@ledewire/browser 0.8.1 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.ts CHANGED
@@ -114,6 +114,18 @@ declare class BrowserAuthNamespace {
114
114
  * Register a new buyer account with email and password.
115
115
  * Tokens are stored automatically after successful signup.
116
116
  *
117
+ * Pass `company_invitation_token` (from a Company invitation email) to sign
118
+ * up and join the Company in one step, or `invitation_token` (from a store
119
+ * invitation email) to join the store. If an invitation can't be accepted,
120
+ * nothing is created and the signup is refused; with both tokens it joins
121
+ * both or neither.
122
+ *
123
+ * @throws {LedewireError} With `statusCode === 422` and
124
+ * `type === 'invitation_not_accepted'` when an invitation token can't be
125
+ * accepted. `details.reason` says why (an `InvitationRefusalReason`) and
126
+ * `details.invitation` says which (`'store'` or `'company'`). A `409` still
127
+ * means only that the email is taken.
128
+ *
117
129
  * @param body - Signup credentials and display name.
118
130
  * @returns The authentication token response.
119
131
  */
@@ -130,6 +142,14 @@ declare class BrowserAuthNamespace {
130
142
  * Log in with a Google ID token obtained from the Google OAuth flow.
131
143
  * Tokens are stored automatically after successful login.
132
144
  *
145
+ * Pass `invitation_token` (store) or `company_invitation_token` (Company)
146
+ * from an invitation email to accept it as you sign in. When this call
147
+ * creates the account, an invitation that can't be accepted refuses the
148
+ * whole call with a `422` (`type === 'invitation_not_accepted'`, as for
149
+ * {@link signup}) and nothing is created. For an account that already
150
+ * exists, the sign-in succeeds either way and the response's `invitations`
151
+ * reports what happened to each token sent.
152
+ *
133
153
  * @param body - The Google ID token.
134
154
  * @returns The authentication token response.
135
155
  */
@@ -216,8 +236,10 @@ declare class BrowserClient {
216
236
  readonly content: BrowserContentNamespace;
217
237
  /** Seller operations: API key login, content list/search/get */
218
238
  readonly seller: BrowserSellerNamespace;
219
- /** Authenticated buyer account: API key management */
239
+ /** Authenticated buyer account: API keys, MCP keys, and the daily spend cap */
220
240
  readonly user: UserNamespace;
241
+ /** Company membership, and Company administration: members, Machine users, wallet, reports */
242
+ readonly company: CompanyNamespace;
221
243
  /* Excluded from this release type: __constructor */
222
244
  }
223
245
 
@@ -541,7 +563,24 @@ declare class BrowserWalletNamespace {
541
563
  * mid-acquisition can see why their balance is lower than their purchase
542
564
  * history explains.
543
565
  *
566
+ * **Company members:** a buyer with an open Company membership spends from the
567
+ * Company wallet and never sees its balance, so `balance_cents` and
568
+ * `spendable_cents` are `null`. `company_name` names the Company whose wallet
569
+ * pays, and `remaining_cents` is what the member may still spend today under
570
+ * their membership Spend cap. For anyone else, `company_name` is `null` and
571
+ * `remaining_cents` is their own cap's headroom (`null` when uncapped).
572
+ *
544
573
  * @returns The current wallet balance in cents, including held funds detail.
574
+ *
575
+ * @example
576
+ * ```ts
577
+ * const wallet = await lw.wallet.balance()
578
+ * if (wallet.company_name !== null) {
579
+ * console.log(`${wallet.company_name} pays; ${wallet.remaining_cents}c left today`)
580
+ * } else {
581
+ * console.log(`Balance: ${wallet.balance_cents}c`)
582
+ * }
583
+ * ```
545
584
  */
546
585
  balance(): Promise<WalletBalanceResponse>;
547
586
  /**
@@ -563,14 +602,21 @@ declare class BrowserWalletNamespace {
563
602
  */
564
603
  transactions(): Promise<WalletTransactionItem[]>;
565
604
  /**
566
- * Creates a payment session for funding the buyer's wallet.
605
+ * Creates a payment session for funding the buyer's personal wallet. A
606
+ * Company admin funds the Company wallet with
607
+ * `company.wallet.createPaymentSession()` instead.
567
608
  *
568
609
  * @param body - The amount and currency to fund.
569
610
  * @returns Payment session details for use with the payment provider widget.
570
611
  */
571
612
  createPaymentSession(body: WalletPaymentSessionRequest): Promise<WalletPaymentSessionResponse>;
572
613
  /**
573
- * Polls the status of a wallet funding payment session.
614
+ * Polls the status of a personal wallet funding payment session.
615
+ *
616
+ * `completed`, `failed` and `cancelled` are terminal. An ACH top-up can sit
617
+ * in `awaiting_verification` (bank microdeposits not yet confirmed) and then
618
+ * `processing` (the debit under way) for days before it completes.
619
+ * `balance_cents` is `null` for a Company member.
574
620
  *
575
621
  * @param sessionId - The session ID returned by `createPaymentSession`.
576
622
  * @returns The current payment status.
@@ -643,6 +689,694 @@ export declare type CheckoutState = CheckoutStateResponse;
643
689
  /** Full checkout state for a buyer/content pair, including auth and fund status. */
644
690
  export declare type CheckoutStateResponse = components['schemas']['CheckoutStateResponse'];
645
691
 
692
+ /**
693
+ * A pending invitation to join a Company. Joining always waits for the invitee
694
+ * to accept, because it moves their spending onto the Company wallet. Never
695
+ * carries the acceptance token, which reaches only the invited address.
696
+ */
697
+ export declare type CompanyInvitation = components['schemas']['CompanyInvitation'];
698
+
699
+ /** Request body for accepting a Company invitation. */
700
+ export declare type CompanyInvitationAcceptRequest = components['schemas']['CompanyInvitationAcceptRequest'];
701
+
702
+ /** The Company's pending invitations. */
703
+ export declare type CompanyInvitationList = components['schemas']['CompanyInvitationList'];
704
+
705
+ /** Request body for inviting someone to the Company. */
706
+ export declare type CompanyInvitationRequest = Omit<components['schemas']['CompanyInvitationRequest'], 'role'> & {
707
+ role?: CompanyRole;
708
+ };
709
+
710
+ /**
711
+ * Invite people to a Company, and accept an invitation.
712
+ *
713
+ * Nobody joins until they accept, because joining moves their spending onto
714
+ * the Company wallet. Every invitation emails a token that accepting requires,
715
+ * even for a buyer already signed in as the invited address. An existing buyer
716
+ * passes it to {@link accept}; a new address passes it to `auth.signup()` or
717
+ * `auth.loginWithGoogle()` as `company_invitation_token`, which creates the
718
+ * account and joins in one step.
719
+ *
720
+ * `list()`, `create()` and `revoke()` are Company-admin only; `accept()` is for
721
+ * the invitee.
722
+ *
723
+ * Obtain via `client.company.invitations` — do not construct directly.
724
+ *
725
+ * @example
726
+ * ```ts
727
+ * // Admin: invite an analyst
728
+ * await client.company.invitations.create({ email: 'analyst@example.com' })
729
+ *
730
+ * // Invitee (already has an account): accept with the emailed token
731
+ * const membership = await client.company.invitations.accept({ token })
732
+ * ```
733
+ */
734
+ declare class CompanyInvitationsNamespace {
735
+ private readonly http;
736
+ /* Excluded from this release type: __constructor */
737
+ /**
738
+ * Lists the Company's pending invitations. Company admins only.
739
+ *
740
+ * @returns The pending invitations.
741
+ * @throws {ForbiddenError} When the caller is not a Company admin.
742
+ * @throws {NotFoundError} When the caller belongs to no Company.
743
+ */
744
+ list(): Promise<CompanyInvitationList>;
745
+ /**
746
+ * Invites someone to the Company and emails them the acceptance token.
747
+ * Company admins only. Inviting someone who belongs to another Company
748
+ * succeeds; their accept is refused until they leave it.
749
+ *
750
+ * @param body - The invitee's email, and their role (default `'member'`).
751
+ * @returns The invitation. It expires seven days after it is sent.
752
+ * @throws {ForbiddenError} When the caller is not a Company admin.
753
+ * @throws {LedewireError} With `statusCode === 409` when the address is
754
+ * already a member or already has a pending invitation.
755
+ */
756
+ create(body: CompanyInvitationRequest): Promise<CompanyInvitation>;
757
+ /**
758
+ * Revokes a pending invitation. Company admins only. The emailed token can no
759
+ * longer be accepted, and the address can be invited again at once rather
760
+ * than when this invitation would have expired.
761
+ *
762
+ * @param id - The invitation id (`CompanyInvitation.id`).
763
+ * @throws {ForbiddenError} When the caller is not a Company admin.
764
+ * @throws {NotFoundError} When the caller belongs to no Company, or the
765
+ * invitation is not one of its own.
766
+ * @throws {LedewireError} With `statusCode === 409` when the invitation is no
767
+ * longer pending (accepted, already revoked, or expired).
768
+ */
769
+ revoke(id: string): Promise<void>;
770
+ /**
771
+ * Accepts an invitation, opening a membership with the invited role. The
772
+ * token must belong to an invitation addressed to one of the buyer's
773
+ * addresses.
774
+ *
775
+ * Every refusal carries `type === 'invitation_not_accepted'` and the reason
776
+ * as `details.reason` (an `InvitationRefusalReason`).
777
+ *
778
+ * @param body - The token from the invitation email.
779
+ * @returns The new membership.
780
+ * @throws {NotFoundError} When no invitation with this token is addressed to
781
+ * this buyer (`details.reason === 'not_found'`).
782
+ * @throws {LedewireError} With `statusCode === 409` when already accepted
783
+ * (`'already_accepted'`), or when the buyer already belongs to a Company
784
+ * (`'already_in_company'`; leave it first); with `statusCode === 410` when
785
+ * the invitation has expired or was withdrawn (`'expired'`).
786
+ */
787
+ accept(body: CompanyInvitationAcceptRequest): Promise<CompanyMembership>;
788
+ }
789
+
790
+ /**
791
+ * A Machine user: a Buyer with a name and no email, password or login, owned by
792
+ * a Company and joined as a non-admin member. It authenticates only with the
793
+ * Buyer keys and MCP API keys a Company admin issues it. Deactivation is
794
+ * permanent.
795
+ */
796
+ export declare type CompanyMachineUser = components['schemas']['CompanyMachineUser'];
797
+
798
+ /**
799
+ * A Machine user's Buyer key (secret never included after creation). It logs in
800
+ * through `auth.loginWithBuyerApiKey()`; its limit is the Machine user's
801
+ * membership Spend cap.
802
+ */
803
+ export declare type CompanyMachineUserBuyerKey = components['schemas']['CompanyMachineUserBuyerKey'];
804
+
805
+ /** Request body for creating a Machine user's Buyer key. */
806
+ export declare type CompanyMachineUserBuyerKeyCreateRequest = components['schemas']['CompanyMachineUserBuyerKeyRequest'];
807
+
808
+ /**
809
+ * Returned once when a Machine user's Buyer key is created. The `secret` is
810
+ * shown exactly once and cannot be retrieved again.
811
+ */
812
+ export declare type CompanyMachineUserBuyerKeyCreateResponse = components['schemas']['CompanyMachineUserBuyerKeyCreateResponse'];
813
+
814
+ /** A Machine user's Buyer keys, oldest first. */
815
+ export declare type CompanyMachineUserBuyerKeyList = components['schemas']['CompanyMachineUserBuyerKeyList'];
816
+
817
+ /**
818
+ * Issue and revoke a Machine user's Buyer keys. Company admins only.
819
+ *
820
+ * A Machine user's Buyer key logs in through `auth.loginWithBuyerApiKey()` (or
821
+ * `createAgentClient()`), exactly like a buyer's own key. Its spending limit is
822
+ * the Machine user's membership Spend cap, so a key carries no
823
+ * `spending_limit_cents` of its own.
824
+ *
825
+ * **Secret handling:** `create()` returns the `secret` exactly once.
826
+ *
827
+ * Obtain via `client.company.machineUsers.buyerKeys` — do not construct directly.
828
+ */
829
+ declare class CompanyMachineUserBuyerKeysNamespace {
830
+ private readonly http;
831
+ /* Excluded from this release type: __constructor */
832
+ /**
833
+ * Lists a Machine user's Buyer keys, oldest first. Secrets are never included.
834
+ *
835
+ * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
836
+ * @returns The keys.
837
+ * @throws {NotFoundError} When the Machine user is not in the caller's Company.
838
+ */
839
+ list(machineUserId: string): Promise<CompanyMachineUserBuyerKeyList>;
840
+ /**
841
+ * Creates a Buyer key for a Machine user.
842
+ *
843
+ * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
844
+ * @param body - The key's name, unique among this Machine user's Buyer keys.
845
+ * @returns The key with its one-time `secret` — store it immediately.
846
+ * @throws {LedewireError} With `statusCode === 409` when the Machine user is
847
+ * deactivated; with `statusCode === 422` for a duplicate name.
848
+ */
849
+ create(machineUserId: string, body: CompanyMachineUserBuyerKeyCreateRequest): Promise<CompanyMachineUserBuyerKeyCreateResponse>;
850
+ /**
851
+ * Revokes a Machine user's Buyer key.
852
+ *
853
+ * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
854
+ * @param id - The key id.
855
+ * @throws {NotFoundError} When there is no such Machine user in the caller's
856
+ * Company, or no such active key.
857
+ */
858
+ revoke(machineUserId: string, id: string): Promise<void>;
859
+ }
860
+
861
+ /** Request body for creating a Machine user. */
862
+ export declare type CompanyMachineUserCreateRequest = components['schemas']['CompanyMachineUserRequest'];
863
+
864
+ /** The Company's Machine users. */
865
+ export declare type CompanyMachineUserList = components['schemas']['CompanyMachineUserList'];
866
+
867
+ /**
868
+ * A Machine user's active MCP API key. Carries buyer scopes only
869
+ * (`mcp:search`, `mcp:purchase`), never a store, and does not expire.
870
+ */
871
+ export declare type CompanyMachineUserMcpKey = components['schemas']['CompanyMachineUserMcpKey'];
872
+
873
+ /** Request body for creating a Machine user's MCP API key. */
874
+ export declare type CompanyMachineUserMcpKeyCreateRequest = components['schemas']['CompanyMachineUserMcpKeyRequest'];
875
+
876
+ /**
877
+ * Returned once when a Machine user's MCP API key is created. The `secret` is
878
+ * shown exactly once and cannot be retrieved again.
879
+ */
880
+ export declare type CompanyMachineUserMcpKeyCreateResponse = components['schemas']['CompanyMachineUserMcpKeyCreateResponse'];
881
+
882
+ /** A Machine user's MCP API keys, oldest first. */
883
+ export declare type CompanyMachineUserMcpKeyList = components['schemas']['CompanyMachineUserMcpKeyList'];
884
+
885
+ /**
886
+ * Issue and revoke a Machine user's MCP API keys. Company admins only.
887
+ *
888
+ * A Machine user's MCP key carries buyer scopes only — `mcp:search` and
889
+ * `mcp:purchase` — never a store, and does not expire; revoke it instead. It is
890
+ * presented to the Ledewire MCP server as `Authorization: Bearer <key>:<secret>`.
891
+ *
892
+ * **Secret handling:** `create()` returns the `secret` exactly once.
893
+ *
894
+ * Obtain via `client.company.machineUsers.mcpKeys` — do not construct directly.
895
+ */
896
+ declare class CompanyMachineUserMcpKeysNamespace {
897
+ private readonly http;
898
+ /* Excluded from this release type: __constructor */
899
+ /**
900
+ * Lists a Machine user's active MCP API keys, oldest first. Secrets are never
901
+ * included.
902
+ *
903
+ * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
904
+ * @returns The keys.
905
+ * @throws {NotFoundError} When the Machine user is not in the caller's Company.
906
+ */
907
+ list(machineUserId: string): Promise<CompanyMachineUserMcpKeyList>;
908
+ /**
909
+ * Creates an MCP API key for a Machine user.
910
+ *
911
+ * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
912
+ * @param body - A label and at least one of `'mcp:search'`, `'mcp:purchase'`.
913
+ * Any other scope, or a `store_id`, is refused with `400`.
914
+ * @returns The key with its one-time `secret` — store it immediately.
915
+ * @throws {LedewireError} With `statusCode === 409` when the Machine user is
916
+ * deactivated; with `statusCode === 422` for a duplicate label.
917
+ */
918
+ create(machineUserId: string, body: CompanyMachineUserMcpKeyCreateRequest): Promise<CompanyMachineUserMcpKeyCreateResponse>;
919
+ /**
920
+ * Revokes a Machine user's MCP API key.
921
+ *
922
+ * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
923
+ * @param id - The key id.
924
+ * @throws {NotFoundError} When there is no such Machine user in the caller's
925
+ * Company, or no such active key.
926
+ */
927
+ revoke(machineUserId: string, id: string): Promise<void>;
928
+ }
929
+
930
+ /**
931
+ * Manage the Company's Machine users. Company admins only.
932
+ *
933
+ * A Machine user is a Buyer with a name and no email, password or login — an
934
+ * identity for an autonomous agent that spends the Company's money. It joins at
935
+ * once as a non-admin member with the default daily Spend cap (change it with
936
+ * `company.members.update()`), and authenticates only with the keys an admin
937
+ * issues it through {@link buyerKeys} and {@link mcpKeys}. Every human-only flow
938
+ * (login, Google sign-in, password reset, accepting or leaving a membership)
939
+ * refuses it.
940
+ *
941
+ * Obtain via `client.company.machineUsers` — do not construct directly.
942
+ *
943
+ * @example
944
+ * ```ts
945
+ * const agentUser = await client.company.machineUsers.create({ name: 'research-agent' })
946
+ * const { key, secret } = await client.company.machineUsers.buyerKeys.create(agentUser.id, {
947
+ * name: 'production',
948
+ * })
949
+ * // Store immediately — the secret cannot be retrieved again
950
+ * await secretsManager.put('LEDEWIRE_AGENT_KEY', `${key}:${secret}`)
951
+ *
952
+ * // The agent then authenticates as the Machine user (server-side, @ledewire/node)
953
+ * const agent = createAgentClient({ key, secret })
954
+ * ```
955
+ */
956
+ declare class CompanyMachineUsersNamespace {
957
+ private readonly http;
958
+ /** A Machine user's Buyer keys: list, create, revoke. */
959
+ readonly buyerKeys: CompanyMachineUserBuyerKeysNamespace;
960
+ /** A Machine user's MCP API keys: list, create, revoke. */
961
+ readonly mcpKeys: CompanyMachineUserMcpKeysNamespace;
962
+ /* Excluded from this release type: __constructor */
963
+ /**
964
+ * Lists the Company's Machine users, deactivated ones included
965
+ * (`deactivated_at` set).
966
+ *
967
+ * @returns The Machine users.
968
+ * @throws {ForbiddenError} When the caller is not a Company admin.
969
+ * @throws {NotFoundError} When the caller belongs to no Company.
970
+ */
971
+ list(): Promise<CompanyMachineUserList>;
972
+ /**
973
+ * Creates a Machine user, joined at once as an active non-admin member.
974
+ *
975
+ * @param body - A name (at most 100 characters, unique among the Company's
976
+ * active Machine users) and an optional description.
977
+ * @returns The Machine user.
978
+ * @throws {LedewireError} With `statusCode === 409` when an active Machine
979
+ * user already has this name; with `statusCode === 422` when the name is
980
+ * blank or too long.
981
+ */
982
+ create(body: CompanyMachineUserCreateRequest): Promise<CompanyMachineUser>;
983
+ /**
984
+ * Renames a Machine user or changes its description, under the same name
985
+ * rules as {@link create}. Its keys and sessions are untouched, so the agent
986
+ * keeps working without being re-issued anything. Company reports read the
987
+ * name live, so `company.members`, `company.purchases` and `company.spend`
988
+ * show the new name on earlier rows as well as later ones.
989
+ *
990
+ * @param id - The Machine user id (`CompanyMachineUser.id`).
991
+ * @param body - A new `name`, a new `description` (`null` clears it), or both.
992
+ * @returns The updated Machine user.
993
+ * @throws {NotFoundError} When the Machine user is not in the caller's Company.
994
+ * @throws {LedewireError} With `statusCode === 409` when another active
995
+ * Machine user has this name, or this one is deactivated; with
996
+ * `statusCode === 422` when the name is blank or too long.
997
+ */
998
+ update(id: string, body: CompanyMachineUserUpdateRequest): Promise<CompanyMachineUser>;
999
+ /**
1000
+ * Deactivates a Machine user, **permanently**. In one step this closes its
1001
+ * membership, revokes every key it holds, and ends its sessions. It cannot be
1002
+ * reactivated; create a new one, which may reuse the name.
1003
+ *
1004
+ * @param id - The Machine user id (`CompanyMachineUser.id`).
1005
+ * @returns The deactivated Machine user.
1006
+ * @throws {NotFoundError} When the Machine user is not in the caller's Company.
1007
+ * @throws {LedewireError} With `statusCode === 409` when already deactivated.
1008
+ */
1009
+ deactivate(id: string): Promise<CompanyMachineUser>;
1010
+ }
1011
+
1012
+ /**
1013
+ * Request body for renaming a Machine user or changing its description. Give
1014
+ * at least one of the two. A `null` or blank `description` clears it; `name`
1015
+ * cannot be `null`, and is at most 100 characters.
1016
+ *
1017
+ * Hand-written: the spec expresses "at least one" as an `anyOf`, which the
1018
+ * generator widens to `unknown`.
1019
+ */
1020
+ export declare type CompanyMachineUserUpdateRequest = {
1021
+ name: string;
1022
+ description?: string | null;
1023
+ } | {
1024
+ name?: string;
1025
+ description: string | null;
1026
+ };
1027
+
1028
+ /**
1029
+ * An open Company membership as a Company admin sees it. `id` is the membership
1030
+ * id the `company.members` methods take — not the member's `user_id`.
1031
+ */
1032
+ export declare type CompanyMember = components['schemas']['CompanyMember'];
1033
+
1034
+ /** The Company's open memberships. */
1035
+ export declare type CompanyMemberList = components['schemas']['CompanyMemberList'];
1036
+
1037
+ /**
1038
+ * The authenticated buyer's own open Company membership. Names the Company but
1039
+ * never its balance: a member sees only what they may still spend.
1040
+ */
1041
+ export declare type CompanyMembership = components['schemas']['CompanyMembership'];
1042
+
1043
+ /**
1044
+ * Read or close the authenticated buyer's own Company membership.
1045
+ *
1046
+ * While a buyer holds an open membership, the Company wallet pays for their
1047
+ * purchases and their own membership Spend cap limits them. They never see the
1048
+ * Company balance: `wallet.balance()` reports `balance_cents: null` and a
1049
+ * `remaining_cents` allowance instead, with `company_name` naming whose wallet
1050
+ * pays.
1051
+ *
1052
+ * Obtain via `client.company.membership` — do not construct directly.
1053
+ *
1054
+ * @example
1055
+ * ```ts
1056
+ * try {
1057
+ * const { company_name, role } = await client.company.membership.get()
1058
+ * console.log(`Purchases are paid by ${company_name} (${role})`)
1059
+ * } catch (err) {
1060
+ * if (err instanceof NotFoundError) console.log('Not in a Company')
1061
+ * else throw err
1062
+ * }
1063
+ * ```
1064
+ */
1065
+ declare class CompanyMembershipNamespace {
1066
+ private readonly http;
1067
+ /* Excluded from this release type: __constructor */
1068
+ /**
1069
+ * Returns the authenticated buyer's open Company membership. Names the
1070
+ * Company, never its balance.
1071
+ *
1072
+ * @returns The membership.
1073
+ * @throws {NotFoundError} When the buyer belongs to no Company.
1074
+ */
1075
+ get(): Promise<CompanyMembership>;
1076
+ /**
1077
+ * Leaves the Company. The buyer's purchases are paid from their personal
1078
+ * wallet again afterwards.
1079
+ *
1080
+ * @throws {NotFoundError} When the buyer belongs to no Company.
1081
+ * @throws {ForbiddenError} For a Machine user, which cannot leave — an admin
1082
+ * deactivates it instead.
1083
+ * @throws {LedewireError} With `statusCode === 422` when the buyer is the
1084
+ * Company's last admin.
1085
+ */
1086
+ leave(): Promise<void>;
1087
+ }
1088
+
1089
+ /**
1090
+ * Manage the Company's open memberships: list them, change a member's role or
1091
+ * daily Spend cap, and remove a member. Company admins only.
1092
+ *
1093
+ * Every method takes the **membership id** (`CompanyMember.id`), not the
1094
+ * member's `user_id`.
1095
+ *
1096
+ * A member's daily Spend cap is never `null` — Company members are never
1097
+ * uncapped. It defaults to 1000 cents ($10) on joining, is read in the
1098
+ * Company's timezone, and also binds bulk acquisitions.
1099
+ *
1100
+ * Obtain via `client.company.members` — do not construct directly.
1101
+ *
1102
+ * @example
1103
+ * ```ts
1104
+ * const { data: members } = await client.company.members.list()
1105
+ * const analyst = members.find((m) => m.email === 'analyst@example.com')
1106
+ * if (analyst) {
1107
+ * await client.company.members.update(analyst.id, { daily_spend_limit_cents: 5000 })
1108
+ * }
1109
+ * ```
1110
+ */
1111
+ declare class CompanyMembersNamespace {
1112
+ private readonly http;
1113
+ /* Excluded from this release type: __constructor */
1114
+ /**
1115
+ * Lists the Company's open memberships, Machine users included
1116
+ * (`kind: 'machine'`, `email: null`).
1117
+ *
1118
+ * @returns The members.
1119
+ * @throws {ForbiddenError} When the caller is not a Company admin.
1120
+ * @throws {NotFoundError} When the caller belongs to no Company.
1121
+ */
1122
+ list(): Promise<CompanyMemberList>;
1123
+ /**
1124
+ * Changes a member's role, daily Spend cap, or both. Any admin may set any
1125
+ * member's cap, their own included.
1126
+ *
1127
+ * @param id - The membership id (`CompanyMember.id`).
1128
+ * @param body - At least one of `role` and `daily_spend_limit_cents`.
1129
+ * @returns The updated member.
1130
+ * @throws {LedewireError} With `statusCode === 400` when neither field is
1131
+ * given or the cap is `null`/negative; with `statusCode === 422` for an
1132
+ * unknown role, or a change that would leave the Company with no admin.
1133
+ */
1134
+ update(id: string, body: CompanyMemberUpdateRequest): Promise<CompanyMember>;
1135
+ /**
1136
+ * Removes a member, closing their membership. Their ledger accounts stay
1137
+ * with the Company. Removing a Machine user deactivates it permanently.
1138
+ *
1139
+ * @param id - The membership id (`CompanyMember.id`).
1140
+ * @throws {LedewireError} With `statusCode === 422` when it would leave the
1141
+ * Company with no admin.
1142
+ */
1143
+ remove(id: string): Promise<void>;
1144
+ }
1145
+
1146
+ /**
1147
+ * Request body for changing a member's role or daily Spend cap — at least one
1148
+ * of the two. `daily_spend_limit_cents` cannot be `null`: a Company member is
1149
+ * never uncapped.
1150
+ */
1151
+ export declare type CompanyMemberUpdateRequest = components['schemas']['CompanyMemberRoleRequest'];
1152
+
1153
+ /**
1154
+ * Company operations for the authenticated buyer.
1155
+ *
1156
+ * A Company is a shared wallet that pays for its members' purchases. Each
1157
+ * member spends under their own daily Spend cap, set by a Company admin, and
1158
+ * never sees the Company balance. Admins fund the wallet, manage members and
1159
+ * Machine users (agent identities with no login), and report on spend.
1160
+ *
1161
+ * `membership` and `invitations.accept()` are for any buyer; everything else is
1162
+ * Company-admin only and throws {@link ForbiddenError} for a plain member.
1163
+ *
1164
+ * Obtain via `client.company` — do not construct directly.
1165
+ */
1166
+ declare class CompanyNamespace {
1167
+ /** The authenticated buyer's own membership: read it, or leave the Company. */
1168
+ readonly membership: CompanyMembershipNamespace;
1169
+ /** Invite people to the Company (admin), and accept an invitation (invitee). */
1170
+ readonly invitations: CompanyInvitationsNamespace;
1171
+ /** List members, change a member's role or daily Spend cap, remove a member (admin). */
1172
+ readonly members: CompanyMembersNamespace;
1173
+ /** Machine users and their Buyer keys and MCP API keys (admin). */
1174
+ readonly machineUsers: CompanyMachineUsersNamespace;
1175
+ /** Read and fund the Company wallet, and list unsettled top-ups (admin). */
1176
+ readonly wallet: CompanyWalletNamespace;
1177
+ /** Everything the Company paid for, attributed to its members (admin). */
1178
+ readonly purchases: CompanyPurchasesNamespace;
1179
+ /** What each member has spent of the Company's money (admin). */
1180
+ readonly spend: CompanySpendNamespace;
1181
+ /* Excluded from this release type: __constructor */
1182
+ }
1183
+
1184
+ /** A Company wallet top-up that has not settled yet. */
1185
+ export declare type CompanyPendingTopUp = components['schemas']['CompanyPendingTopUp'];
1186
+
1187
+ /** The Company's unsettled top-ups, newest first. */
1188
+ export declare type CompanyPendingTopUpList = components['schemas']['CompanyPendingTopUpList'];
1189
+
1190
+ /**
1191
+ * One thing the Company paid for — a purchase or a Bulk acquisition drawn on
1192
+ * the Company wallet — attributed to the membership that bought it.
1193
+ */
1194
+ export declare type CompanyPurchase = components['schemas']['CompanyPurchase'];
1195
+
1196
+ /** Everything the Company paid for, newest first, paginated. */
1197
+ export declare type CompanyPurchaseList = components['schemas']['CompanyPurchaseList'];
1198
+
1199
+ /**
1200
+ * The membership a {@link CompanyPurchase} or spend row is attributed to.
1201
+ * Recorded at payment time, so it still names a member who has since left.
1202
+ */
1203
+ export declare type CompanyPurchaseMember = components['schemas']['CompanyPurchaseMember'];
1204
+
1205
+ /**
1206
+ * Everything the Company paid for. Company admins only.
1207
+ *
1208
+ * Obtain via `client.company.purchases` — do not construct directly.
1209
+ *
1210
+ * @example
1211
+ * ```ts
1212
+ * const { data, pagination } = await client.company.purchases.list({
1213
+ * kind: 'bulk_acquisition',
1214
+ * from: '2026-09-01',
1215
+ * to: '2026-09-30',
1216
+ * })
1217
+ * ```
1218
+ */
1219
+ declare class CompanyPurchasesNamespace {
1220
+ private readonly http;
1221
+ /* Excluded from this release type: __constructor */
1222
+ /**
1223
+ * Lists every purchase and Bulk acquisition drawn on the Company wallet,
1224
+ * newest first, each attributed to the membership that bought it — including
1225
+ * members who have since left. A Bulk acquisition's per-work purchases are
1226
+ * not listed separately, and a failed purchase is not listed.
1227
+ *
1228
+ * A Bulk acquisition's corpus and manifest are reachable by a Company admin
1229
+ * through `acquisitions.getCorpus()` / `downloadCorpus()` / `getManifest()`
1230
+ * with its `id`.
1231
+ *
1232
+ * @param params - Optional filters (`member`, `from`, `to`, `kind`) and pagination.
1233
+ * @returns A paginated list of Company purchases.
1234
+ * @throws {ForbiddenError} When the caller is not a Company admin.
1235
+ * @throws {LedewireError} With `statusCode === 400` for an invalid filter.
1236
+ */
1237
+ list(params?: CompanyPurchasesParams): Promise<CompanyPurchaseList>;
1238
+ }
1239
+
1240
+ /** Query parameters accepted by `GET /v1/company/purchases`. */
1241
+ export declare interface CompanyPurchasesParams extends CompanyReportFilters {
1242
+ /** Only purchases, or only Bulk acquisitions. Both by default. */
1243
+ kind?: CompanyPurchase['kind'];
1244
+ /** Page number (1-based). Defaults to 1. */
1245
+ page?: number;
1246
+ /** Items per page. Maximum 100. Defaults to 25. */
1247
+ per_page?: number;
1248
+ }
1249
+
1250
+ /**
1251
+ * Filters shared by the Company purchase and spend reports. `from`/`to` are
1252
+ * inclusive `YYYY-MM-DD` days read in the Company's timezone.
1253
+ */
1254
+ export declare interface CompanyReportFilters {
1255
+ /** A membership id (`member.id`), open or closed. */
1256
+ member?: string;
1257
+ /** The first day to include, `YYYY-MM-DD`, in the Company's timezone. */
1258
+ from?: string;
1259
+ /** The last day to include, `YYYY-MM-DD`, in the Company's timezone. */
1260
+ to?: string;
1261
+ [key: string]: string | number | undefined;
1262
+ }
1263
+
1264
+ /** A Company membership role. Only an `admin` can manage the Company. */
1265
+ export declare type CompanyRole = CompanyMembership['role'];
1266
+
1267
+ /** What each membership, open or closed, has spent of the Company's money. */
1268
+ export declare type CompanySpendList = components['schemas']['CompanySpendList'];
1269
+
1270
+ /**
1271
+ * What each member has spent of the Company's money. Company admins only.
1272
+ *
1273
+ * Obtain via `client.company.spend` — do not construct directly.
1274
+ *
1275
+ * @example
1276
+ * ```ts
1277
+ * const { data } = await client.company.spend.list({ from: '2026-09-01' })
1278
+ * for (const { member, spend_cents } of data) console.log(member.name, spend_cents)
1279
+ * ```
1280
+ */
1281
+ declare class CompanySpendNamespace {
1282
+ private readonly http;
1283
+ /* Excluded from this release type: __constructor */
1284
+ /**
1285
+ * Returns one row per membership the Company has had, open or closed, oldest
1286
+ * first, with what each spent in the range — lifetime when neither `from`
1287
+ * nor `to` is given.
1288
+ *
1289
+ * `spend_cents` is net of refunds and counts what a Bulk acquisition
1290
+ * captured; a live hold does not count until it captures, so it can be lower
1291
+ * than the same member's `amount_cents` in `company.purchases.list()`.
1292
+ *
1293
+ * @param params - Optional `member`, `from`, and `to` filters.
1294
+ * @returns Spend per membership.
1295
+ * @throws {ForbiddenError} When the caller is not a Company admin.
1296
+ * @throws {LedewireError} With `statusCode === 400` for an invalid filter.
1297
+ */
1298
+ list(params?: CompanySpendParams): Promise<CompanySpendList>;
1299
+ }
1300
+
1301
+ /**
1302
+ * Query parameters accepted by `GET /v1/company/spend`. Lifetime spend when
1303
+ * neither `from` nor `to` is given.
1304
+ */
1305
+ export declare type CompanySpendParams = CompanyReportFilters;
1306
+
1307
+ /**
1308
+ * The Company wallet as a Company admin sees it: the spendable balance, what
1309
+ * in-flight Bulk acquisitions hold, and what top-ups are on their way. The only
1310
+ * response that carries the Company balance.
1311
+ */
1312
+ export declare type CompanyWallet = components['schemas']['CompanyWallet'];
1313
+
1314
+ /**
1315
+ * Read the Company wallet, fund it, and track top-ups that have not settled.
1316
+ * Company admins only.
1317
+ *
1318
+ * Members never see the Company balance and cannot fund the Company wallet; a
1319
+ * member who runs short is refused at purchase and must ask an admin. Even for
1320
+ * an admin, `wallet.balance()` reports no Company balance: {@link get} is the
1321
+ * only place it appears.
1322
+ *
1323
+ * Obtain via `client.company.wallet` — do not construct directly.
1324
+ *
1325
+ * @example
1326
+ * ```ts
1327
+ * const { balance_cents, held_cents, pending_top_up_cents } = await client.company.wallet.get()
1328
+ *
1329
+ * const session = await client.company.wallet.createPaymentSession({ amount_cents: 50000 })
1330
+ * // Confirm with session.client_secret in the payment widget, as for a personal top-up.
1331
+ *
1332
+ * const { data: pending } = await client.company.wallet.listPendingTopUps()
1333
+ * ```
1334
+ */
1335
+ declare class CompanyWalletNamespace {
1336
+ private readonly http;
1337
+ /* Excluded from this release type: __constructor */
1338
+ /**
1339
+ * Reads the Company wallet: the spendable `balance_cents` (money held by
1340
+ * in-flight Bulk acquisitions is already out of it, and it goes negative when
1341
+ * a reversed top-up takes the wallet below zero), `held_cents` committed to
1342
+ * Company-paid Bulk acquisitions still in progress, and
1343
+ * `pending_top_up_cents`, the total of {@link listPendingTopUps}.
1344
+ *
1345
+ * @returns The Company wallet.
1346
+ * @throws {ForbiddenError} When the caller is not a Company admin.
1347
+ * @throws {NotFoundError} When the caller belongs to no Company.
1348
+ */
1349
+ get(): Promise<CompanyWallet>;
1350
+ /**
1351
+ * Starts a Company wallet top-up, by card or ACH (`us_bank_account`). Confirm
1352
+ * it client-side with the returned `client_secret`, as for a personal top-up.
1353
+ *
1354
+ * The top-up is spendable only once it settles: a card usually settles at
1355
+ * once, an ACH debit after about four business days. Starting another top-up
1356
+ * never cancels an ACH debit already processing. Track it with
1357
+ * {@link listPendingTopUps}: a top-up drops off that list once it settles.
1358
+ * (`wallet.getPaymentStatus()` covers personal top-ups only and does not
1359
+ * find a Company session.)
1360
+ *
1361
+ * @param body - The amount to fund.
1362
+ * @returns Payment session details for the payment provider widget.
1363
+ * @throws {ForbiddenError} When the caller is not a Company admin.
1364
+ * @throws {LedewireError} With `statusCode === 402` when the payment provider
1365
+ * refused to create the session.
1366
+ */
1367
+ createPaymentSession(body: WalletPaymentSessionRequest): Promise<WalletPaymentSessionResponse>;
1368
+ /**
1369
+ * Lists the Company's top-ups that are not yet spendable, newest first:
1370
+ * `pending` (a session not yet paid), `awaiting_verification` (a bank account
1371
+ * whose microdeposits are not yet confirmed, up to ten days), and
1372
+ * `processing` (an ACH debit under way).
1373
+ *
1374
+ * @returns The pending top-ups.
1375
+ * @throws {ForbiddenError} When the caller is not a Company admin.
1376
+ */
1377
+ listPendingTopUps(): Promise<CompanyPendingTopUpList>;
1378
+ }
1379
+
646
1380
  declare interface components {
647
1381
  schemas: {
648
1382
  /** @description Platform-level public configuration. No authentication required. */
@@ -653,10 +1387,19 @@ declare interface components {
653
1387
  ContentAccessInfo: {
654
1388
  user_id: string | null;
655
1389
  has_purchased: boolean;
1390
+ /** @description Whether the buyer can afford the price. For a Company member, whether their Remaining covers it — the Company balance is never consulted, and a shortfall there surfaces only as the refusal at purchase. */
656
1391
  has_sufficient_funds: boolean;
657
- wallet_balance_cents: number;
658
- /** @enum {string} */
1392
+ /** @description The buyer's wallet balance. null for a Company member, who never sees the Company balance. */
1393
+ wallet_balance_cents: number | null;
1394
+ /**
1395
+ * @description Never fund_wallet for a Company member, who cannot fund the Company wallet.
1396
+ * @enum {string}
1397
+ */
659
1398
  next_required_action: 'authenticate' | 'fund_wallet' | 'purchase';
1399
+ /** @description Spend cap minus spend so far today — for a Company member, their membership's cap. null when the buyer is uncapped or unauthenticated. */
1400
+ remaining_cents: number | null;
1401
+ /** @description The buyer's Company, if they hold an open membership. */
1402
+ company_name: string | null;
660
1403
  };
661
1404
  AuthenticationResponse: {
662
1405
  /** @enum {string} */
@@ -666,9 +1409,37 @@ declare interface components {
666
1409
  refresh_token: string;
667
1410
  /**
668
1411
  * Format: date-time
669
- * @description When the Access Token expires
1412
+ * @description When the access token expires, about 30 minutes after it was issued. Equal to the token's `exp` claim. Refresh before then.
670
1413
  */
671
1414
  expires_at: string;
1415
+ /** @description Present only on `POST /v1/auth/login/google` for an account that already existed, when the call carried `invitation_token` or `company_invitation_token`. One entry per token sent. A refused invitation does not refuse the sign-in; it is reported here instead. */
1416
+ invitations?: {
1417
+ store?: components['schemas']['InvitationOutcome'];
1418
+ company?: components['schemas']['InvitationOutcome'];
1419
+ };
1420
+ };
1421
+ InvitationOutcome: {
1422
+ accepted: boolean;
1423
+ reason?: components['schemas']['InvitationRefusalReason'];
1424
+ /** @description The refusal in words, for display. Present when `accepted` is false. */
1425
+ message?: string;
1426
+ };
1427
+ /**
1428
+ * @description Why an invitation was not accepted. `not_found` also covers a Company invitation addressed to another email, deliberately indistinguishable; `expired` covers a withdrawn one; `wrong_email` is a store invitation sent to another address; `already_in_company` means the account belongs to another Company and must leave it first; `already_member` means it already belongs to the store; `invalid` is an invitation that could not be saved.
1429
+ * @enum {string}
1430
+ */
1431
+ InvitationRefusalReason: 'not_found' | 'already_accepted' | 'expired' | 'wrong_email' | 'already_in_company' | 'already_member' | 'invalid';
1432
+ /** @description An invitation refused. Signup and Google sign-in return it with HTTP 422 and name the `invitation`; `POST /v1/company/invitations/accept` returns it with its own status (404, 409 or 410) and no `invitation`. */
1433
+ InvitationNotAcceptedError: {
1434
+ error: {
1435
+ code: number;
1436
+ message: string;
1437
+ /** @enum {string} */
1438
+ type: 'invitation_not_accepted';
1439
+ };
1440
+ reason: components['schemas']['InvitationRefusalReason'];
1441
+ /** @enum {string} */
1442
+ invitation?: 'store' | 'company';
672
1443
  };
673
1444
  /** @description Token response for merchant authentication. Includes stores the user has access to so the client can prompt for store selection. */
674
1445
  MerchantAuthenticationResponse: {
@@ -676,7 +1447,10 @@ declare interface components {
676
1447
  token_type: 'Bearer';
677
1448
  access_token: string;
678
1449
  refresh_token: string;
679
- /** Format: date-time */
1450
+ /**
1451
+ * Format: date-time
1452
+ * @description When the access token expires, about 30 minutes after it was issued. Equal to the token's `exp` claim. Refresh before then.
1453
+ */
680
1454
  expires_at: string;
681
1455
  /** @description Stores the authenticated user can manage, for store-selection on the client. */
682
1456
  stores: components['schemas']['MerchantLoginStore'][];
@@ -731,15 +1505,23 @@ declare interface components {
731
1505
  message: string;
732
1506
  /**
733
1507
  * @description Machine-readable reason, present on refusals that carry one. Branch on this rather than on `message`, which is prose and may be reworded. `retrieval_failed` is transient and worth retrying; `not_licensable` means report it undelivered; `price_drifted` means re-quote; `client_error` is ours to fix and must never be retried unchanged; `insufficient_funds` is cleared by funding the wallet and `daily_spend_cap_reached` deliberately is not.
1508
+ *
1509
+ * On the Bulk acquisition steps: `exclusions_unacknowledged` means post the acknowledgement first; `quote_not_ready` means keep polling a `pending` quote or re-quote a `failed` one (`quote_state` says which); `quote_expired` and `quote_in_progress` mean re-quote, and wait for the re-quote already running; `invalid_acquisition_state` means re-read the acquisition (`status` and `expected_status` are alongside); `nothing_to_hold` means every work was excluded and a different selection is needed; `run_not_started` means the run could not be queued, so nothing was held and the same authorization is safe to retry.
1510
+ *
1511
+ * `invitation_not_accepted` means a store or Company invitation was refused; `reason` alongside says why (see `InvitationNotAcceptedError`).
734
1512
  * @enum {string}
735
1513
  */
736
- type?: 'retrieval_failed' | 'not_licensable' | 'price_drifted' | 'client_error' | 'insufficient_funds' | 'daily_spend_cap_reached';
1514
+ type?: 'retrieval_failed' | 'not_licensable' | 'price_drifted' | 'client_error' | 'insufficient_funds' | 'daily_spend_cap_reached' | 'exclusions_unacknowledged' | 'invalid_acquisition_state' | 'quote_not_ready' | 'nothing_to_hold' | 'quote_expired' | 'quote_in_progress' | 'run_not_started' | 'invitation_not_accepted';
737
1515
  };
738
1516
  };
739
1517
  AuthSignupRequest: {
740
1518
  email: string;
741
1519
  password: string;
742
1520
  name: string;
1521
+ /** @description The token from a store invitation email. Signup also accepts it and the new account joins the store. If the invitation can't be accepted, nothing is created and the signup is refused with a 422 (`InvitationNotAcceptedError`). */
1522
+ invitation_token?: string;
1523
+ /** @description The token from a Company invitation email. Signup also accepts it and the new buyer joins the Company. If the invitation can't be accepted (unknown, addressed to another email, expired, withdrawn or already accepted), nothing is created and the signup is refused with a 422. A signup carrying both tokens joins both or neither. */
1524
+ company_invitation_token?: string;
743
1525
  };
744
1526
  AuthLoginEmailRequest: {
745
1527
  email?: string;
@@ -747,6 +1529,10 @@ declare interface components {
747
1529
  };
748
1530
  AuthLoginOAuthRequest: {
749
1531
  id_token?: string;
1532
+ /** @description The token from a store invitation email. The account joins the store. When this call creates the account and the invitation can't be accepted, nothing is created and the call is refused with a 422. See `company_invitation_token` for an existing account. */
1533
+ invitation_token?: string;
1534
+ /** @description The token from a Company invitation email. When this call creates the account, it also accepts the invitation and the new buyer joins the Company. If the invitation can't be accepted (unknown, addressed to another email, expired, withdrawn or already accepted), nothing is created and the call is refused with a 422. A call creating an account with both tokens joins both or neither. For an account that already exists, each token is accepted if it can be, the sign-in succeeds either way, and the response's `invitations` says what happened to each. */
1535
+ company_invitation_token?: string;
750
1536
  };
751
1537
  MerchantEmailLoginRequest: {
752
1538
  email: string;
@@ -793,7 +1579,7 @@ declare interface components {
793
1579
  /** @description 64-char hex authentication secret. Store immediately — shown once only. */
794
1580
  secret: string;
795
1581
  };
796
- /** @description The authenticated buyer's daily spend cap, read against the current spend window. The cap governs every wallet debit the buyer makes — MCP, REST, or the web payment gate — and spend is derived from completed purchases, so a refund returns allowance. cap_cents, spent_cents, remaining_cents and resets_at are spelled exactly as they are in DailySpendCapReachedError, so a refusal and this resource describe the same numbers. */
1582
+ /** @description The authenticated buyer's daily spend cap, read against the current spend window. The cap governs every wallet debit the buyer makes — MCP, REST, or the web payment gate — and spend is derived from completed purchases, so a refund returns allowance. cap_cents, spent_cents, remaining_cents and resets_at are spelled exactly as they are in DailySpendCapReachedError, so a refusal and this resource describe the same numbers. For a Company member it is the membership's cap, read-only, in the Company's timezone, counting only spend paid through the membership; company_name names the Company. The Company balance never appears here. */
797
1583
  UserSpendCap: {
798
1584
  /** @description The daily spend cap in cents. null means uncapped. */
799
1585
  cap_cents: number | null;
@@ -808,8 +1594,277 @@ declare interface components {
808
1594
  * @description The instant the current spend window rolls, in UTC.
809
1595
  */
810
1596
  resets_at: string;
811
- /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. */
1597
+ /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. Always false for a Company member, whose cap binds bulk acquisitions too. */
812
1598
  bulk_exempt: boolean;
1599
+ /** @description The Company whose cap this is, for a buyer with an open Company membership; null otherwise. A member sees the Company's name, never its balance. */
1600
+ company_name: string | null;
1601
+ };
1602
+ /** @description A pending invitation to join a Company. Joining always waits for the invitee to accept, because it moves their Agents' spending onto the Company wallet. Never carries the signup token, which reaches only the invited address. */
1603
+ CompanyInvitation: {
1604
+ /** Format: uuid */
1605
+ id: string;
1606
+ /** Format: uuid */
1607
+ company_id: string;
1608
+ company_name: string;
1609
+ /** @description The invited address, lowercased. */
1610
+ email: string;
1611
+ /** @enum {string} */
1612
+ role: 'admin' | 'member';
1613
+ /** Format: date-time */
1614
+ invited_at: string;
1615
+ /**
1616
+ * Format: date-time
1617
+ * @description Seven days after it was sent. An expired invitation cannot be accepted.
1618
+ */
1619
+ expires_at: string;
1620
+ };
1621
+ CompanyInvitationList: {
1622
+ data: components['schemas']['CompanyInvitation'][];
1623
+ };
1624
+ CompanyInvitationRequest: {
1625
+ email: string;
1626
+ /**
1627
+ * @default member
1628
+ * @enum {string}
1629
+ */
1630
+ role: 'admin' | 'member';
1631
+ };
1632
+ /** @description An open membership as a Company admin sees it. */
1633
+ CompanyMember: {
1634
+ /**
1635
+ * Format: uuid
1636
+ * @description The membership id, used by the members/{id} routes.
1637
+ */
1638
+ id: string;
1639
+ /** Format: uuid */
1640
+ user_id: string;
1641
+ name: string;
1642
+ /** @description Null for a Machine user, which has no email address. */
1643
+ email: string | null;
1644
+ /**
1645
+ * @description A machine member is a Machine user: it cannot be made an admin, and removing it deactivates it permanently.
1646
+ * @enum {string}
1647
+ */
1648
+ kind: 'human' | 'machine';
1649
+ /** @enum {string} */
1650
+ role: 'admin' | 'member';
1651
+ /** Format: date-time */
1652
+ joined_at: string;
1653
+ /** @description The member's daily Spend cap, read in the Company's timezone. Never null: a member is never uncapped. Defaults to 1000 ($10) on joining, and again on rejoining. */
1654
+ daily_spend_limit_cents: number;
1655
+ };
1656
+ /** @description One thing the Company paid for, as a Company admin sees it: a purchase or a Bulk acquisition drawn on the Company wallet, attributed to the member who bought it. */
1657
+ CompanyPurchase: {
1658
+ /** @enum {string} */
1659
+ kind: 'purchase' | 'bulk_acquisition';
1660
+ /**
1661
+ * Format: uuid
1662
+ * @description The purchase id, or the acquisition id for a Bulk acquisition.
1663
+ */
1664
+ id: string;
1665
+ member: components['schemas']['CompanyPurchaseMember'];
1666
+ /** @description The purchase's or the acquisition's own status. */
1667
+ status: string;
1668
+ /** @description A purchase's price. A Bulk acquisition's captured amount once it has settled, failed or been cancelled, and the amount still held while it is authorized or acquiring — so while a Hold is live this is more than the member's `spend_cents`, which counts only what was captured. */
1669
+ amount_cents: number;
1670
+ /**
1671
+ * Format: date-time
1672
+ * @description When the purchase was made, or when the Bulk acquisition was authorized — the moment it counts against the member's Spend window.
1673
+ */
1674
+ occurred_at: string;
1675
+ };
1676
+ /** @description The membership that paid. Recorded when it was paid, so it still names the member after they leave; a person who left and rejoined appears under each membership. */
1677
+ CompanyPurchaseMember: {
1678
+ /**
1679
+ * Format: uuid
1680
+ * @description The membership id, which the `member` filter takes.
1681
+ */
1682
+ id: string;
1683
+ /** Format: uuid */
1684
+ user_id: string;
1685
+ /** @description The member's current name, read when the response is built. Renaming a Machine user (PATCH /v1/company/machine-users/{id}) relabels its earlier rows too; the audit trail keeps the old name. */
1686
+ name: string;
1687
+ /** @enum {string} */
1688
+ kind: 'human' | 'machine';
1689
+ /**
1690
+ * Format: date-time
1691
+ * @description When the membership closed, or null while it is open.
1692
+ */
1693
+ left_at: string | null;
1694
+ };
1695
+ CompanyPurchaseList: {
1696
+ data: components['schemas']['CompanyPurchase'][];
1697
+ pagination: components['schemas']['PaginationMeta'];
1698
+ };
1699
+ CompanySpendList: {
1700
+ /** @description Every membership the Company has had, open or closed, oldest first. */
1701
+ data: {
1702
+ member: components['schemas']['CompanyPurchaseMember'];
1703
+ /** @description What the member has spent of the Company's money in the range, net of refunds, read from the member's own ledger account. A Bulk acquisition counts what it captured; a live Hold does not count until it captures. */
1704
+ spend_cents: number;
1705
+ }[];
1706
+ };
1707
+ /** @description A Machine user as a Company admin sees it: a Buyer with a name and no email, password or login, created as an active non-admin member. Deactivation is permanent. */
1708
+ CompanyMachineUser: {
1709
+ /**
1710
+ * Format: uuid
1711
+ * @description The Machine user id, used by the machine-users/{id} routes.
1712
+ */
1713
+ id: string;
1714
+ /**
1715
+ * Format: uuid
1716
+ * @description Its Buyer id, which attribution and history name it by.
1717
+ */
1718
+ user_id: string;
1719
+ /** @description Unique among the Company's active Machine users; a deactivated one's may be reused. */
1720
+ name: string;
1721
+ description: string | null;
1722
+ /** Format: uuid */
1723
+ created_by_user_id: string | null;
1724
+ /** Format: date-time */
1725
+ created_at: string;
1726
+ /** Format: date-time */
1727
+ deactivated_at: string | null;
1728
+ };
1729
+ CompanyMachineUserList: {
1730
+ data: components['schemas']['CompanyMachineUser'][];
1731
+ };
1732
+ CompanyMachineUserRequest: {
1733
+ name: string;
1734
+ description?: string | null;
1735
+ };
1736
+ /** @description At least one of `name` and `description`. A null or blank `description` clears it; `name` cannot be null. */
1737
+ CompanyMachineUserUpdateRequest: {
1738
+ name?: string;
1739
+ description?: string | null;
1740
+ } | unknown | unknown;
1741
+ /** @description A Machine user's Buyer key as a Company admin sees it. It logs in through POST /v1/auth/login/buyer-api-key. Its limit is the Machine user's membership Spend cap. */
1742
+ CompanyMachineUserBuyerKey: {
1743
+ /** Format: uuid */
1744
+ id: string;
1745
+ name: string;
1746
+ /** @description Structured public identifier (e.g. bktst_abc123) */
1747
+ key: string;
1748
+ /**
1749
+ * Format: uuid
1750
+ * @description The Company admin who created it.
1751
+ */
1752
+ created_by_user_id: string | null;
1753
+ /** Format: date-time */
1754
+ last_used_at: string | null;
1755
+ /** Format: date-time */
1756
+ created_at: string;
1757
+ };
1758
+ /** @description Returned once only at creation. The secret is not stored and cannot be retrieved again. */
1759
+ CompanyMachineUserBuyerKeyCreateResponse: components['schemas']['CompanyMachineUserBuyerKey'] & {
1760
+ /** @description 64-char hex authentication secret. Store immediately — shown once only. */
1761
+ secret: string;
1762
+ };
1763
+ CompanyMachineUserBuyerKeyList: {
1764
+ data: components['schemas']['CompanyMachineUserBuyerKey'][];
1765
+ };
1766
+ /** @description spending_limit_cents is refused with 400: the Machine user's membership Spend cap is its limit. */
1767
+ CompanyMachineUserBuyerKeyRequest: {
1768
+ /** @description Unique among this Machine user's Buyer keys. */
1769
+ name: string;
1770
+ };
1771
+ /** @description A Machine user's active MCP API Key as a Company admin sees it. Presented as a `key:secret` Bearer token. It carries buyer Scopes only, never a Store, and does not expire; revoke it instead. */
1772
+ CompanyMachineUserMcpKey: {
1773
+ /** Format: uuid */
1774
+ id: string;
1775
+ label: string;
1776
+ key: string;
1777
+ scopes: ('mcp:search' | 'mcp:purchase')[];
1778
+ /**
1779
+ * Format: uuid
1780
+ * @description The Company admin who created it.
1781
+ */
1782
+ created_by_user_id: string | null;
1783
+ /**
1784
+ * Format: date-time
1785
+ * @description Always null for a key an admin created.
1786
+ */
1787
+ expires_at: string | null;
1788
+ /** Format: date-time */
1789
+ last_used_at: string | null;
1790
+ /** Format: date-time */
1791
+ created_at: string;
1792
+ };
1793
+ /** @description Returned once only at creation. The secret cannot be retrieved again. */
1794
+ CompanyMachineUserMcpKeyCreateResponse: components['schemas']['CompanyMachineUserMcpKey'] & {
1795
+ /** @description Authentication secret. Store immediately — shown once only. */
1796
+ secret: string;
1797
+ };
1798
+ CompanyMachineUserMcpKeyList: {
1799
+ data: components['schemas']['CompanyMachineUserMcpKey'][];
1800
+ };
1801
+ /** @description Any Scope other than mcp:search and mcp:purchase, or a store_id, is refused with 400. */
1802
+ CompanyMachineUserMcpKeyRequest: {
1803
+ label: string;
1804
+ scopes: ('mcp:search' | 'mcp:purchase')[];
1805
+ };
1806
+ CompanyMemberList: {
1807
+ data: components['schemas']['CompanyMember'][];
1808
+ };
1809
+ /** @description The Company wallet, as a Company admin sees it. No member-facing response carries these figures; only this one does. */
1810
+ CompanyWallet: {
1811
+ /** @description Spendable now. Money held by in-flight Bulk acquisitions is already out of it. Negative when a reversed top-up has taken the wallet below zero; a purchase is refused whenever the balance does not cover its price. */
1812
+ balance_cents: number;
1813
+ /** @description Committed to Company-paid Bulk acquisitions still in progress, including those started by members who have since left the Company. When an acquisition settles or is cancelled, what it captured is charged and the rest is released back to the balance. */
1814
+ held_cents: number;
1815
+ /** @description The sum of top-ups not yet spendable: the same top-ups GET /v1/company/wallet/pending-top-ups lists. Not part of the balance until each settles. */
1816
+ pending_top_up_cents: number;
1817
+ /** @example usd */
1818
+ currency: string;
1819
+ company_name: string;
1820
+ };
1821
+ /** @description A Company wallet top-up that has not yet settled, as a Company admin sees it. */
1822
+ CompanyPendingTopUp: {
1823
+ /** Format: uuid */
1824
+ id: string;
1825
+ /** @description The payment session id returned when the top-up was started. */
1826
+ session_id: string | null;
1827
+ amount_cents: number;
1828
+ /** @enum {string} */
1829
+ status: 'pending' | 'awaiting_verification' | 'processing';
1830
+ /**
1831
+ * Format: uuid
1832
+ * @description The admin who started the top-up.
1833
+ */
1834
+ initiated_by_user_id: string;
1835
+ /** Format: date-time */
1836
+ created_at: string;
1837
+ /**
1838
+ * Format: date
1839
+ * @description The payment provider's estimate of when an ACH debit lands. Not guaranteed, and null until the provider can determine it, and always for a card.
1840
+ */
1841
+ expected_debit_date: string | null;
1842
+ };
1843
+ CompanyPendingTopUpList: {
1844
+ data: components['schemas']['CompanyPendingTopUp'][];
1845
+ };
1846
+ CompanyInvitationAcceptRequest: {
1847
+ /** @description The token from the invitation email. */
1848
+ token: string;
1849
+ };
1850
+ /** @description At least one of role and daily_spend_limit_cents. */
1851
+ CompanyMemberRoleRequest: {
1852
+ /** @enum {string} */
1853
+ role?: 'admin' | 'member';
1854
+ /** @description The member's daily Spend cap in cents. Any admin may set any member's, their own included. null is refused — a member is never uncapped. Writes an AuditEvent. */
1855
+ daily_spend_limit_cents?: number;
1856
+ };
1857
+ /** @description The authenticated buyer's own open Company membership. Names the Company but never its balance. */
1858
+ CompanyMembership: {
1859
+ /** Format: uuid */
1860
+ id: string;
1861
+ /** Format: uuid */
1862
+ company_id: string;
1863
+ company_name: string;
1864
+ /** @enum {string} */
1865
+ role: 'admin' | 'member';
1866
+ /** Format: date-time */
1867
+ joined_at: string;
813
1868
  };
814
1869
  /** @description Sets the buyer's cap. The field is required and nullable: null is how a buyer becomes uncapped, and an omitted field is treated as a client error rather than as a request to be uncapped. A cap below spend already made in the current window is accepted — it simply leaves remaining_cents at zero until the window rolls. Zero is a valid cap and refuses every priced purchase. */
815
1870
  UserSpendCapUpdateRequest: {
@@ -828,9 +1883,9 @@ declare interface components {
828
1883
  * @description Scopes the key to a specific store. User must be an owner or author of that store.
829
1884
  */
830
1885
  store_id?: string | null;
831
- /** @description Grants access to seller content management tools. Defaults to false. */
1886
+ /** @description Grants access to seller content management tools. Defaults to false. Requires a `store_id` for which the user is an owner or author; otherwise the request is refused with 403. Re-checked on every use, so a key stops working if the holder loses the role. */
832
1887
  can_manage_content?: boolean;
833
- /** @description Grants access to seller analytics tools. Defaults to false. */
1888
+ /** @description Grants access to seller analytics tools. Defaults to false. Requires a `store_id` for which the user is an owner or author; an author's analytics cover only their own content. Otherwise refused with 403, and re-checked on every use. */
834
1889
  can_read_analytics?: boolean;
835
1890
  };
836
1891
  /** @description Returned once only at creation. The secret cannot be retrieved again. */
@@ -891,7 +1946,7 @@ declare interface components {
891
1946
  /** @description Academic citation count from source metadata. Null for non-academic content or unknown values. */
892
1947
  citation_count: number | null;
893
1948
  };
894
- /** @description Content returned to a store team member (owner or author) accessing their own content without a purchase. */
1949
+ /** @description Content returned without a purchase to a store team member reading their own store's content — any of it for an owner, only what they wrote for an author. */
895
1950
  McpSellerContent: components['schemas']['McpContentSearchResult'] & {
896
1951
  /** @description Article body. Present when content_type is `markdown` or inline `html`. */
897
1952
  content_body?: string | null;
@@ -960,8 +2015,12 @@ declare interface components {
960
2015
  } | null;
961
2016
  };
962
2017
  McpGetWalletBalanceResult: {
963
- /** @description Current wallet balance in cents for the authenticated MCP key owner. */
964
- wallet_balance_cents: number;
2018
+ /** @description Current wallet balance in cents for the authenticated MCP key owner. null for a Company member, who never sees the Company balance; read remaining_cents instead. */
2019
+ wallet_balance_cents: number | null;
2020
+ /** @description Spend cap minus spend so far today — for a Company member, their membership's cap, never reduced by the Company balance. null when uncapped. */
2021
+ remaining_cents: number | null;
2022
+ /** @description The Company whose wallet pays, for a member; null otherwise. */
2023
+ company_name: string | null;
965
2024
  };
966
2025
  McpRegisterResult: {
967
2026
  /** @description The API key identifier (not secret). */
@@ -976,8 +2035,12 @@ declare interface components {
976
2035
  content: components['schemas']['McpContentSearchResult'];
977
2036
  /** @description Whether the authenticated user has a completed purchase for this content. */
978
2037
  has_purchased: boolean;
979
- /** @description Current wallet balance in cents for the authenticated MCP key owner. */
980
- wallet_balance_cents: number;
2038
+ /** @description Current wallet balance in cents for the authenticated MCP key owner. null for a Company member, who never sees the Company balance. */
2039
+ wallet_balance_cents: number | null;
2040
+ /** @description Spend cap minus spend so far today; a member's membership cap. null when uncapped. */
2041
+ remaining_cents: number | null;
2042
+ /** @description The Company whose wallet pays, for a member; null otherwise. */
2043
+ company_name: string | null;
981
2044
  };
982
2045
  McpListPurchasesResult: {
983
2046
  /** @description Receipts, newest first, one per purchase and never collapsed — a Buyer may hold several purchases of one work, each at the price in force when it was made. These were `McpFullContent` until #939, which meant this endpoint returned the body of every article the Buyer had ever bought. */
@@ -987,7 +2050,7 @@ declare interface components {
987
2050
  offset: number;
988
2051
  limit: number;
989
2052
  };
990
- /** @description Returned as structuredContent when a get_content payment attempt fails due to insufficient wallet balance. Always accompanied by isError: true. */
2053
+ /** @description Returned as structuredContent when a get_content payment attempt fails due to insufficient wallet balance. Always accompanied by isError: true. A Company member instead receives McpCompanyInsufficientFundsError, with the same error code. */
991
2054
  McpInsufficientFundsError: {
992
2055
  /** @enum {string} */
993
2056
  error: 'insufficient_funds';
@@ -1003,6 +2066,14 @@ declare interface components {
1003
2066
  */
1004
2067
  funding_url: string;
1005
2068
  };
2069
+ /** @description A Company member's get_content payment the Company wallet cannot cover. Always accompanied by isError: true. Same error code as McpInsufficientFundsError, but no balance, shortfall or funding_url: a member never sees the Company balance and cannot fund the Company wallet. The remedy is to ask a Company admin. */
2070
+ McpCompanyInsufficientFundsError: {
2071
+ /** @enum {string} */
2072
+ error: 'insufficient_funds';
2073
+ /** @description Price of the content in cents. */
2074
+ required_cents: number;
2075
+ message: string;
2076
+ };
1006
2077
  /** @description Returned as structuredContent when a get_content call is refused because the buyer's daily spend cap would be exceeded. Always accompanied by isError: true. Deliberately carries no funding_url — adding money to the wallet cannot raise a cap, and a payload resembling McpInsufficientFundsError would send agents to the wrong remedy. The cap resets at resets_at; until then the only remedies are raising the cap or waiting. */
1007
2078
  McpDailySpendCapReachedError: {
1008
2079
  /** @enum {string} */
@@ -1018,8 +2089,10 @@ declare interface components {
1018
2089
  * @description The instant the current spend window rolls, in UTC. One calendar day boundary in the buyer's own timezone.
1019
2090
  */
1020
2091
  resets_at: string;
1021
- /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. */
2092
+ /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. Always false for a Company member, whose cap binds bulk acquisitions too. */
1022
2093
  bulk_exempt: boolean;
2094
+ /** @description The remedy in words. A Company member is told to ask a Company admin, who sets their cap; anyone else, that the daily cap is reached. */
2095
+ message?: string;
1023
2096
  };
1024
2097
  /** @description The REST and x402 web-gate form of the same refusal, returned with HTTP 402 Payment Required by POST /v1/purchases and GET /v1/x402/contents/{id}. Carries the same fields as McpDailySpendCapReachedError alongside the standard error envelope, and the same absence of a funding URL. `error.type` is the machine-readable discriminator. */
1025
2098
  DailySpendCapReachedError: {
@@ -1043,6 +2116,8 @@ declare interface components {
1043
2116
  resets_at: string;
1044
2117
  /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only. */
1045
2118
  bulk_exempt: boolean;
2119
+ /** @description The remedy in words. A Company member is told to ask a Company admin, who sets their cap; anyone else, that the daily cap is reached. */
2120
+ message?: string;
1046
2121
  };
1047
2122
  /** @description Returned by the fund_wallet tool. Contains the buyer portal wallet URL. Open this link in a browser to add funds using the Ledewire wallet funding page. */
1048
2123
  McpFundWalletResult: {
@@ -1272,13 +2347,13 @@ declare interface components {
1272
2347
  [key: string]: unknown;
1273
2348
  };
1274
2349
  };
1275
- /** @description The buyer's wallet. balance_cents and spendable_cents are the same number and always will be — balance_cents has always meant "what you can spend", and money committed to a bulk acquisition is a hold, which moves it out of the wallet rather than annotating it. held_cents and holds exist so a buyer mid-acquisition can see why their balance is lower than their purchase history explains. */
2350
+ /** @description The buyer's wallet. balance_cents and spendable_cents are the same number and always will be — balance_cents has always meant "what you can spend", and money committed to a bulk acquisition is a hold, which moves it out of the wallet rather than annotating it. held_cents and holds exist so a buyer mid-acquisition can see why their balance is lower than their purchase history explains. For a Company member the balances are null — a member never sees the Company balance — and remaining_cents and company_name say what they may still spend and whose wallet pays. */
1276
2351
  WalletBalanceResponse: {
1277
- /** @description Spendable balance in cents. Excludes funds held against a bulk acquisition. */
1278
- balance_cents: number;
1279
- /** @description The same figure as balance_cents, named in the vocabulary holds require. */
1280
- spendable_cents: number;
1281
- /** @description Total committed to active bulk acquisitions and not yet spent or released. */
2352
+ /** @description Spendable balance in cents. Excludes held funds — those held against a bulk acquisition, and a brokered purchase's price while its content is being retrieved. */
2353
+ balance_cents: number | null;
2354
+ /** @description The same figure as balance_cents, named in the vocabulary holds require. null for a Company member. */
2355
+ spendable_cents: number | null;
2356
+ /** @description Total held and not yet spent or released. Includes, for the few seconds its content is being retrieved, the price of a brokered purchase in progress, which has no entry in holds. */
1282
2357
  held_cents: number;
1283
2358
  /** @description One entry per bulk acquisition currently holding funds. Empty when none is. */
1284
2359
  holds: {
@@ -1292,6 +2367,10 @@ declare interface components {
1292
2367
  */
1293
2368
  authorized_at: string;
1294
2369
  }[];
2370
+ /** @description Spend cap minus spend so far today — for a Company member, their membership's cap, never reduced by the Company balance. null when uncapped. */
2371
+ remaining_cents: number | null;
2372
+ /** @description The Company whose wallet pays, for a member; null otherwise. */
2373
+ company_name: string | null;
1295
2374
  };
1296
2375
  WalletTransactionItem: {
1297
2376
  /** @description ID of the transaction entry (matches the source record) */
@@ -1879,10 +2958,11 @@ declare interface components {
1879
2958
  };
1880
2959
  WalletPaymentStatusResponse: {
1881
2960
  /** @enum {string} */
1882
- status: 'pending' | 'completed' | 'failed';
2961
+ status: 'pending' | 'awaiting_verification' | 'processing' | 'completed' | 'failed' | 'cancelled';
1883
2962
  /** Format: date-time */
1884
2963
  updated_at: string;
1885
- balance_cents: number;
2964
+ /** @description The wallet balance. null for a Company member, as on GET /v1/wallet/balance. */
2965
+ balance_cents: number | null;
1886
2966
  };
1887
2967
  SalesSummaryResponse: {
1888
2968
  /** @description Amount in cents */
@@ -2010,7 +3090,7 @@ declare interface components {
2010
3090
  */
2011
3091
  line_state: 'pending' | 'firm' | 'estimated' | 'excluded';
2012
3092
  /**
2013
- * @description Present only on an excluded line. `excluded_rate_unavailable` is the one transient reason.
3093
+ * @description Present only on an excluded line. `excluded_rate_unavailable` is the one transient reason. `excluded_free_not_supported` is retired — a work published at zero is now included at no cost — and appears only on lines quoted before that; a re-quote prices them back in.
2014
3094
  * @enum {string|null}
2015
3095
  */
2016
3096
  exclusion_reason?: 'excluded_malformed' | 'excluded_duplicate' | 'excluded_no_rate' | 'excluded_free_not_supported' | 'excluded_not_deliverable' | 'excluded_insufficient_rights' | 'excluded_above_price_ceiling' | 'excluded_rate_unavailable' | null;
@@ -2049,6 +3129,28 @@ declare interface components {
2049
3129
  domains: string[];
2050
3130
  /** @description Whether works from this publication can come back in a Bulk acquisition's corpus — true when it publishes a `FULL_USE` rate. */
2051
3131
  bulk_licensable: boolean;
3132
+ /** @description The oldest date we have swept this publication back to, when that was true as of, and where we looked. Coverage is stated this way and never as a percentage. Null means "no horizon established yet" — it is not a horizon of zero, and is never sent as an object of nulls. */
3133
+ coverage_horizon: {
3134
+ /**
3135
+ * Format: date-time
3136
+ * @description The oldest date swept back to.
3137
+ * @example 2019-03-01T00:00:00Z
3138
+ */
3139
+ horizon_at: string;
3140
+ /**
3141
+ * Format: date-time
3142
+ * @description When the sweep behind the horizon began. The Broker adds works behind a horizon after the fact, so the horizon holds only of the catalog as it stood at this time.
3143
+ * @example 2026-09-27T04:30:00Z
3144
+ */
3145
+ as_of: string;
3146
+ /**
3147
+ * @description Where the sweep looked — today always the Broker's catalog.
3148
+ * @example [
3149
+ * "catalog"
3150
+ * ]
3151
+ */
3152
+ sources: string[];
3153
+ } | null;
2052
3154
  };
2053
3155
  /** @description Every Publication the Broker reports as ready to license, paginated. */
2054
3156
  PublicationListResponse: {
@@ -2108,7 +3210,7 @@ declare interface components {
2108
3210
  */
2109
3211
  status: 'quoted' | 'authorized' | 'acquiring' | 'settled' | 'cancelled' | 'failed';
2110
3212
  /**
2111
- * @description Whether the Selection has been priced. Pricing is asynchronous — resolving rates for 10,000 works is ~200 upstream batch calls under undocumented limits — so a submitted Selection comes back `pending` and the client polls this.
3213
+ * @description Whether the Selection has been priced. Pricing is asynchronous — resolving rates for 10,000 works is ~200 upstream batch calls under undocumented limits — so a submitted Selection comes back `pending` and the client polls this. Stop polling once `status` leaves `quoted`: a quote cancelled while still being priced stays `pending`.
2112
3214
  * @enum {string}
2113
3215
  */
2114
3216
  quote_state: 'pending' | 'ready' | 'failed';
@@ -2138,6 +3240,8 @@ declare interface components {
2138
3240
  /** @description Quoted and not yet reached. What a resumed run will attempt. */
2139
3241
  outstanding: number;
2140
3242
  };
3243
+ /** @description Seconds to wait before polling again, also sent as `Retry-After`. Present only while there is something to wait for — `quote_state` is `pending` on a `quoted` acquisition, or `status` is `authorized` or `acquiring` — and absent otherwise, so a client can poll for as long as the field is there. Grows with the size of the Selection, from 2 seconds to at most 60. */
3244
+ poll_after_seconds?: number;
2141
3245
  /** Format: date-time */
2142
3246
  created_at: string;
2143
3247
  };
@@ -2174,10 +3278,12 @@ declare interface components {
2174
3278
  * A corpus is a rendering of Purchases the Buyer already holds, not an entitlement of its own, which is what makes everything about it cheap: it can be discarded and rebuilt, and rebuilding grants nothing that was not already granted. So a blob past its 30-day retention answers `rebuild_required` at 200 rather than 404 or 410 — those would tell the Buyer something was lost, and nothing was.
2175
3279
  *
2176
3280
  * `rebuild_required` covers "never assembled" as well as "expired", on purpose: from the Buyer's side they are one situation — there is no file, ask for one — and splitting them would put our bookkeeping into their contract.
3281
+ *
3282
+ * **Assembly starts by itself when the acquisition settles** with at least one work delivered, so a client polls the acquisition until `settled` and then polls this until `ready` — there is nothing to ask for in between. `POST` is for a corpus that has expired or failed. An acquisition that delivered nothing has nothing to render and reads `rebuild_required`.
2177
3283
  */
2178
3284
  CorpusResponse: {
2179
3285
  /**
2180
- * @description `ready` is downloadable now. `assembling` means a run is in flight and `pending` that one is queued — poll either. `rebuild_required` means ask for it again, with `POST /v1/acquisitions/{id}/corpus`. `failed` carries a reason.
3286
+ * @description `ready` is downloadable now. `assembling` means a run is in flight and `pending` that one is queued — poll either. `rebuild_required` means ask for it again, with `POST /v1/acquisitions/{id}/corpus`, and is also what a run abandoned mid-assembly (a worker that died) reads as once it has gone two hours without progress. `failed` carries a reason; a POST retries one that failed transiently, and leaves one that failed because our records disagree with the signed manifest as it is.
2181
3287
  * @enum {string}
2182
3288
  */
2183
3289
  state: 'pending' | 'assembling' | 'ready' | 'rebuild_required' | 'failed';
@@ -2195,6 +3301,8 @@ declare interface components {
2195
3301
  expires_at?: string | null;
2196
3302
  /** @description Why assembly broke. Present only when `state` is `failed`. */
2197
3303
  failure_reason?: string | null;
3304
+ /** @description Seconds to wait before polling again, also sent as `Retry-After`. Present only while `state` is `pending` or `assembling`; `ready`, `failed` and `rebuild_required` carry neither, since nothing changes until the Buyer acts. Grows with the number of works the corpus renders, from 2 seconds to at most 60. */
3305
+ poll_after_seconds?: number;
2198
3306
  /**
2199
3307
  * @description Where to fetch the archive, relative to this API, and null in every state but `ready`.
2200
3308
  *
@@ -2391,7 +3499,10 @@ declare interface components {
2391
3499
  responses: never;
2392
3500
  parameters: never;
2393
3501
  requestBodies: never;
2394
- headers: never;
3502
+ headers: {
3503
+ /** @description Seconds to wait before polling again, sent only while a bulk step is still in progress — a quote being priced, a run in flight, a corpus queued or assembling — and equal to the body's `poll_after_seconds`. Absent once there is nothing left to wait for. Sized from the selection: at least 2 and at most 60. */
3504
+ PollRetryAfter: number;
3505
+ };
2395
3506
  pathItems: never;
2396
3507
  }
2397
3508
 
@@ -2423,6 +3534,19 @@ export declare type DailySpendCapReachedErrorBody = components['schemas']['Daily
2423
3534
  * - `insufficient_funds` — cleared by funding the wallet.
2424
3535
  * - `daily_spend_cap_reached` — deliberately **not** cleared by funding the wallet; see
2425
3536
  * {@link SpendCapReachedError}.
3537
+ *
3538
+ * On the bulk acquisition steps:
3539
+ *
3540
+ * - `exclusions_unacknowledged` — call `acquisitions.acknowledgeExclusions()` first.
3541
+ * - `quote_not_ready` — keep polling a `pending` quote, or re-quote a `failed` one
3542
+ * (`quote_state` says which).
3543
+ * - `quote_expired` — re-quote.
3544
+ * - `quote_in_progress` — wait for the re-quote already running.
3545
+ * - `invalid_acquisition_state` — re-read the acquisition; `status` and
3546
+ * `expected_status` arrive in `LedewireError.details`.
3547
+ * - `nothing_to_hold` — every work was excluded; a different Selection is needed.
3548
+ * - `run_not_started` — the run could not be queued, so nothing was held and the same
3549
+ * authorization is safe to retry.
2426
3550
  */
2427
3551
  export declare type ErrorType = NonNullable<components['schemas']['ErrorResponse']['error']['type']>;
2428
3552
 
@@ -2604,6 +3728,20 @@ declare interface HttpClientConfig {
2604
3728
  */
2605
3729
  export declare function init(config: BrowserClientConfig): BrowserClient;
2606
3730
 
3731
+ /**
3732
+ * What happened to one invitation token sent with `auth.loginWithGoogle()` for
3733
+ * an account that already existed. A refused invitation does not refuse the
3734
+ * sign-in; `accepted` is `false` and `reason` says why.
3735
+ */
3736
+ export declare type InvitationOutcome = components['schemas']['InvitationOutcome'];
3737
+
3738
+ /**
3739
+ * Why a store or Company invitation was not accepted. Carried by an
3740
+ * {@link InvitationOutcome}, and by a refused signup or Google sign-in as
3741
+ * `LedewireError.details.reason` (with `type === 'invitation_not_accepted'`).
3742
+ */
3743
+ export declare type InvitationRefusalReason = components['schemas']['InvitationRefusalReason'];
3744
+
2607
3745
  /**
2608
3746
  * Base error class for all LedeWire SDK errors.
2609
3747
  * All errors thrown by the SDK are instances of this class,
@@ -3063,6 +4201,8 @@ declare class UserApiKeysNamespace {
3063
4201
  *
3064
4202
  * @param body - Name and optional spend ceiling for the new key.
3065
4203
  * @returns The new key's public identifier and one-time secret.
4204
+ * @throws {ForbiddenError} When the caller is a Machine user, whose keys its
4205
+ * Company's admins manage through `company.machineUsers.buyerKeys`.
3066
4206
  *
3067
4207
  * @example
3068
4208
  * ```ts
@@ -3082,6 +4222,7 @@ declare class UserApiKeysNamespace {
3082
4222
  * token refresh. Revocation takes effect immediately.
3083
4223
  *
3084
4224
  * @param id - UUID of the API key to revoke.
4225
+ * @throws {ForbiddenError} When the caller is a Machine user.
3085
4226
  */
3086
4227
  revoke(id: string): Promise<void>;
3087
4228
  }
@@ -3141,6 +4282,12 @@ declare class UserMcpKeysNamespace {
3141
4282
  *
3142
4283
  * @param body - Label and scopes for the new key.
3143
4284
  * @returns The new key's public identifier, scopes, and one-time secret.
4285
+ * @throws {ForbiddenError} When a seller-tier scope or `store_id` names a store
4286
+ * the user is not an owner or author of (plain store members cannot hold a
4287
+ * store-scoped key), or when the caller is a Machine user, whose keys its
4288
+ * Company's admins manage through `company.machineUsers.mcpKeys`. Seller-tier
4289
+ * scopes are re-checked on every use, so a key stops working if its holder
4290
+ * loses the role.
3144
4291
  *
3145
4292
  * @example
3146
4293
  * ```ts
@@ -3159,6 +4306,7 @@ declare class UserMcpKeysNamespace {
3159
4306
  * desired scopes — scopes cannot be edited in place.
3160
4307
  *
3161
4308
  * @param id - UUID of the MCP API key to revoke.
4309
+ * @throws {ForbiddenError} When the caller is a Machine user.
3162
4310
  */
3163
4311
  revoke(id: string): Promise<void>;
3164
4312
  }
@@ -3241,6 +4389,12 @@ declare class UserSpendCapNamespace {
3241
4389
  * Returns the authenticated buyer's spend cap, read against the current spend
3242
4390
  * window.
3243
4391
  *
4392
+ * For a buyer with an open Company membership this is the membership's cap —
4393
+ * read in the Company's timezone, counting only spend paid through the
4394
+ * membership, never uncapped, and always binding bulk acquisitions
4395
+ * (`bulk_exempt: false`). `company_name` names the Company; it is `null` for
4396
+ * anyone else.
4397
+ *
3244
4398
  * @returns The current spend cap, spend-to-date, and reset time.
3245
4399
  */
3246
4400
  get(): Promise<UserSpendCap>;
@@ -3254,6 +4408,9 @@ declare class UserSpendCapNamespace {
3254
4408
  *
3255
4409
  * @param body - The new cap in whole cents, or `null` to remove it.
3256
4410
  * @returns The updated spend cap.
4411
+ * @throws {ForbiddenError} When the buyer holds an open Company membership. A
4412
+ * member's cap — an admin's own included — is set by a Company admin through
4413
+ * `company.members.update()`.
3257
4414
  */
3258
4415
  update(body: UserSpendCapUpdateRequest): Promise<UserSpendCap>;
3259
4416
  }
@@ -3268,8 +4425,13 @@ export declare type UserSpendCapUpdateRequest = components['schemas']['UserSpend
3268
4425
  /** Current wallet balance for the authenticated buyer. */
3269
4426
  export declare type WalletBalanceResponse = components['schemas']['WalletBalanceResponse'];
3270
4427
 
3271
- /** Request body for creating a wallet payment session. */
3272
- export declare type WalletPaymentSessionRequest = components['schemas']['WalletPaymentSessionRequest'];
4428
+ /**
4429
+ * Request body for creating a wallet payment session (personal or Company).
4430
+ * `currency` is optional; the server defaults it to `'usd'`.
4431
+ */
4432
+ export declare type WalletPaymentSessionRequest = Omit<components['schemas']['WalletPaymentSessionRequest'], 'currency'> & {
4433
+ currency?: string;
4434
+ };
3273
4435
 
3274
4436
  /** Response from creating a wallet payment session. */
3275
4437
  export declare type WalletPaymentSessionResponse = components['schemas']['WalletPaymentSessionResponse'];