@hypequery/cloud-client 0.0.0-canary-20261113132821 → 0.0.0-stage

package/dist/generated/operations.js

@@ -1,1159 +0,0 @@
-// Generated by packages/cloud-client/codegen/generate.ts from specs/cloud-api/operations-v1.json.
-// Do not edit by hand: run `pnpm --filter @hypequery/cloud-client generate`.
-/** The operations spec version this client was generated from. */
-export const SPEC_VERSION = 1;
-/** Every operation path is relative to this. */
-export const BASE_PATH = "/v1";
-/** Every error category, in the order Cloud lists them. */
-export const CLOUD_ERROR_CATEGORIES = ["correctable_input", "unauthenticated", "forbidden", "tenant_unavailable", "budget_exceeded", "cancelled", "stale_contract", "unavailable", "internal"];
-/** Every error code an operation can return, with what to do about it. */
-export const CLOUD_ERRORS = {
-    UNAUTHENTICATED: {
-        status: 401,
-        category: "unauthenticated",
-        retryable: false,
-        hint: "Sign in to hypequery Cloud, or send a valid bearer token.",
-        docsUrl: "https://hypequery.com/docs/errors/unauthenticated",
-    },
-    FORBIDDEN: {
-        status: 403,
-        category: "forbidden",
-        retryable: false,
-        hint: "Ask an organisation Admin to do this, or to change your role.",
-        docsUrl: "https://hypequery.com/docs/errors/forbidden",
-    },
-    INVALID_REQUEST_ORIGIN: {
-        status: 403,
-        category: "forbidden",
-        retryable: false,
-        hint: "Send the request from the Cloud app, or authenticate with a bearer token instead of a cookie.",
-        docsUrl: "https://hypequery.com/docs/errors/invalid-request-origin",
-    },
-    OPERATION_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Check the method and path against operations-v1.json.",
-        docsUrl: "https://hypequery.com/docs/errors/operation-not-found",
-    },
-    INVALID_INPUT: {
-        status: 400,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Fix the fields listed in `issues`, then retry.",
-        docsUrl: "https://hypequery.com/docs/errors/invalid-input",
-    },
-    PROJECT_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List projects (`projects.list`) and use one of their slugs.",
-        docsUrl: "https://hypequery.com/docs/errors/project-not-found",
-    },
-    PROJECT_HAS_SEVERAL_TARGETS: {
-        status: 409,
-        category: "unavailable",
-        retryable: false,
-        hint: "This project still has several environments; contact hypequery support to finish moving it to projects only.",
-        docsUrl: "https://hypequery.com/docs/errors/project-has-several-targets",
-    },
-    VERSION_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List versions (`releases.list`) and use one of their labels.",
-        docsUrl: "https://hypequery.com/docs/errors/version-not-found",
-    },
-    RELEASE_MOVED: {
-        status: 409,
-        category: "stale_contract",
-        retryable: false,
-        hint: "Read the current state again (`releases.status` or `drafts.list`), show the user what changed, then retry with the new values.",
-        docsUrl: "https://hypequery.com/docs/errors/release-moved",
-    },
-    RELEASE_CHANGE_REFUSED: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Read the message: it names the guard that refused the change and how to clear it.",
-        docsUrl: "https://hypequery.com/docs/errors/release-change-refused",
-    },
-    DRAFT_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List drafts (`drafts.list`) and use one of their ids.",
-        docsUrl: "https://hypequery.com/docs/errors/draft-not-found",
-    },
-    DRAFT_NOT_CHECKABLE: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Number checks here are for code drafts with a saved release; deploy the draft again from code first.",
-        docsUrl: "https://hypequery.com/docs/errors/draft-not-checkable",
-    },
-    DRAFT_NOT_READY: {
-        status: 422,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Fix what the message names in the draft (or the code, for a code draft), then publish again.",
-        docsUrl: "https://hypequery.com/docs/errors/draft-not-ready",
-    },
-    CONNECTION_NOT_SAVED: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Call connections_link and give the user its link to enter the connection in the dashboard (or `connections.save` from the CLI); never ask for the password in chat.",
-        docsUrl: "https://hypequery.com/docs/errors/connection-not-saved",
-    },
-    CONNECTION_AUTH_FAILED: {
-        status: 422,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Call connections_link so the user can correct the ClickHouse user and password in the dashboard (or `connections.save` from the CLI), then run `connections.test`. Never ask for the password in chat.",
-        docsUrl: "https://hypequery.com/docs/errors/connection-auth-failed",
-    },
-    CONNECTION_UNREACHABLE: {
-        status: 502,
-        category: "unavailable",
-        retryable: true,
-        hint: "Check the host and port, and that ClickHouse accepts connections from hypequery's egress addresses; then run `connections.test` again.",
-        docsUrl: "https://hypequery.com/docs/errors/connection-unreachable",
-    },
-    CONNECTION_QUERY_FAILED: {
-        status: 422,
-        category: "correctable_input",
-        retryable: false,
-        hint: "ClickHouse refused the check query: grant the user what the message names, then run `connections.test`.",
-        docsUrl: "https://hypequery.com/docs/errors/connection-query-failed",
-    },
-    CONNECTION_DATABASE_LOCKED: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Keep the default database while a release is live; add other databases to `databases` instead.",
-        docsUrl: "https://hypequery.com/docs/errors/connection-database-locked",
-    },
-    STALE_REVISION: {
-        status: 409,
-        category: "stale_contract",
-        retryable: false,
-        hint: "Read it again, then retry with the new expectedRevision.",
-        docsUrl: "https://hypequery.com/docs/errors/stale-revision",
-    },
-    TENANT_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List customers (`tenants.list`) and use one of their ids.",
-        docsUrl: "https://hypequery.com/docs/errors/tenant-not-found",
-    },
-    TENANT_EXISTS: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "That customer is already registered; update it (`tenants.update`) instead.",
-        docsUrl: "https://hypequery.com/docs/errors/tenant-exists",
-    },
-    PERMISSION_SET_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List permission sets (`permissionSets.list`) and use one of their ids.",
-        docsUrl: "https://hypequery.com/docs/errors/permission-set-not-found",
-    },
-    PERMISSION_SET_EXISTS: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Choose another name, or update the existing set (`permissionSets.update`).",
-        docsUrl: "https://hypequery.com/docs/errors/permission-set-exists",
-    },
-    GRANT_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List connections (`tenantGrants.list`) and use one of their ids.",
-        docsUrl: "https://hypequery.com/docs/errors/grant-not-found",
-    },
-    ISSUER_UNREADABLE: {
-        status: 422,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Check the URL is public https and serves the provider's JSON (a JWKS `keys` array, or openid-configuration), then save again.",
-        docsUrl: "https://hypequery.com/docs/errors/issuer-unreadable",
-    },
-    ISSUER_REQUIRED: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Save the identity provider's JWT settings first (`jwtIssuer.save`).",
-        docsUrl: "https://hypequery.com/docs/errors/issuer-required",
-    },
-    ALREADY_CONFIGURED: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Read the current settings, then save again with their expectedRevision to replace them.",
-        docsUrl: "https://hypequery.com/docs/errors/already-configured",
-    },
-    NOT_CONFIGURED: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Nothing is configured yet; save it first.",
-        docsUrl: "https://hypequery.com/docs/errors/not-configured",
-    },
-    PROJECT_EXISTS: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Choose another slug, or use the existing project (`projects.get`).",
-        docsUrl: "https://hypequery.com/docs/errors/project-exists",
-    },
-    KEY_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List keys (`apiKeys.list` or `deployKeys.list`) and use an active key's id.",
-        docsUrl: "https://hypequery.com/docs/errors/key-not-found",
-    },
-    MEMBER_NOT_FOUND: {
-        status: 404,
-        category: "correctable_input",
-        retryable: false,
-        hint: "List members (`members.list`) and use one of their ids.",
-        docsUrl: "https://hypequery.com/docs/errors/member-not-found",
-    },
-    SESSION_REQUIRED: {
-        status: 403,
-        category: "forbidden",
-        retryable: false,
-        hint: "Make this change in the dashboard or with `hypequery` signed in as yourself.",
-        docsUrl: "https://hypequery.com/docs/errors/session-required",
-    },
-    DRAFT_READ_ONLY: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "This project's model lives in a repository. Explain it or answer questions; for a change, write a prompt or pull-request description for the user's coding agent.",
-        docsUrl: "https://hypequery.com/docs/errors/draft-read-only",
-    },
-    NOTHING_TO_CONFIRM: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Call customer_scope_list and confirm only a dataset it lists with a candidate column.",
-        docsUrl: "https://hypequery.com/docs/errors/nothing-to-confirm",
-    },
-    FINDINGS_CHANGED: {
-        status: 409,
-        category: "stale_contract",
-        retryable: false,
-        hint: "Read drafts_findings again and answer with the current ids and tokens.",
-        docsUrl: "https://hypequery.com/docs/errors/findings-changed",
-    },
-    RUN_CONFLICT: {
-        status: 409,
-        category: "stale_contract",
-        retryable: false,
-        hint: "Read drafts_run_status and act on the run it returns.",
-        docsUrl: "https://hypequery.com/docs/errors/run-conflict",
-    },
-    DRAFT_NAME_TAKEN: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Choose another name; drafts_list shows the names in use.",
-        docsUrl: "https://hypequery.com/docs/errors/draft-name-taken",
-    },
-    UPDATE_CONFLICTS: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Ask the user which side to keep for each conflict in drafts_update, preview with drafts_apply_update, then apply.",
-        docsUrl: "https://hypequery.com/docs/errors/update-conflicts",
-    },
-    OWNERSHIP_CHANGE_REQUIRED: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Tell the user the live model was built in Cloud and publishing this code draft replaces it, after which the project is managed in code; once they agree, repeat the call with takeOwnership: true.",
-        docsUrl: "https://hypequery.com/docs/errors/ownership-change-required",
-    },
-    CONFIRMATION_REQUIRED: {
-        status: 409,
-        category: "correctable_input",
-        retryable: false,
-        hint: "Show the user what will change; once they agree, repeat the call with `confirm: true`.",
-        docsUrl: "https://hypequery.com/docs/errors/confirmation-required",
-    },
-    INTERNAL: {
-        status: 500,
-        category: "internal",
-        retryable: true,
-        hint: "Retry; if it keeps failing, report it with hypequery_feedback and this requestId.",
-        docsUrl: "https://hypequery.com/docs/errors/internal",
-    },
-};
-/** Route and policy for every operation, by name. */
-export const OPERATIONS = {
-    "projects.list": {
-        name: "projects.list",
-        summary: "List the projects in your organisation.",
-        scope: "organization",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "UNAUTHENTICATED"],
-    },
-    "projects.get": {
-        name: "projects.get",
-        summary: "Show one project and whether a release is live.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "projects.connectInfo": {
-        name: "projects.connectInfo",
-        summary: "Where the project is served: the MCP URL, the REST base and dataset URLs, and the client contract.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/connect-info",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "projects.create": {
-        name: "projects.create",
-        summary: "Create a project: one ClickHouse connection, one live data model, its own URLs.",
-        scope: "organization",
-        capability: "environment:create",
-        destructive: false,
-        method: "POST",
-        path: "/projects",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_EXISTS", "UNAUTHENTICATED"],
-    },
-    "projects.rename": {
-        name: "projects.rename",
-        summary: "Change a project's display name; its slug and URLs stay the same.",
-        scope: "project",
-        capability: "environment:create",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "releases.status": {
-        name: "releases.status",
-        summary: "Show what is live: the current version and revision.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/releases/live",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "releases.list": {
-        name: "releases.list",
-        summary: "List published versions, newest first.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/releases",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "releases.get": {
-        name: "releases.get",
-        summary: "Show one published version and its data model.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/releases/{version}",
-        pathParams: ["project", "version"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED", "VERSION_NOT_FOUND"],
-    },
-    "releases.rollback": {
-        name: "releases.rollback",
-        summary: "Make an earlier published version live again. The project's owner follows it: rolling back to a version built in Cloud makes the model editable in Cloud again, and to one deployed from code makes it managed in code.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: true,
-        method: "POST",
-        path: "/projects/{project}/releases/{version}/rollback",
-        pathParams: ["project", "version"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "RELEASE_CHANGE_REFUSED", "RELEASE_MOVED", "UNAUTHENTICATED", "VERSION_NOT_FOUND"],
-    },
-    "drafts.list": {
-        name: "drafts.list",
-        summary: "List the project's drafts and whether each is ready to publish.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.open": {
-        name: "drafts.open",
-        summary: "Open your working draft (created on first use, with the ClickHouse schema discovered) or a named draft, and see what it holds.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/drafts/open",
-        pathParams: ["project"],
-        errors: ["CONNECTION_NOT_SAVED", "DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.save": {
-        name: "drafts.save",
-        summary: "Save the draft as a staging release after its publish gates pass. Nothing goes live; publishing is drafts.promote.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/save",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_NOT_READY", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "drafts.review": {
-        name: "drafts.review",
-        summary: "Review a saved draft before publishing: what changes against production, breaking changes, held measures and checks.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}/review",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "RELEASE_MOVED", "UNAUTHENTICATED"],
-    },
-    "drafts.checks": {
-        name: "drafts.checks",
-        summary: "Run Cloud's number checks on a code draft's saved release.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/checks",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_CHECKABLE", "DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.promote": {
-        name: "drafts.promote",
-        summary: "Publish a draft's saved release to production.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: true,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/promote",
-        pathParams: ["project", "draft"],
-        errors: ["CONFIRMATION_REQUIRED", "DRAFT_NOT_FOUND", "DRAFT_NOT_READY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "OWNERSHIP_CHANGE_REQUIRED", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "RELEASE_CHANGE_REFUSED", "RELEASE_MOVED", "UNAUTHENTICATED"],
-    },
-    "drafts.get": {
-        name: "drafts.get",
-        summary: "Read a draft: its model, revision, whether Production moved since it was based, its saved release and its publish gates.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.rename": {
-        name: "drafts.rename",
-        summary: "Rename a draft. Its id and staging URL stay the same.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/drafts/{draft}",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NAME_TAKEN", "DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.delete": {
-        name: "drafts.delete",
-        summary: "Delete a draft and its staging URL for good. Only its creator can, unless you manage the organisation.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/drafts/{draft}",
-        pathParams: ["project", "draft"],
-        errors: ["CONFIRMATION_REQUIRED", "DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.archived": {
-        name: "drafts.archived",
-        summary: "Read an archived draft: the release it published and whether it can be reopened against current Production.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}/archive",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "drafts.reopen": {
-        name: "drafts.reopen",
-        summary: "Reopen an archived draft as a working draft, from the release you read.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/reopen",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "drafts.impact": {
-        name: "drafts.impact",
-        summary: "Who a saved draft affects: which apps and customers called the datasets, measures and fields it changes or removes, recently.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}/impact",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "RELEASE_MOVED", "UNAUTHENTICATED"],
-    },
-    "drafts.update": {
-        name: "drafts.update",
-        summary: "When Production moved since a draft was based, show the merge onto current Production: what merges cleanly and each conflict to choose.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}/update",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_NOT_READY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED", "UPDATE_CONFLICTS"],
-    },
-    "drafts.applyUpdate": {
-        name: "drafts.applyUpdate",
-        summary: "Merge a draft onto current Production with the user's choice for each conflict (keep the draft's or Production's). Preview first; apply once every conflict is chosen.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/update",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_NOT_READY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED", "UPDATE_CONFLICTS"],
-    },
-    "drafts.refreshBase": {
-        name: "drafts.refreshBase",
-        summary: "For a code draft whose base Production moved: acknowledge that publishing it will replace current Production as it is, dropping the changes made there since. Nothing is merged.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: true,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/refresh-base",
-        pathParams: ["project", "draft"],
-        errors: ["CONFIRMATION_REQUIRED", "DRAFT_NOT_FOUND", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "drafts.setup": {
-        name: "drafts.setup",
-        summary: "Save what the user said about the project on a draft: what it's for, who it serves, the tables to model, priority metrics and one number they trust.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/drafts/{draft}/setup",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "drafts.findings": {
-        name: "drafts.findings",
-        summary: "List what discovery found that changes numbers (internal rows, mixed units, versioned rows, grain, customer scope…), each with the question to ask the user and the measures it affects.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}/findings",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.answer": {
-        name: "drafts.answer",
-        summary: "Record the user's answers to findings: approve the proposed default, reject it (remove, or their own alternative), or decide later. Each answer becomes the member's decision in the draft's evidence ledger and can release held measures, so ask the user first.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: true,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/answers",
-        pathParams: ["project", "draft"],
-        errors: ["CONFIRMATION_REQUIRED", "DRAFT_NOT_FOUND", "DRAFT_NOT_READY", "DRAFT_READ_ONLY", "FINDINGS_CHANGED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "drafts.runStatus": {
-        name: "drafts.runStatus",
-        summary: "Read the progress of the draft's background checks (grain, column meaning, measures, joins, query history, the trusted number).",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/drafts/{draft}/run",
-        pathParams: ["project", "draft"],
-        errors: ["DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "drafts.run": {
-        name: "drafts.run",
-        summary: "Start, resume or cancel the draft's background checks against ClickHouse. They run in batches; poll drafts_run_status, then read drafts_findings.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/drafts/{draft}/run",
-        pathParams: ["project", "draft"],
-        errors: ["CONNECTION_NOT_SAVED", "DRAFT_NOT_FOUND", "DRAFT_READ_ONLY", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "RUN_CONFLICT", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "customerScope.list": {
-        name: "customerScope.list",
-        summary: "List each live dataset's customer scope, and the ones flagged for exposing a customer column without being scoped by it.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/onboarding/customer-scope",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerScope.confirmShared": {
-        name: "customerScope.confirmShared",
-        summary: "Record that a flagged dataset is the same for every customer, so it stays unscoped on purpose. Only the user can decide this.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: true,
-        method: "POST",
-        path: "/projects/{project}/onboarding/customer-scope/confirm",
-        pathParams: ["project"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "NOTHING_TO_CONFIRM", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "samplePolicy.get": {
-        name: "samplePolicy.get",
-        summary: "Read which columns' sample values the assistant may see: all, only those not detected as sensitive, or none, with per-column overrides.",
-        scope: "project",
-        capability: "deployment:publish",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/sample-policy",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "samplePolicy.set": {
-        name: "samplePolicy.set",
-        summary: "Set which columns' sample values the assistant may see.",
-        scope: "project",
-        capability: "connection:manage",
-        destructive: false,
-        method: "PUT",
-        path: "/projects/{project}/sample-policy",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "connections.get": {
-        name: "connections.get",
-        summary: "Show the project's ClickHouse connection (never the password).",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/connection",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "connections.save": {
-        name: "connections.save",
-        summary: "Test and save the project's ClickHouse connection; once a release is live, databases can only be added.",
-        scope: "project",
-        capability: "connection:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/connection",
-        pathParams: ["project"],
-        errors: ["CONNECTION_AUTH_FAILED", "CONNECTION_DATABASE_LOCKED", "CONNECTION_QUERY_FAILED", "CONNECTION_UNREACHABLE", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "connections.link": {
-        name: "connections.link",
-        summary: "Get a one-time link for the user to enter the project's ClickHouse connection in the dashboard, so the password never passes through chat. It works for the user who asked, signed in, once, for 15 minutes; then check it with connections.test.",
-        scope: "project",
-        capability: "connection:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/connection/link",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "connections.test": {
-        name: "connections.test",
-        summary: "Check the saved connection now: reachable, the user accepted, and what hypequery needs granted.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/connection/test",
-        pathParams: ["project"],
-        errors: ["CONNECTION_AUTH_FAILED", "CONNECTION_NOT_SAVED", "CONNECTION_QUERY_FAILED", "CONNECTION_UNREACHABLE", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "connections.queryHistory": {
-        name: "connections.queryHistory",
-        summary: "Show whether onboarding may read ClickHouse query history, and which accounts are technical.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/connection/query-history",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "connections.setQueryHistory": {
-        name: "connections.setQueryHistory",
-        summary: "Allow or stop onboarding reading ClickHouse query history (shapes only, never literals).",
-        scope: "project",
-        capability: "connection:manage",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/connection/query-history",
-        pathParams: ["project"],
-        errors: ["CONNECTION_NOT_SAVED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "logs.query": {
-        name: "logs.query",
-        summary: "Search the project's request history (7 days): who queried what, how long it took, and what failed.",
-        scope: "project",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/logs",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "usage.get": {
-        name: "usage.get",
-        summary: "Show this month's queries by day and transport, per customer, and embedded chat usage.",
-        scope: "organization",
-        capability: "workspace:view",
-        destructive: false,
-        method: "GET",
-        path: "/org/usage",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "UNAUTHENTICATED"],
-    },
-    "audit.list": {
-        name: "audit.list",
-        summary: "List the organisation's audit log: publishes, rollbacks, members, keys and connection changes.",
-        scope: "organization",
-        capability: "audit:read",
-        destructive: false,
-        method: "GET",
-        path: "/org/audit",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "UNAUTHENTICATED"],
-    },
-    "tenants.list": {
-        name: "tenants.list",
-        summary: "List the project's customers (tenants) and whether each is enabled.",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/tenants",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "tenants.create": {
-        name: "tenants.create",
-        summary: "Register a customer by the id your app uses for it, with a display name.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/customers/tenants",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "TENANT_EXISTS", "UNAUTHENTICATED"],
-    },
-    "tenants.update": {
-        name: "tenants.update",
-        summary: "Rename a customer, or disable it (which ends its users' MCP sign-ins).",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/customers/tenants/{tenant}",
-        pathParams: ["project", "tenant"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "TENANT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "tenants.remove": {
-        name: "tenants.remove",
-        summary: "Remove a customer and end its users' MCP sign-ins.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/customers/tenants/{tenant}",
-        pathParams: ["project", "tenant"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "TENANT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "permissionSets.list": {
-        name: "permissionSets.list",
-        summary: "List the permission sets that decide which datasets and fields customers' users see.",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/permission-sets",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "permissionSets.create": {
-        name: "permissionSets.create",
-        summary: "Create a permission set: the datasets and fields a customer's users may query.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/customers/permission-sets",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PERMISSION_SET_EXISTS", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "permissionSets.update": {
-        name: "permissionSets.update",
-        summary: "Change a permission set, guarded by the revision you read; fields you leave out keep their values.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/customers/permission-sets/{permissionSet}",
-        pathParams: ["project", "permissionSet"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PERMISSION_SET_NOT_FOUND", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "permissionSets.remove": {
-        name: "permissionSets.remove",
-        summary: "Delete a permission set; tokens naming it are refused from then on.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/customers/permission-sets/{permissionSet}",
-        pathParams: ["project", "permissionSet"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PERMISSION_SET_NOT_FOUND", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerLimits.get": {
-        name: "customerLimits.get",
-        summary: "Show each customer's query rate, daily query limit and chat token allowance.",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/limits",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerLimits.set": {
-        name: "customerLimits.set",
-        summary: "Set each customer's query rate, daily query limit and chat tokens; null keeps the default.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/customers/limits",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "tenantGrants.list": {
-        name: "tenantGrants.list",
-        summary: "List customers' users signed in to MCP, by customer and user.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/mcp-grants",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "tenantGrants.revokeTenant": {
-        name: "tenantGrants.revokeTenant",
-        summary: "End every MCP connection of one customer's users.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: true,
-        method: "POST",
-        path: "/projects/{project}/customers/mcp-grants/revoke-tenant",
-        pathParams: ["project"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "tenantGrants.revoke": {
-        name: "tenantGrants.revoke",
-        summary: "End one customer user's MCP connection; it stops on its next call.",
-        scope: "project",
-        capability: "embed:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/customers/mcp-grants/{grant}",
-        pathParams: ["project", "grant"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "GRANT_NOT_FOUND", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerAccess.get": {
-        name: "customerAccess.get",
-        summary: "Show how the app identifies its customers' users, the customer origin, and a dataset to prove scoping with.",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/access",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerAccess.setMode": {
-        name: "customerAccess.setMode",
-        summary: "Choose how the app identifies its customers' users: jwt (your provider), minted (your backend mints tokens), backend (your backend names the customer) or internal.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/customers/access",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerAccess.createKey": {
-        name: "customerAccess.createKey",
-        summary: "Create the server key a minted or backend mode uses, for any customer. Its token is returned once.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/customers/access/key",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerAccess.prove": {
-        name: "customerAccess.prove",
-        summary: "Prove customer scoping: one query as a chosen customer through the customer origin, then the same query with no customer, which must be refused.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/customers/access/prove",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerSettings.get": {
-        name: "customerSettings.get",
-        summary: "Show the allowed browser origins and how customers register.",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/settings",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "customerSettings.set": {
-        name: "customerSettings.set",
-        summary: "Replace the browser origins allowed to call customer endpoints, and choose whether customers register on first use.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "PATCH",
-        path: "/projects/{project}/customers/settings",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "jwtIssuer.get": {
-        name: "jwtIssuer.get",
-        summary: "Show the identity provider whose JWTs your app's users present, with its health.",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/jwt-issuer",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "jwtIssuer.save": {
-        name: "jwtIssuer.save",
-        summary: "Trust your identity provider's JWTs: issuer, audience, JWKS URL and which claims name the customer and access.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "PUT",
-        path: "/projects/{project}/customers/jwt-issuer",
-        pathParams: ["project"],
-        errors: ["ALREADY_CONFIGURED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "ISSUER_UNREADABLE", "NOT_CONFIGURED", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "jwtIssuer.remove": {
-        name: "jwtIssuer.remove",
-        summary: "Stop trusting the identity provider's JWTs; tokens from it are refused from then on.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/customers/jwt-issuer",
-        pathParams: ["project"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "NOT_CONFIGURED", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "oidcClient.get": {
-        name: "oidcClient.get",
-        summary: "Show OIDC sign-in for customers' MCP users, with the redirect and MCP URLs to register (never the client secret).",
-        scope: "project",
-        capability: "embed:view",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/customers/oidc-client",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "oidcClient.save": {
-        name: "oidcClient.save",
-        summary: "Let customers' users sign in to MCP with your identity provider: issuer, client id and (the first time) secret.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "PUT",
-        path: "/projects/{project}/customers/oidc-client",
-        pathParams: ["project"],
-        errors: ["ALREADY_CONFIGURED", "CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "ISSUER_REQUIRED", "ISSUER_UNREADABLE", "NOT_CONFIGURED", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "STALE_REVISION", "UNAUTHENTICATED"],
-    },
-    "oidcClient.remove": {
-        name: "oidcClient.remove",
-        summary: "Remove OIDC sign-in; every customer MCP connection ends with it.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/customers/oidc-client",
-        pathParams: ["project"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "NOT_CONFIGURED", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "members.list": {
-        name: "members.list",
-        summary: "List the organisation's members and pending invitations, with their roles.",
-        scope: "organization",
-        capability: "organization:manage",
-        destructive: false,
-        method: "GET",
-        path: "/org/members",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "UNAUTHENTICATED"],
-    },
-    "members.invite": {
-        name: "members.invite",
-        summary: "Invite someone by email as a Developer (member) or an Admin; they get an email to accept.",
-        scope: "organization",
-        capability: "organization:manage",
-        destructive: false,
-        method: "POST",
-        path: "/org/members/invitations",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "SESSION_REQUIRED", "UNAUTHENTICATED"],
-    },
-    "members.cancelInvitation": {
-        name: "members.cancelInvitation",
-        summary: "Cancel a pending invitation.",
-        scope: "organization",
-        capability: "organization:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/org/members/invitations/{invitation}",
-        pathParams: ["invitation"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "MEMBER_NOT_FOUND", "SESSION_REQUIRED", "UNAUTHENTICATED"],
-    },
-    "org.accessPolicy": {
-        name: "org.accessPolicy",
-        summary: "Show who may be invited: any email, or only approved email domains.",
-        scope: "organization",
-        capability: "organization:manage",
-        destructive: false,
-        method: "GET",
-        path: "/org/access-policy",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "UNAUTHENTICATED"],
-    },
-    "org.setAccessPolicy": {
-        name: "org.setAccessPolicy",
-        summary: "Choose who may be invited: any email, or only approved email domains.",
-        scope: "organization",
-        capability: "organization:manage",
-        destructive: false,
-        method: "PUT",
-        path: "/org/access-policy",
-        pathParams: [],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "UNAUTHENTICATED"],
-    },
-    "deployKeys.list": {
-        name: "deployKeys.list",
-        summary: "List the project's deploy keys (for CI), with when each was last used.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/deploy-keys",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "deployKeys.create": {
-        name: "deployKeys.create",
-        summary: "Create a deploy key for CI; its token is returned once.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/deploy-keys",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "deployKeys.revoke": {
-        name: "deployKeys.revoke",
-        summary: "Revoke a deploy key; CI using it stops deploying.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/deploy-keys/{key}",
-        pathParams: ["project", "key"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "KEY_NOT_FOUND", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "apiKeys.list": {
-        name: "apiKeys.list",
-        summary: "List the project's API keys and approved MCP connections, with their roles, scopes and customers.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "GET",
-        path: "/projects/{project}/api-keys",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "apiKeys.create": {
-        name: "apiKeys.create",
-        summary: "Create an API key with roles, scopes and which customers it may act for; its token is returned once.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: false,
-        method: "POST",
-        path: "/projects/{project}/api-keys",
-        pathParams: ["project"],
-        errors: ["FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-    "apiKeys.revoke": {
-        name: "apiKeys.revoke",
-        summary: "Revoke an API key or an approved MCP connection; it stops on its next call.",
-        scope: "project",
-        capability: "credentials:manage",
-        destructive: true,
-        method: "DELETE",
-        path: "/projects/{project}/api-keys/{key}",
-        pathParams: ["project", "key"],
-        errors: ["CONFIRMATION_REQUIRED", "FORBIDDEN", "INTERNAL", "INVALID_INPUT", "INVALID_REQUEST_ORIGIN", "KEY_NOT_FOUND", "PROJECT_HAS_SEVERAL_TARGETS", "PROJECT_NOT_FOUND", "UNAUTHENTICATED"],
-    },
-};