reactions": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ReactionController.create",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{message_id}/reactions",
         "parameters": [
           {
             "description": "",
@@ -21476,7 +22283,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{message_id}/reactions/{emoji}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ReactionController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/messages/{message_id}/reactions/{emoji}",
         "parameters": [
           {
             "description": "",
@@ -21547,7 +22354,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/mute": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.unmute",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/mute",
         "parameters": [
           {
             "description": "",
@@ -21591,7 +22398,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.mute",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/mute",
         "parameters": [
           {
             "description": "",
@@ -21648,7 +22455,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/pin": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.unpin",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{conversation_id}/pin",
         "parameters": [
           {
             "description": "",
@@ -21692,7 +22499,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.pin",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/pin",
         "parameters": [
           {
             "description": "",
@@ -21738,7 +22545,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/read": {
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.mark_read",
+        "operationId": "put /v1/organizations/{organization_id}/conversations/{conversation_id}/read",
         "parameters": [
           {
             "description": "",
@@ -21788,7 +22595,7 @@
     "/v1/organizations/{organization_id}/conversations/{conversation_id}/report": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.report",
+        "operationId": "post /v1/organizations/{organization_id}/conversations/{conversation_id}/report",
         "parameters": [
           {
             "description": "",
@@ -21848,7 +22655,7 @@
     "/v1/organizations/{organization_id}/conversations/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/conversations/{id}",
         "parameters": [
           {
             "description": "",
@@ -21885,7 +22692,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.show",
+        "operationId": "get /v1/organizations/{organization_id}/conversations/{id}",
         "parameters": [
           {
             "description": "",
@@ -21940,7 +22747,7 @@
       "patch": {
         "callbacks": {},
         "description": "Solo admins (owner/admin). Los campos ausentes no se tocan.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/conversations/{id}",
         "parameters": [
           {
             "description": "",
@@ -22016,7 +22823,7 @@
       "put": {
         "callbacks": {},
         "description": "Solo admins (owner/admin). Los campos ausentes no se tocan.",
-        "operationId": "HablalaApiWeb.Messaging.ConversationController.update",
+        "operationId": "put /v1/organizations/{organization_id}/conversations/{id}",
         "parameters": [
           {
             "description": "",
@@ -22094,7 +22901,7 @@
       "get": {
         "callbacks": {},
         "description": "Los dominios propios solicitados por la organización, con su estado de verificación.",
-        "operationId": "HablalaApiWeb.Domains.CustomDomainController.index",
+        "operationId": "get /v1/organizations/{organization_id}/domains",
         "parameters": [
           {
             "description": "",
@@ -22128,7 +22935,7 @@
       "post": {
         "callbacks": {},
         "description": "Registra un dominio para la organización en estado `pending` y arranca el workflow de verificación (aprovisiona en el proveedor → verifica DNS → emite TLS → activa). La respuesta incluye el reto DNS que el cliente debe publicar (cuando el proveedor lo emite).",
-        "operationId": "HablalaApiWeb.Domains.CustomDomainController.create",
+        "operationId": "post /v1/organizations/{organization_id}/domains",
         "parameters": [
           {
             "description": "",
@@ -22195,7 +23002,7 @@
       "delete": {
         "callbacks": {},
         "description": "Des-aprovisiona el dominio en el proveedor y lo borra.",
-        "operationId": "HablalaApiWeb.Domains.CustomDomainController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/domains/{id}",
         "parameters": [
           {
             "description": "",
@@ -22242,7 +23049,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Domains.CustomDomainController.show",
+        "operationId": "get /v1/organizations/{organization_id}/domains/{id}",
         "parameters": [
           {
             "description": "",
@@ -22299,7 +23106,7 @@
       "post": {
         "callbacks": {},
         "description": "Conecta dos records vía un tipo de relación (`relationship` = slug). Idempotente: crear la misma arista dos veces no falla.",
-        "operationId": "HablalaApiWeb.Data.EdgeController.create",
+        "operationId": "post /v1/organizations/{organization_id}/edges",
         "parameters": [
           {
             "description": "",
@@ -22365,7 +23172,7 @@
     "/v1/organizations/{organization_id}/edges/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.EdgeController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/edges/{id}",
         "parameters": [
           {
             "description": "",
@@ -22405,7 +23212,7 @@
       "post": {
         "callbacks": {},
         "description": "Devuelve el grafo de datos del tenant como `nodes` + `edges` planos (knowledge graph), acotado por `limit` y ordenado por grado desc (los nodos más conectados primero). Filtra por el ABAC del scope. Base de la vista de grafo global.",
-        "operationId": "HablalaApiWeb.Data.GraphController.overview",
+        "operationId": "post /v1/organizations/{organization_id}/graph",
         "parameters": [
           {
             "description": "",
@@ -22462,7 +23269,7 @@
       "post": {
         "callbacks": {},
         "description": "Devuelve el vecindario de un nodo — sus vecinos directos (1 salto) + las aristas que los unen — como `nodes` + `edges`. Es el *expand-on-demand* (progressive disclosure) para explorar el grafo sin cargarlo entero.",
-        "operationId": "HablalaApiWeb.Data.GraphController.expand",
+        "operationId": "post /v1/organizations/{organization_id}/graph/expand",
         "parameters": [
           {
             "description": "",
@@ -22528,7 +23335,7 @@
     "/v1/organizations/{organization_id}/invitations": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.index",
+        "operationId": "get /v1/organizations/{organization_id}/invitations",
         "parameters": [
           {
             "description": "",
@@ -22572,7 +23379,7 @@
       "post": {
         "callbacks": {},
         "description": "Dos modalidades según el cuerpo:\n\n* `{ \"invitation\": { \"email\": \"…\", \"roleId\": \"role_…\" } }` — invitación por **correo** (o para reenviar/onboarding de equipo). Se acepta canjeando el token del email.\n* `{ \"invitation\": { \"userId\": \"user_…\", \"roleId\": \"role_…\" } }` — invitación **dirigida** a un usuario ya existente (encontrado por su username en el buscador). Le llega a su bandeja (`GET /me/invitations`) y la acepta/rechaza desde la app: NO se le añade sin consentimiento (patrón *message request*, doctrina anti-spam).",
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.create",
+        "operationId": "post /v1/organizations/{organization_id}/invitations",
         "parameters": [
           {
             "description": "",
@@ -22649,7 +23456,7 @@
       "post": {
         "callbacks": {},
         "description": "Crea (o reenvía) invitaciones para una lista de emails, todos con el mismo rol opcional. No es todo-o-nada: cada email se procesa aparte y su resultado se refleja por separado (`sent` / `already` / `invalid`).",
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.bulk",
+        "operationId": "post /v1/organizations/{organization_id}/invitations/bulk",
         "parameters": [
           {
             "description": "",
@@ -22715,7 +23522,7 @@
     "/v1/organizations/{organization_id}/invitations/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/invitations/{id}",
         "parameters": [
           {
             "description": "",
@@ -22762,7 +23569,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.InvitationController.show",
+        "operationId": "get /v1/organizations/{organization_id}/invitations/{id}",
         "parameters": [
           {
             "description": "",
@@ -22818,7 +23625,7 @@
     "/v1/organizations/{organization_id}/invite-link": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.InviteLinkController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/invite-link",
         "parameters": [
           {
             "description": "",
@@ -22855,7 +23662,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve el link activo, creándolo si no existe (lazy). El secreto en claro (`url`) solo viaja cuando se acaba de crear; en llamadas siguientes se devuelve el link sin el claro (que no se puede recuperar).",
-        "operationId": "HablalaApiWeb.Orgs.InviteLinkController.show",
+        "operationId": "get /v1/organizations/{organization_id}/invite-link",
         "parameters": [
           {
             "description": "",
@@ -22901,7 +23708,7 @@
       "post": {
         "callbacks": {},
         "description": "Revoca el link activo (si hay) y crea uno nuevo. El secreto anterior deja de canjear al instante; el nuevo claro (`url`) viaja en la respuesta.",
-        "operationId": "HablalaApiWeb.Orgs.InviteLinkController.rotate",
+        "operationId": "post /v1/organizations/{organization_id}/invite-link/rotate",
         "parameters": [
           {
             "description": "",
@@ -22946,7 +23753,7 @@
     "/v1/organizations/{organization_id}/invoices": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.index",
+        "operationId": "get /v1/organizations/{organization_id}/invoices",
         "parameters": [
           {
             "description": "",
@@ -22990,7 +23797,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.create",
+        "operationId": "post /v1/organizations/{organization_id}/invoices",
         "parameters": [
           {
             "description": "",
@@ -23046,7 +23853,7 @@
     "/v1/organizations/{organization_id}/invoices/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/invoices/{id}",
         "parameters": [
           {
             "description": "",
@@ -23093,7 +23900,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.show",
+        "operationId": "get /v1/organizations/{organization_id}/invoices/{id}",
         "parameters": [
           {
             "description": "",
@@ -23147,7 +23954,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/invoices/{id}",
         "parameters": [
           {
             "description": "",
@@ -23212,7 +24019,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.update",
+        "operationId": "put /v1/organizations/{organization_id}/invoices/{id}",
         "parameters": [
           {
             "description": "",
@@ -23279,7 +24086,7 @@
     "/v1/organizations/{organization_id}/invoices/{id}/finalize": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.finalize",
+        "operationId": "post /v1/organizations/{organization_id}/invoices/{id}/finalize",
         "parameters": [
           {
             "description": "",
@@ -23335,7 +24142,7 @@
     "/v1/organizations/{organization_id}/invoices/{id}/mark-uncollectible": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.mark_uncollectible",
+        "operationId": "post /v1/organizations/{organization_id}/invoices/{id}/mark-uncollectible",
         "parameters": [
           {
             "description": "",
@@ -23391,7 +24198,7 @@
     "/v1/organizations/{organization_id}/invoices/{id}/void": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.void",
+        "operationId": "post /v1/organizations/{organization_id}/invoices/{id}/void",
         "parameters": [
           {
             "description": "",
@@ -23447,7 +24254,7 @@
     "/v1/organizations/{organization_id}/invoices/{invoice_id}/line-items": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.add_line_item",
+        "operationId": "post /v1/organizations/{organization_id}/invoices/{invoice_id}/line-items",
         "parameters": [
           {
             "description": "",
@@ -23514,7 +24321,7 @@
     "/v1/organizations/{organization_id}/invoices/{invoice_id}/line-items/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.remove_line_item",
+        "operationId": "delete /v1/organizations/{organization_id}/invoices/{invoice_id}/line-items/{id}",
         "parameters": [
           {
             "description": "",
@@ -23572,7 +24379,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.InvoiceController.update_line_item",
+        "operationId": "patch /v1/organizations/{organization_id}/invoices/{invoice_id}/line-items/{id}",
         "parameters": [
           {
             "description": "",
@@ -23650,7 +24457,7 @@
     "/v1/organizations/{organization_id}/locations": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.LocationController.index",
+        "operationId": "get /v1/organizations/{organization_id}/locations",
         "parameters": [
           {
             "description": "",
@@ -23683,7 +24490,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.LocationController.create",
+        "operationId": "post /v1/organizations/{organization_id}/locations",
         "parameters": [
           {
             "description": "",
@@ -23740,7 +24547,7 @@
       "post": {
         "callbacks": {},
         "description": "Crea, si no existen, la internal inicial (Almacén) y las tres virtuales (Proveedores, Clientes, Ajustes de inventario) que balancean la doble entrada.",
-        "operationId": "HablalaApiWeb.Inventory.LocationController.ensure_defaults",
+        "operationId": "post /v1/organizations/{organization_id}/locations/ensure-defaults",
         "parameters": [
           {
             "description": "",
@@ -23775,7 +24582,7 @@
     "/v1/organizations/{organization_id}/locations/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.LocationController.show",
+        "operationId": "get /v1/organizations/{organization_id}/locations/{id}",
         "parameters": [
           {
             "description": "",
@@ -23829,7 +24636,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.LocationController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/locations/{id}",
         "parameters": [
           {
             "description": "",
@@ -23894,7 +24701,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.LocationController.update",
+        "operationId": "put /v1/organizations/{organization_id}/locations/{id}",
         "parameters": [
           {
             "description": "",
@@ -23961,7 +24768,7 @@
     "/v1/organizations/{organization_id}/mentions": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Messaging.MentionController.index",
+        "operationId": "get /v1/organizations/{organization_id}/mentions",
         "parameters": [
           {
             "description": "",
@@ -23997,7 +24804,7 @@
       "post": {
         "callbacks": {},
         "description": "La web lo llama al aprobar `…/oauth/authorize`: crea el grant aprobado y devuelve el `code` de un solo uso que el navegador reenvía al CLI vía redirect a `127.0.0.1`.",
-        "operationId": "HablalaApiWeb.Oauth.GrantController.create",
+        "operationId": "post /v1/organizations/{organization_id}/oauth/grants",
         "parameters": [
           {
             "description": "",
@@ -24064,7 +24871,7 @@
       "post": {
         "callbacks": {},
         "description": "El consent: fija la organización del path y los permisos elegidos (intersectados con los del aprobador) en el grant. El CLI que sondea recibirá su `mat_…` en el siguiente poll.",
-        "operationId": "HablalaApiWeb.Oauth.GrantController.approve",
+        "operationId": "post /v1/organizations/{organization_id}/oauth/grants/{user_code}/approve",
         "parameters": [
           {
             "description": "",
@@ -24151,7 +24958,7 @@
     "/v1/organizations/{organization_id}/objects": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.ObjectController.index",
+        "operationId": "get /v1/organizations/{organization_id}/objects",
         "parameters": [
           {
             "description": "",
@@ -24184,7 +24991,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.ObjectController.create",
+        "operationId": "post /v1/organizations/{organization_id}/objects",
         "parameters": [
           {
             "description": "",
@@ -24241,7 +25048,7 @@
       "delete": {
         "callbacks": {},
         "description": "Soft delete: marca `isArchived` en vez de borrar (los records persisten).",
-        "operationId": "HablalaApiWeb.Data.ObjectController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -24278,7 +25085,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.ObjectController.show",
+        "operationId": "get /v1/organizations/{organization_id}/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -24332,7 +25139,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.ObjectController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -24397,7 +25204,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.ObjectController.update",
+        "operationId": "put /v1/organizations/{organization_id}/objects/{id}",
         "parameters": [
           {
             "description": "",
@@ -24464,7 +25271,7 @@
     "/v1/organizations/{organization_id}/objects/{object_id}/attributes": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.AttributeController.index",
+        "operationId": "get /v1/organizations/{organization_id}/objects/{object_id}/attributes",
         "parameters": [
           {
             "description": "",
@@ -24508,7 +25315,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.AttributeController.create",
+        "operationId": "post /v1/organizations/{organization_id}/objects/{object_id}/attributes",
         "parameters": [
           {
             "description": "",
@@ -24575,7 +25382,7 @@
     "/v1/organizations/{organization_id}/objects/{object_id}/attributes/{id}": {
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.AttributeController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/objects/{object_id}/attributes/{id}",
         "parameters": [
           {
             "description": "",
@@ -24651,7 +25458,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.AttributeController.update",
+        "operationId": "put /v1/organizations/{organization_id}/objects/{object_id}/attributes/{id}",
         "parameters": [
           {
             "description": "",
@@ -24729,7 +25536,7 @@
     "/v1/organizations/{organization_id}/objects/{object_slug}/records": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RecordController.create",
+        "operationId": "post /v1/organizations/{organization_id}/objects/{object_slug}/records",
         "parameters": [
           {
             "description": "",
@@ -24807,7 +25614,7 @@
       "get": {
         "callbacks": {},
         "description": "Lista los records SOFT-DELETED del objeto (`deleted_at IS NOT NULL`), para restaurarlos. Misma lectura gobernada que `POST /query` (RBAC + ABAC por fila + field_mask + paginación keyset), sobre el otro lado de `deleted_at`. Gate RBAC: `records:delete`.",
-        "operationId": "HablalaApiWeb.Data.RecordController.trash",
+        "operationId": "get /v1/organizations/{organization_id}/objects/{object_slug}/records/trash",
         "parameters": [
           {
             "description": "",
@@ -24895,7 +25702,7 @@
     "/v1/organizations/{organization_id}/objects/{object_slug}/records/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RecordController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -24963,7 +25770,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RecordController.show",
+        "operationId": "get /v1/organizations/{organization_id}/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -25038,7 +25845,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RecordController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -25134,7 +25941,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RecordController.update",
+        "operationId": "put /v1/organizations/{organization_id}/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -25233,7 +26040,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve cuántos edges se desvincularían y qué referencias core BLOQUEARÍAN el borrado (restrict-on-delete), sin mutar nada. Alimenta la confirmación dependent-aware de la UI. Misma fuente que el guard del borrado real, así que preview y borrado no divergen. Gate `records:delete` + ABAC de escritura por fila.",
-        "operationId": "HablalaApiWeb.Data.RecordController.dependencies",
+        "operationId": "get /v1/organizations/{organization_id}/objects/{object_slug}/records/{record_id}/dependencies",
         "parameters": [
           {
             "description": "",
@@ -25310,7 +26117,7 @@
     "/v1/organizations/{organization_id}/objects/{object_slug}/records/{record_id}/events": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.EventController.index",
+        "operationId": "get /v1/organizations/{organization_id}/objects/{object_slug}/records/{record_id}/events",
         "parameters": [
           {
             "description": "",
@@ -25367,7 +26174,7 @@
     "/v1/organizations/{organization_id}/objects/{object_slug}/records/{record_id}/restore": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RecordController.restore",
+        "operationId": "post /v1/organizations/{organization_id}/objects/{object_slug}/records/{record_id}/restore",
         "parameters": [
           {
             "description": "",
@@ -25454,7 +26261,7 @@
     "/v1/organizations/{organization_id}/organization_membership": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.leave",
+        "operationId": "delete /v1/organizations/{organization_id}/organization_membership",
         "parameters": [
           {
             "description": "",
@@ -25492,7 +26299,7 @@
     "/v1/organizations/{organization_id}/organization_memberships": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.index",
+        "operationId": "get /v1/organizations/{organization_id}/organization_memberships",
         "parameters": [
           {
             "description": "",
@@ -25538,7 +26345,7 @@
       "get": {
         "callbacks": {},
         "description": "Paridad con el descubrimiento personal (`/v1/me/people/lookup`): resuelve un miembro del tenant por email exacto sin listar a todos. Devuelve `data: null` si nadie coincide.",
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.lookup",
+        "operationId": "get /v1/organizations/{organization_id}/organization_memberships/lookup",
         "parameters": [
           {
             "description": "",
@@ -25584,7 +26391,7 @@
     "/v1/organizations/{organization_id}/organization_memberships/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/organization_memberships/{id}",
         "parameters": [
           {
             "description": "",
@@ -25631,7 +26438,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.show",
+        "operationId": "get /v1/organizations/{organization_id}/organization_memberships/{id}",
         "parameters": [
           {
             "description": "",
@@ -25686,7 +26493,7 @@
       "patch": {
         "callbacks": {},
         "description": "Perfil por-organización: nombre visible, puesto, avatar y estado. Editar el propio siempre se permite; el de otro miembro requiere `organization_memberships:update`.",
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/organization_memberships/{id}",
         "parameters": [
           {
             "description": "",
@@ -25762,7 +26569,7 @@
       "put": {
         "callbacks": {},
         "description": "Perfil por-organización: nombre visible, puesto, avatar y estado. Editar el propio siempre se permite; el de otro miembro requiere `organization_memberships:update`.",
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.update",
+        "operationId": "put /v1/organizations/{organization_id}/organization_memberships/{id}",
         "parameters": [
           {
             "description": "",
@@ -25840,7 +26647,7 @@
       "put": {
         "callbacks": {},
         "description": "Acción de administración (requiere `organization_memberships:update`). Semántica PUT: la membresía queda con exactamente los roles indicados. Los ids de rol de otra organización se ignoran.",
-        "operationId": "HablalaApiWeb.Orgs.MembershipController.update_roles",
+        "operationId": "put /v1/organizations/{organization_id}/organization_memberships/{membership_id}/roles",
         "parameters": [
           {
             "description": "",
@@ -25917,7 +26724,7 @@
     "/v1/organizations/{organization_id}/payments": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.PaymentController.index",
+        "operationId": "get /v1/organizations/{organization_id}/payments",
         "parameters": [
           {
             "description": "",
@@ -25961,7 +26768,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.PaymentController.create",
+        "operationId": "post /v1/organizations/{organization_id}/payments",
         "parameters": [
           {
             "description": "",
@@ -26028,7 +26835,7 @@
     "/v1/organizations/{organization_id}/payments/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.PaymentController.show",
+        "operationId": "get /v1/organizations/{organization_id}/payments/{id}",
         "parameters": [
           {
             "description": "",
@@ -26084,7 +26891,7 @@
     "/v1/organizations/{organization_id}/payments/{id}/attach": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.PaymentController.attach",
+        "operationId": "post /v1/organizations/{organization_id}/payments/{id}/attach",
         "parameters": [
           {
             "description": "",
@@ -26151,7 +26958,7 @@
     "/v1/organizations/{organization_id}/payments/{id}/cancel": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.PaymentController.cancel",
+        "operationId": "post /v1/organizations/{organization_id}/payments/{id}/cancel",
         "parameters": [
           {
             "description": "",
@@ -26207,7 +27014,7 @@
     "/v1/organizations/{organization_id}/payments/{id}/succeed": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Invoicing.PaymentController.succeed",
+        "operationId": "post /v1/organizations/{organization_id}/payments/{id}/succeed",
         "parameters": [
           {
             "description": "",
@@ -26264,7 +27071,7 @@
       "get": {
         "callbacks": {},
         "description": "El conjunto completo de permisos posibles (`recurso:accion`) que puede tener un rol. Lo consume el editor de roles para pintar cada toggle on/off.",
-        "operationId": "HablalaApiWeb.Orgs.RoleController.permissions",
+        "operationId": "get /v1/organizations/{organization_id}/permissions",
         "parameters": [
           {
             "description": "",
@@ -26309,7 +27116,7 @@
     "/v1/organizations/{organization_id}/policies": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.PolicyController.index",
+        "operationId": "get /v1/organizations/{organization_id}/policies",
         "parameters": [
           {
             "description": "",
@@ -26352,7 +27159,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.PolicyController.create",
+        "operationId": "post /v1/organizations/{organization_id}/policies",
         "parameters": [
           {
             "description": "",
@@ -26418,7 +27225,7 @@
     "/v1/organizations/{organization_id}/policies/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.PolicyController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -26465,7 +27272,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.PolicyController.show",
+        "operationId": "get /v1/organizations/{organization_id}/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -26519,7 +27326,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.PolicyController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -26584,7 +27391,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.PolicyController.update",
+        "operationId": "put /v1/organizations/{organization_id}/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -26652,7 +27459,7 @@
       "post": {
         "callbacks": {},
         "description": "Compila una consulta lógica (object/select/where/include/semantic/order_by) a SQL con permisos inyectados y devuelve las filas mapeadas a slugs. Único camino de lectura rica.",
-        "operationId": "HablalaApiWeb.Data.QueryController.create",
+        "operationId": "post /v1/organizations/{organization_id}/query",
         "parameters": [
           {
             "description": "",
@@ -26728,7 +27535,7 @@
     "/v1/organizations/{organization_id}/relationships": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RelationshipController.index",
+        "operationId": "get /v1/organizations/{organization_id}/relationships",
         "parameters": [
           {
             "description": "",
@@ -26761,7 +27568,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RelationshipController.create",
+        "operationId": "post /v1/organizations/{organization_id}/relationships",
         "parameters": [
           {
             "description": "",
@@ -26817,7 +27624,7 @@
     "/v1/organizations/{organization_id}/relationships/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Data.RelationshipController.show",
+        "operationId": "get /v1/organizations/{organization_id}/relationships/{id}",
         "parameters": [
           {
             "description": "",
@@ -26873,7 +27680,7 @@
     "/v1/organizations/{organization_id}/roles": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.RoleController.index",
+        "operationId": "get /v1/organizations/{organization_id}/roles",
         "parameters": [
           {
             "description": "",
@@ -26916,7 +27723,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.RoleController.create",
+        "operationId": "post /v1/organizations/{organization_id}/roles",
         "parameters": [
           {
             "description": "",
@@ -26982,7 +27789,7 @@
     "/v1/organizations/{organization_id}/roles/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.RoleController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/roles/{id}",
         "parameters": [
           {
             "description": "",
@@ -27029,7 +27836,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.RoleController.show",
+        "operationId": "get /v1/organizations/{organization_id}/roles/{id}",
         "parameters": [
           {
             "description": "",
@@ -27083,7 +27890,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.RoleController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/roles/{id}",
         "parameters": [
           {
             "description": "",
@@ -27148,7 +27955,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Orgs.RoleController.update",
+        "operationId": "put /v1/organizations/{organization_id}/roles/{id}",
         "parameters": [
           {
             "description": "",
@@ -27215,7 +28022,7 @@
     "/v1/organizations/{organization_id}/schedules": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.index",
+        "operationId": "get /v1/organizations/{organization_id}/schedules",
         "parameters": [
           {
             "description": "",
@@ -27258,7 +28065,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.create",
+        "operationId": "post /v1/organizations/{organization_id}/schedules",
         "parameters": [
           {
             "description": "",
@@ -27314,7 +28121,7 @@
     "/v1/organizations/{organization_id}/schedules/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/schedules/{id}",
         "parameters": [
           {
             "description": "",
@@ -27351,7 +28158,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.show",
+        "operationId": "get /v1/organizations/{organization_id}/schedules/{id}",
         "parameters": [
           {
             "description": "",
@@ -27405,7 +28212,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/schedules/{id}",
         "parameters": [
           {
             "description": "",
@@ -27470,7 +28277,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.update",
+        "operationId": "put /v1/organizations/{organization_id}/schedules/{id}",
         "parameters": [
           {
             "description": "",
@@ -27537,7 +28344,7 @@
     "/v1/organizations/{organization_id}/schedules/{schedule_id}/availabilities": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.add_availability",
+        "operationId": "post /v1/organizations/{organization_id}/schedules/{schedule_id}/availabilities",
         "parameters": [
           {
             "description": "",
@@ -27604,7 +28411,7 @@
     "/v1/organizations/{organization_id}/schedules/{schedule_id}/availabilities/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Scheduling.ScheduleController.remove_availability",
+        "operationId": "delete /v1/organizations/{organization_id}/schedules/{schedule_id}/availabilities/{id}",
         "parameters": [
           {
             "description": "",
@@ -27654,7 +28461,7 @@
     "/v1/organizations/{organization_id}/stock-movements": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.StockMovementController.index",
+        "operationId": "get /v1/organizations/{organization_id}/stock-movements",
         "parameters": [
           {
             "description": "",
@@ -27731,7 +28538,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.StockMovementController.create",
+        "operationId": "post /v1/organizations/{organization_id}/stock-movements",
         "parameters": [
           {
             "description": "",
@@ -27798,7 +28605,7 @@
     "/v1/organizations/{organization_id}/stock-movements/adjust": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.StockMovementController.adjust",
+        "operationId": "post /v1/organizations/{organization_id}/stock-movements/adjust",
         "parameters": [
           {
             "description": "",
@@ -27854,7 +28661,7 @@
     "/v1/organizations/{organization_id}/stock-movements/levels": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.StockMovementController.stock_levels",
+        "operationId": "get /v1/organizations/{organization_id}/stock-movements/levels",
         "parameters": [
           {
             "description": "",
@@ -27900,7 +28707,7 @@
     "/v1/organizations/{organization_id}/stock-movements/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Inventory.StockMovementController.show",
+        "operationId": "get /v1/organizations/{organization_id}/stock-movements/{id}",
         "parameters": [
           {
             "description": "",
@@ -27957,7 +28764,7 @@
       "post": {
         "callbacks": {},
         "description": "Devuelve un sobre auto-descriptivo para subir un archivo directo al object storage. Según `method`: `POST` → form multipart con `fields` + el archivo como campo `file` (S3/R2 POST policy, con tope de tamaño firmado en el borde); `PUT` → PUT del blob a `url` con `headers` (adaptador local de dev). Luego se referencia `fileUrl`. (El camino personal usa `HablalaApiWeb.Me.UploadController` en `/v1/me/uploads/presign`.)",
-        "operationId": "HablalaApiWeb.UploadController.presign",
+        "operationId": "post /v1/organizations/{organization_id}/uploads/presign",
         "parameters": [
           {
             "description": "",
@@ -28014,7 +28821,7 @@
       "get": {
         "callbacks": {},
         "description": "Los webhook endpoints de la organización (solo metadatos; el signing secret se obtiene con `GET .../:id/secret`).",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.index",
+        "operationId": "get /v1/organizations/{organization_id}/webhooks",
         "parameters": [
           {
             "description": "",
@@ -28048,7 +28855,7 @@
       "post": {
         "callbacks": {},
         "description": "Suscribe una URL a eventos del event store. La plataforma genera el **signing secret** (`whsec_…`) y lo incluye en esta respuesta (`secret`); con él el receptor verifica la firma de cada entrega (spec Standard Webhooks). También puede recuperarse después con `GET .../:id/secret`.",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.create",
+        "operationId": "post /v1/organizations/{organization_id}/webhooks",
         "parameters": [
           {
             "description": "",
@@ -28115,7 +28922,7 @@
       "delete": {
         "callbacks": {},
         "description": "Elimina el endpoint y su historial de deliveries. Deja de recibir entregas.",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -28162,7 +28969,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.show",
+        "operationId": "get /v1/organizations/{organization_id}/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -28217,7 +29024,7 @@
       "patch": {
         "callbacks": {},
         "description": "Cambia `url`/`enabledEvents`/`status`. Reactivar (`status: \"enabled\"`) un endpoint auto-deshabilitado limpia el motivo del disable. El slug y el secret no se tocan aquí.",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -28283,7 +29090,7 @@
       "put": {
         "callbacks": {},
         "description": "Cambia `url`/`enabledEvents`/`status`. Reactivar (`status: \"enabled\"`) un endpoint auto-deshabilitado limpia el motivo del disable. El slug y el secret no se tocan aquí.",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.update",
+        "operationId": "put /v1/organizations/{organization_id}/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -28351,7 +29158,7 @@
       "get": {
         "callbacks": {},
         "description": "La bitácora de entregas (canónico GitHub): qué eventos se entregaron, cuántos intentos costaron y con qué respondió el receptor. Más recientes primero (máx. 50).",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.deliveries",
+        "operationId": "get /v1/organizations/{organization_id}/webhooks/{id}/deliveries",
         "parameters": [
           {
             "description": "",
@@ -28398,7 +29205,7 @@
       "post": {
         "callbacks": {},
         "description": "Genera un `whsec_…` nuevo para el MISMO endpoint (el historial no cambia). El secret viejo deja de firmar de inmediato: actualiza la copia del receptor. La respuesta incluye el nuevo secret.",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.rotate",
+        "operationId": "post /v1/organizations/{organization_id}/webhooks/{id}/rotate",
         "parameters": [
           {
             "description": "",
@@ -28445,7 +29252,7 @@
       "get": {
         "callbacks": {},
         "description": "El `whsec_…` del endpoint, para configurarlo en el receptor (modelo Svix `GET .../secret` / Stripe dashboard \"Reveal\"). Es una llave de firma compartida, no una credencial de autenticación entrante: por eso es recuperable, a diferencia de `sk_`/`mat_`.",
-        "operationId": "HablalaApiWeb.Webhooks.WebhookController.secret",
+        "operationId": "get /v1/organizations/{organization_id}/webhooks/{id}/secret",
         "parameters": [
           {
             "description": "",
@@ -28492,7 +29299,7 @@
       "get": {
         "callbacks": {},
         "description": "Corridas de la organización, más recientes primero (máx. 50).",
-        "operationId": "HablalaApiWeb.Workflows.WorkflowExecutionController.index",
+        "operationId": "get /v1/organizations/{organization_id}/workflow-executions",
         "parameters": [
           {
             "description": "",
@@ -28559,7 +29366,7 @@
     "/v1/organizations/{organization_id}/workflow-executions/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Workflows.WorkflowExecutionController.show",
+        "operationId": "get /v1/organizations/{organization_id}/workflow-executions/{id}",
         "parameters": [
           {
             "description": "",
@@ -28616,7 +29423,7 @@
       "post": {
         "callbacks": {},
         "description": "Entrega una señal externa a una ejecución detenida en un estado de espera (patrón human task, ADR-017). Requiere `workflows:signal`; si el estado de espera declara la tarea (`task_key`), además se evalúa la policy ABAC `signal` sobre ese record. La ejecución avanza de forma asíncrona: la respuesta confirma la entrega del signal.",
-        "operationId": "HablalaApiWeb.Workflows.WorkflowExecutionController.signal",
+        "operationId": "post /v1/organizations/{organization_id}/workflow-executions/{id}/signals",
         "parameters": [
           {
             "description": "",
@@ -28714,7 +29521,7 @@
       "get": {
         "callbacks": {},
         "description": "Todas las definiciones de la organización (incluye archivadas).",
-        "operationId": "HablalaApiWeb.Workflows.WorkflowDefinitionController.index",
+        "operationId": "get /v1/organizations/{organization_id}/workflows",
         "parameters": [
           {
             "description": "",
@@ -28757,7 +29564,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Workflows.WorkflowDefinitionController.create",
+        "operationId": "post /v1/organizations/{organization_id}/workflows",
         "parameters": [
           {
             "description": "",
@@ -28824,7 +29631,7 @@
       "delete": {
         "callbacks": {},
         "description": "Soft-delete: marca la definición como archivada. Deja de disparar triggers nuevos; sus ejecuciones históricas se conservan.",
-        "operationId": "HablalaApiWeb.Workflows.WorkflowDefinitionController.delete",
+        "operationId": "delete /v1/organizations/{organization_id}/workflows/{id}",
         "parameters": [
           {
             "description": "",
@@ -28871,7 +29678,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Workflows.WorkflowDefinitionController.show",
+        "operationId": "get /v1/organizations/{organization_id}/workflows/{id}",
         "parameters": [
           {
             "description": "",
@@ -28925,7 +29732,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Workflows.WorkflowDefinitionController.update (2)",
+        "operationId": "patch /v1/organizations/{organization_id}/workflows/{id}",
         "parameters": [
           {
             "description": "",
@@ -28990,7 +29797,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Workflows.WorkflowDefinitionController.update",
+        "operationId": "put /v1/organizations/{organization_id}/workflows/{id}",
         "parameters": [
           {
             "description": "",
@@ -29057,7 +29864,7 @@
     "/v1/policies": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.PolicyController.index",
+        "operationId": "get /v1/policies",
         "parameters": [],
         "responses": {
           "200": {
@@ -29088,7 +29895,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.PolicyController.create",
+        "operationId": "post /v1/policies",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -29142,7 +29949,7 @@
     "/v1/policies/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.PolicyController.delete",
+        "operationId": "delete /v1/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -29178,7 +29985,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.PolicyController.show",
+        "operationId": "get /v1/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -29221,7 +30028,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.PolicyController.update (2)",
+        "operationId": "patch /v1/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -29275,7 +30082,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.PolicyController.update",
+        "operationId": "put /v1/policies/{id}",
         "parameters": [
           {
             "description": "",
@@ -29328,11 +30135,91 @@
         ]
       }
     },
+    "/v1/public/aggregate": {
+      "post": {
+        "callbacks": {},
+        "description": "Agrupa records por `dimensions` y calcula `measures` (count/sum/avg/min/max), autenticado por una API key. Bajo el MISMO default-deny que la lectura: solo agrega lo que las policies exponen al principal `public`/`end_user`.",
+        "operationId": "post /v1/public/aggregate",
+        "parameters": [],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AggregateQueryRequest"
+              }
+            }
+          },
+          "description": "Aggregation query",
+          "required": false
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AggregateResultResponse"
+                }
+              }
+            },
+            "description": "Grupos agregados"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Token inválido"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Sin permiso"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Objeto o tenant desconocido"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Consulta inválida"
+          }
+        },
+        "security": [
+          {
+            "apiKey": []
+          }
+        ],
+        "summary": "Agregar por la Data API pública (reportes)",
+        "tags": [
+          "public"
+        ]
+      }
+    },
     "/v1/public/end-users": {
       "post": {
         "callbacks": {},
         "description": "Crea el record `customer` y su credencial de login (email + password), y devuelve un end-user session token (`sess_…`). Si la request trae un end-user session token anónimo, la sesión se identifica (merge del carrito). La organización sale de la API key.",
-        "operationId": "HablalaApiWeb.PublicApi.EndUserSessionController.register",
+        "operationId": "post /v1/public/end-users",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -29402,7 +30289,7 @@
       "delete": {
         "callbacks": {},
         "description": "Revoca el end-user session token de la request. Idempotente.",
-        "operationId": "HablalaApiWeb.PublicApi.EndUserSessionController.delete",
+        "operationId": "delete /v1/public/end-users/session",
         "parameters": [],
         "responses": {
           "204": {
@@ -29422,7 +30309,7 @@
       "post": {
         "callbacks": {},
         "description": "Verifica email + password y devuelve un end-user session token (`sess_…`). Si la request trae un end-user session token anónimo, la sesión se identifica (merge). La organización sale de la API key.",
-        "operationId": "HablalaApiWeb.PublicApi.EndUserSessionController.create",
+        "operationId": "post /v1/public/end-users/session",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -29468,11 +30355,91 @@
         ]
       }
     },
+    "/v1/public/me/aggregate": {
+      "post": {
+        "callbacks": {},
+        "description": "Agrupa records por `dimensions` y calcula `measures` (count/sum/avg/min/max), autenticado por una API key. Bajo el MISMO default-deny que la lectura: solo agrega lo que las policies exponen al principal `public`/`end_user`.",
+        "operationId": "post /v1/public/me/aggregate",
+        "parameters": [],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AggregateQueryRequest"
+              }
+            }
+          },
+          "description": "Aggregation query",
+          "required": false
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AggregateResultResponse"
+                }
+              }
+            },
+            "description": "Grupos agregados"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Token inválido"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Sin permiso"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Objeto o tenant desconocido"
+          },
+          "422": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            },
+            "description": "Consulta inválida"
+          }
+        },
+        "security": [
+          {
+            "apiKey": []
+          }
+        ],
+        "summary": "Agregar por la Data API pública (reportes)",
+        "tags": [
+          "public"
+        ]
+      }
+    },
     "/v1/public/me/checkout": {
       "post": {
         "callbacks": {},
         "description": "Crea un pedido atómicamente: valida stock por variante, numera (#1001), crea el `order` (source = web, financial_status = pending) + sus renglones con snapshots de precio, y decrementa el inventario. Autenticado por end-user session token; el comprador sale de la sesión (no del cuerpo). Idempotente vía el header `Idempotency-Key`.",
-        "operationId": "HablalaApiWeb.PublicApi.CheckoutController.create",
+        "operationId": "post /v1/public/me/checkout",
         "parameters": [
           {
             "description": "Clave de idempotencia (estándar Stripe): dos envíos con la misma → un pedido.",
@@ -29563,7 +30530,7 @@
     "/v1/public/me/objects/{object_slug}/records": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.create (2)",
+        "operationId": "post /v1/public/me/objects/{object_slug}/records",
         "parameters": [
           {
             "description": "",
@@ -29629,7 +30596,7 @@
     "/v1/public/me/objects/{object_slug}/records/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.delete",
+        "operationId": "delete /v1/public/me/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -29686,7 +30653,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.update (2)",
+        "operationId": "patch /v1/public/me/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -29771,7 +30738,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.update",
+        "operationId": "put /v1/public/me/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -29859,7 +30826,7 @@
       "post": {
         "callbacks": {},
         "description": "Como el staged upload del canal de máquina (`POST /v1/objects/{object_slug}/uploads`), pero gobernado por el ABAC default-deny del canal público: exige una policy `allow` de `create` o `update` para el principal (`public` con la API key; `end_user` con el session token en la variante `/me`) sobre el object — sin policy, 403. Flujo: presign → `PUT` del blob a `uploadUrl` → confirmar escribiendo el record con `fileUrl` en el envelope del attribute `file`.",
-        "operationId": "HablalaApiWeb.PublicApi.UploadController.create",
+        "operationId": "post /v1/public/me/objects/{object_slug}/uploads",
         "parameters": [
           {
             "description": "",
@@ -29936,7 +30903,7 @@
       "post": {
         "callbacks": {},
         "description": "Ejecuta una consulta lógica (object/select/where/include/order_by) autenticada por una API key read-only. La organización sale del token (no de la URL). Devuelve solo lo que las policies ABAC exponen al principal `public` (contenido publicado). Único camino de lectura pública.",
-        "operationId": "HablalaApiWeb.PublicApi.QueryController.create (2)",
+        "operationId": "post /v1/public/me/query",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30015,7 +30982,7 @@
     "/v1/public/objects/{object_slug}/records": {
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.create",
+        "operationId": "post /v1/public/objects/{object_slug}/records",
         "parameters": [
           {
             "description": "",
@@ -30081,7 +31048,7 @@
     "/v1/public/objects/{object_slug}/records/{id}": {
       "delete": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.delete (2)",
+        "operationId": "delete /v1/public/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -30138,7 +31105,7 @@
       },
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.update (4)",
+        "operationId": "patch /v1/public/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -30223,7 +31190,7 @@
       },
       "put": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.PublicApi.RecordController.update (3)",
+        "operationId": "put /v1/public/objects/{object_slug}/records/{id}",
         "parameters": [
           {
             "description": "",
@@ -30311,7 +31278,7 @@
       "post": {
         "callbacks": {},
         "description": "Como el staged upload del canal de máquina (`POST /v1/objects/{object_slug}/uploads`), pero gobernado por el ABAC default-deny del canal público: exige una policy `allow` de `create` o `update` para el principal (`public` con la API key; `end_user` con el session token en la variante `/me`) sobre el object — sin policy, 403. Flujo: presign → `PUT` del blob a `uploadUrl` → confirmar escribiendo el record con `fileUrl` en el envelope del attribute `file`.",
-        "operationId": "HablalaApiWeb.PublicApi.UploadController.create (2)",
+        "operationId": "post /v1/public/objects/{object_slug}/uploads",
         "parameters": [
           {
             "description": "",
@@ -30388,7 +31355,7 @@
       "post": {
         "callbacks": {},
         "description": "Ejecuta una consulta lógica (object/select/where/include/order_by) autenticada por una API key read-only. La organización sale del token (no de la URL). Devuelve solo lo que las policies ABAC exponen al principal `public` (contenido publicado). Único camino de lectura pública.",
-        "operationId": "HablalaApiWeb.PublicApi.QueryController.create",
+        "operationId": "post /v1/public/query",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30468,7 +31435,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve la forma del diccionario del tenant (objetos + atributos + relaciones) para que el SDK genere tipos TS por tenant (`hablala codegen`). La organización sale del token (no de la URL). Read-only; nunca datos de records.",
-        "operationId": "HablalaApiWeb.PublicApi.SchemaController.show",
+        "operationId": "get /v1/public/schema",
         "parameters": [],
         "responses": {
           "200": {
@@ -30507,7 +31474,7 @@
       "post": {
         "callbacks": {},
         "description": "Devuelve un end-user session token anónimo (`sess_…`, sin usuario final): el carrito/actividad antes de identificarse. Al hacer login/signup con este token, la sesión se identifica (merge). La organización sale de la API key.",
-        "operationId": "HablalaApiWeb.PublicApi.EndUserSessionController.create_anonymous",
+        "operationId": "post /v1/public/sessions/anonymous",
         "parameters": [],
         "responses": {
           "201": {
@@ -30546,7 +31513,7 @@
       "post": {
         "callbacks": {},
         "description": "Dado un lote de ids de `product_variant`, devuelve por variante si es comprable (activa y con stock > 0) — el booleano del badge \"Agotado\". Autenticado por API key. Se expone el booleano derivado, no el conteo de stock.",
-        "operationId": "HablalaApiWeb.PublicApi.AvailabilityController.create",
+        "operationId": "post /v1/public/variants/availability",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30606,7 +31573,7 @@
       "post": {
         "callbacks": {},
         "description": "Registra (upsert) el token de push de este dispositivo para el usuario autenticado. Idempotente por `token`: re-registrar en cada arranque es correcto y revive un token que se había dado de baja.",
-        "operationId": "HablalaApiWeb.Notifications.PushTokenController.create",
+        "operationId": "post /v1/push-tokens",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30651,7 +31618,7 @@
       "delete": {
         "callbacks": {},
         "description": "Borra el device token de este dispositivo (logout): el dispositivo deja de recibir push de esta cuenta. Idempotente (204 aunque el token ya no existiera).",
-        "operationId": "HablalaApiWeb.Notifications.PushTokenController.delete",
+        "operationId": "delete /v1/push-tokens/{token}",
         "parameters": [
           {
             "description": "El device token a eliminar.",
@@ -30680,7 +31647,7 @@
       "post": {
         "callbacks": {},
         "description": "Compila una consulta lógica (object/select/where/include/semantic/order_by) a SQL con permisos inyectados y devuelve las filas mapeadas a slugs. Único camino de lectura rica.",
-        "operationId": "HablalaApiWeb.Machine.QueryController.create",
+        "operationId": "post /v1/query",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30744,7 +31711,7 @@
     "/v1/relationships": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RelationshipController.index",
+        "operationId": "get /v1/relationships",
         "parameters": [],
         "responses": {
           "200": {
@@ -30765,7 +31732,7 @@
       },
       "post": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RelationshipController.create",
+        "operationId": "post /v1/relationships",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30809,7 +31776,7 @@
     "/v1/relationships/{id}": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.RelationshipController.show",
+        "operationId": "get /v1/relationships/{id}",
         "parameters": [
           {
             "description": "",
@@ -30855,7 +31822,7 @@
       "post": {
         "callbacks": {},
         "description": "Recibe la aserción del IdP (ya validada en el borde), resuelve o crea la identidad global del usuario, asegura su membresía en la organización y devuelve un token de API. El IdP solo CONFIRMA pertenencia; no reemplaza la identidad (el `user_id` global se preserva).",
-        "operationId": "HablalaApiWeb.Accounts.SsoController.callback",
+        "operationId": "post /v1/sso/callback",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30901,7 +31868,7 @@
       "post": {
         "callbacks": {},
         "description": "Dado un email corporativo, resuelve la conexión SSO de su organización por el dominio y devuelve la URL del IdP a la que redirigir (flujo SP-initiated). Responde 404 si el dominio no tiene una conexión SSO habilitada (el frontend cae al login por contraseña).",
-        "operationId": "HablalaApiWeb.Accounts.SsoController.init",
+        "operationId": "post /v1/sso/init",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30947,7 +31914,7 @@
       "post": {
         "callbacks": {},
         "description": "Inicia sesión con Google. Crea la cuenta si no existe o vincula Google a la cuenta con el mismo email (Google verifica el email, así que la cuenta queda confirmada).\n\nSoporta dos clientes según el campo que envíes:\n\n- **Nativo (app móvil):** envía `idToken` (el `id_token` OIDC del SDK `google_sign_in`). El backend lo **verifica** (firma JWKS de Google, `aud`, `iss`, `exp`) sin canjear nada. Es el flujo estándar de \"sign-in only\".\n- **Web (BFF con redirección server-side):** envía `code` + `redirectUri` (el mismo valor usado para pedir el `code`); se valida contra una allow-list server-side.",
-        "operationId": "HablalaApiWeb.Accounts.UserOAuthController.google",
+        "operationId": "post /v1/users/auth/google",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -30993,7 +31960,7 @@
       "post": {
         "callbacks": {},
         "description": "Completa la vinculación de Google a una cuenta existente que tiene contraseña (paso de re-autenticación del flujo *link-on-login*, ADR-024). Se llama tras recibir un `409 requires_reauth` de `POST /users/auth/google`: el cliente reenvía el mismo `idToken` (o `code`+`redirectUri`) **más** la `password` de la cuenta. Si la contraseña es correcta, se vincula la credencial Google y se devuelve usuario + token.",
-        "operationId": "HablalaApiWeb.Accounts.UserOAuthController.confirm_link",
+        "operationId": "post /v1/users/auth/google/confirm-link",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31039,7 +32006,7 @@
       "post": {
         "callbacks": {},
         "description": "Envía un código OTP por SMS al número dado. Un solo camino para alta y login: si el número ya identifica a una persona, reusa su identidad; si no, la crea. Responde 204 siempre (anti-enumeración): no revela si el número ya existía.",
-        "operationId": "HablalaApiWeb.Accounts.UserPhoneController.start",
+        "operationId": "post /v1/users/auth/phone/start",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31088,7 +32055,7 @@
       "post": {
         "callbacks": {},
         "description": "Verifica el código OTP recibido por SMS y, si es correcto, inicia sesión (devuelve un token de API). El teléfono queda verificado como credencial raíz.",
-        "operationId": "HablalaApiWeb.Accounts.UserPhoneController.verify",
+        "operationId": "post /v1/users/auth/phone/verify",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31144,7 +32111,7 @@
       "post": {
         "callbacks": {},
         "description": "Verifica el código (OTP) enviado al registrarse, confirma la cuenta e inicia sesión (devuelve un token de API).",
-        "operationId": "HablalaApiWeb.Accounts.UserSessionController.confirm_email",
+        "operationId": "post /v1/users/confirm-email",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31200,7 +32167,7 @@
       "post": {
         "callbacks": {},
         "description": "Reenvía el código (OTP) para confirmar la cuenta. Responde 204 siempre, exista o no el email o esté ya confirmado (evita enumeración).",
-        "operationId": "HablalaApiWeb.Accounts.UserSessionController.resend_confirmation",
+        "operationId": "post /v1/users/confirm-email/resend",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31229,7 +32196,7 @@
       "post": {
         "callbacks": {},
         "description": "Agrega un teléfono como método de login a la cuenta autenticada y envía un OTP por SMS. Falla 422 si el número ya pertenece a otra persona.",
-        "operationId": "HablalaApiWeb.Accounts.UserLinkController.start_phone",
+        "operationId": "post /v1/users/link/phone/start",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31277,7 +32244,7 @@
       "post": {
         "callbacks": {},
         "description": "Verifica el OTP y marca el teléfono como método verificado de la cuenta. No inicia una sesión nueva (ya estás autenticado): responde 204.",
-        "operationId": "HablalaApiWeb.Accounts.UserLinkController.verify_phone",
+        "operationId": "post /v1/users/link/phone/verify",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31325,7 +32292,7 @@
       "post": {
         "callbacks": {},
         "description": "Intercambia email + contraseña por un token de API. Si la cuenta aún no está confirmada, responde 403 (hay que confirmar el email primero).",
-        "operationId": "HablalaApiWeb.Accounts.UserSessionController.create",
+        "operationId": "post /v1/users/login",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31381,7 +32348,7 @@
       "delete": {
         "callbacks": {},
         "description": "Revoca el token de API usado en esta request.",
-        "operationId": "HablalaApiWeb.Accounts.UserSessionController.delete",
+        "operationId": "delete /v1/users/logout",
         "parameters": [],
         "responses": {
           "204": {
@@ -31397,7 +32364,7 @@
     "/v1/users/me": {
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Accounts.UserSessionController.me",
+        "operationId": "get /v1/users/me",
         "parameters": [],
         "responses": {
           "200": {
@@ -31431,7 +32398,7 @@
       "patch": {
         "callbacks": {},
         "description": "Perfil de identidad global: nombre, avatar, zona horaria e idioma.",
-        "operationId": "HablalaApiWeb.Accounts.UserSettingsController.update_profile",
+        "operationId": "patch /v1/users/profile",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31476,7 +32443,7 @@
       "post": {
         "callbacks": {},
         "description": "Crea un usuario con email y contraseña y le envía un código (OTP) para confirmar el email. NO inicia sesión: el usuario debe confirmar con `POST /users/confirm-email` antes de entrar. Responde 201 sin token.",
-        "operationId": "HablalaApiWeb.Accounts.UserRegistrationController.create",
+        "operationId": "post /v1/users/register",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31515,7 +32482,7 @@
       "post": {
         "callbacks": {},
         "description": "Envía por email un enlace para restablecer la contraseña. Responde 204 siempre, exista o no el email (evita enumeración de usuarios).",
-        "operationId": "HablalaApiWeb.Accounts.UserPasswordController.request_reset",
+        "operationId": "post /v1/users/reset-password",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31544,7 +32511,7 @@
       "post": {
         "callbacks": {},
         "description": "Canjea el token de reset (recibido por email) y fija una nueva contraseña.",
-        "operationId": "HablalaApiWeb.Accounts.UserPasswordController.reset",
+        "operationId": "post /v1/users/reset-password/confirm",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31592,7 +32559,7 @@
     "/v1/users/settings": {
       "patch": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Accounts.UserSettingsController.update",
+        "operationId": "patch /v1/users/settings",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31637,7 +32604,7 @@
       "post": {
         "callbacks": {},
         "description": "Token firmado de vida corta para autenticar la conexión websocket (`/socket`). El bearer de la API no debe viajar en el query string del upgrade (los proxies loguean la URL); este token de minutos sí puede. Cada reconexión acuña uno nuevo.",
-        "operationId": "HablalaApiWeb.Accounts.UserSessionController.socket_token",
+        "operationId": "post /v1/users/socket-token",
         "parameters": [],
         "responses": {
           "200": {
@@ -31671,7 +32638,7 @@
       "patch": {
         "callbacks": {},
         "description": "Cambia el handle con el que te descubren. Valida formato/charset (ASCII, minúsculas), nombres reservados y unicidad. Devuelve 422 con error en `username` si está tomado o es inválido.",
-        "operationId": "HablalaApiWeb.Accounts.UserSettingsController.update_username",
+        "operationId": "patch /v1/users/username",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31716,7 +32683,7 @@
       "get": {
         "callbacks": {},
         "description": "Los webhook endpoints de la organización (solo metadatos; el signing secret se obtiene con `GET .../:id/secret`).",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.index",
+        "operationId": "get /v1/webhooks",
         "parameters": [],
         "responses": {
           "200": {
@@ -31738,7 +32705,7 @@
       "post": {
         "callbacks": {},
         "description": "Suscribe una URL a eventos del event store. La plataforma genera el **signing secret** (`whsec_…`) y lo incluye en esta respuesta (`secret`); con él el receptor verifica la firma de cada entrega (spec Standard Webhooks). También puede recuperarse después con `GET .../:id/secret`.",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.create",
+        "operationId": "post /v1/webhooks",
         "parameters": [],
         "requestBody": {
           "content": {
@@ -31793,7 +32760,7 @@
       "delete": {
         "callbacks": {},
         "description": "Elimina el endpoint y su historial de deliveries. Deja de recibir entregas.",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.delete",
+        "operationId": "delete /v1/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -31829,7 +32796,7 @@
       },
       "get": {
         "callbacks": {},
-        "operationId": "HablalaApiWeb.Machine.WebhookController.show",
+        "operationId": "get /v1/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -31873,7 +32840,7 @@
       "patch": {
         "callbacks": {},
         "description": "Cambia `url`/`enabledEvents`/`status`. Reactivar (`status: \"enabled\"`) un endpoint auto-deshabilitado limpia el motivo del disable. El slug y el secret no se tocan aquí.",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.update (2)",
+        "operationId": "patch /v1/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -31928,7 +32895,7 @@
       "put": {
         "callbacks": {},
         "description": "Cambia `url`/`enabledEvents`/`status`. Reactivar (`status: \"enabled\"`) un endpoint auto-deshabilitado limpia el motivo del disable. El slug y el secret no se tocan aquí.",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.update",
+        "operationId": "put /v1/webhooks/{id}",
         "parameters": [
           {
             "description": "",
@@ -31985,7 +32952,7 @@
       "get": {
         "callbacks": {},
         "description": "La bitácora de entregas (canónico GitHub): qué eventos se entregaron, cuántos intentos costaron y con qué respondió el receptor. Más recientes primero (máx. 50).",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.deliveries",
+        "operationId": "get /v1/webhooks/{id}/deliveries",
         "parameters": [
           {
             "description": "",
@@ -32021,7 +32988,7 @@
       "post": {
         "callbacks": {},
         "description": "Genera un `whsec_…` nuevo para el MISMO endpoint (el historial no cambia). El secret viejo deja de firmar de inmediato: actualiza la copia del receptor. La respuesta incluye el nuevo secret.",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.rotate",
+        "operationId": "post /v1/webhooks/{id}/rotate",
         "parameters": [
           {
             "description": "",
@@ -32057,7 +33024,7 @@
       "get": {
         "callbacks": {},
         "description": "El `whsec_…` del endpoint, para configurarlo en el receptor (modelo Svix `GET .../secret` / Stripe dashboard \"Reveal\"). Es una llave de firma compartida, no una credencial de autenticación entrante: por eso es recuperable, a diferencia de `sk_`/`mat_`.",
-        "operationId": "HablalaApiWeb.Machine.WebhookController.secret",
+        "operationId": "get /v1/webhooks/{id}/secret",
         "parameters": [
           {
             "description": "",
@@ -32093,7 +33060,7 @@
       "get": {
         "callbacks": {},
         "description": "Devuelve la organización a la que pertenece el token de máquina y sus permisos efectivos. La organización sale del token (no de la URL): así una herramienta externa la infiere sin que el desarrollador la configure.",
-        "operationId": "HablalaApiWeb.Machine.WhoamiController.show",
+        "operationId": "get /v1/whoami",
         "parameters": [],
         "responses": {
           "200": {