@ledewire/browser 0.8.1 → 0.9.0

package/dist/index.d.ts

@@ -114,6 +114,11 @@ declare class BrowserAuthNamespace {
      * Register a new buyer account with email and password.
      * Tokens are stored automatically after successful signup.
      *
+     * Pass `company_invitation_token` (from a Company invitation email) to sign
+     * up and join the Company in one step. If the token does not name a pending
+     * invitation addressed to this email, the account is still created, without
+     * a membership.
+     *
      * @param body - Signup credentials and display name.
      * @returns The authentication token response.
      */
@@ -216,8 +221,10 @@ declare class BrowserClient {
     readonly content: BrowserContentNamespace;
     /** Seller operations: API key login, content list/search/get */
     readonly seller: BrowserSellerNamespace;
-    /** Authenticated buyer account: API key management */
+    /** Authenticated buyer account: API keys, MCP keys, and the daily spend cap */
     readonly user: UserNamespace;
+    /** Company membership, and Company administration: members, Machine users, wallet, reports */
+    readonly company: CompanyNamespace;
     /* Excluded from this release type: __constructor */
 }
 
@@ -541,7 +548,24 @@ declare class BrowserWalletNamespace {
      * mid-acquisition can see why their balance is lower than their purchase
      * history explains.
      *
+     * **Company members:** a buyer with an open Company membership spends from the
+     * Company wallet and never sees its balance, so `balance_cents` and
+     * `spendable_cents` are `null`. `company_name` names the Company whose wallet
+     * pays, and `remaining_cents` is what the member may still spend today under
+     * their membership Spend cap. For anyone else, `company_name` is `null` and
+     * `remaining_cents` is their own cap's headroom (`null` when uncapped).
+     *
      * @returns The current wallet balance in cents, including held funds detail.
+     *
+     * @example
+     * ```ts
+     * const wallet = await lw.wallet.balance()
+     * if (wallet.company_name !== null) {
+     *   console.log(`${wallet.company_name} pays; ${wallet.remaining_cents}c left today`)
+     * } else {
+     *   console.log(`Balance: ${wallet.balance_cents}c`)
+     * }
+     * ```
      */
     balance(): Promise<WalletBalanceResponse>;
     /**
@@ -563,14 +587,21 @@ declare class BrowserWalletNamespace {
      */
     transactions(): Promise<WalletTransactionItem[]>;
     /**
-     * Creates a payment session for funding the buyer's wallet.
+     * Creates a payment session for funding the buyer's personal wallet. A
+     * Company admin funds the Company wallet with
+     * `company.wallet.createPaymentSession()` instead.
      *
      * @param body - The amount and currency to fund.
      * @returns Payment session details for use with the payment provider widget.
      */
     createPaymentSession(body: WalletPaymentSessionRequest): Promise<WalletPaymentSessionResponse>;
     /**
-     * Polls the status of a wallet funding payment session.
+     * Polls the status of a personal wallet funding payment session.
+     *
+     * `completed`, `failed` and `cancelled` are terminal. An ACH top-up can sit
+     * in `awaiting_verification` (bank microdeposits not yet confirmed) and then
+     * `processing` (the debit under way) for days before it completes.
+     * `balance_cents` is `null` for a Company member.
      *
      * @param sessionId - The session ID returned by `createPaymentSession`.
      * @returns The current payment status.
@@ -643,6 +674,620 @@ export declare type CheckoutState = CheckoutStateResponse;
 /** Full checkout state for a buyer/content pair, including auth and fund status. */
 export declare type CheckoutStateResponse = components['schemas']['CheckoutStateResponse'];
 
+/**
+ * A pending invitation to join a Company. Joining always waits for the invitee
+ * to accept, because it moves their spending onto the Company wallet. Never
+ * carries the acceptance token, which reaches only the invited address.
+ */
+export declare type CompanyInvitation = components['schemas']['CompanyInvitation'];
+
+/** Request body for accepting a Company invitation. */
+export declare type CompanyInvitationAcceptRequest = components['schemas']['CompanyInvitationAcceptRequest'];
+
+/** The Company's pending invitations. */
+export declare type CompanyInvitationList = components['schemas']['CompanyInvitationList'];
+
+/** Request body for inviting someone to the Company. */
+export declare type CompanyInvitationRequest = Omit<components['schemas']['CompanyInvitationRequest'], 'role'> & {
+    role?: CompanyRole;
+};
+
+/**
+ * Invite people to a Company, and accept an invitation.
+ *
+ * Nobody joins until they accept, because joining moves their spending onto
+ * the Company wallet. Every invitation emails a token that accepting requires,
+ * even for a buyer already signed in as the invited address. An existing buyer
+ * passes it to {@link accept}; a new address passes it to `auth.signup()` as
+ * `company_invitation_token`, which signs up and joins in one step.
+ *
+ * `list()` and `create()` are Company-admin only; `accept()` is for the invitee.
+ *
+ * Obtain via `client.company.invitations` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * // Admin: invite an analyst
+ * await client.company.invitations.create({ email: 'analyst@example.com' })
+ *
+ * // Invitee (already has an account): accept with the emailed token
+ * const membership = await client.company.invitations.accept({ token })
+ * ```
+ */
+declare class CompanyInvitationsNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Lists the Company's pending invitations. Company admins only.
+     *
+     * @returns The pending invitations.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {NotFoundError} When the caller belongs to no Company.
+     */
+    list(): Promise<CompanyInvitationList>;
+    /**
+     * Invites someone to the Company and emails them the acceptance token.
+     * Company admins only. Inviting someone who belongs to another Company
+     * succeeds; their accept is refused until they leave it.
+     *
+     * @param body - The invitee's email, and their role (default `'member'`).
+     * @returns The invitation. It expires seven days after it is sent.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {LedewireError} With `statusCode === 409` when the address is
+     *   already a member or already has a pending invitation.
+     */
+    create(body: CompanyInvitationRequest): Promise<CompanyInvitation>;
+    /**
+     * Accepts an invitation, opening a membership with the invited role. The
+     * token must belong to an invitation addressed to one of the buyer's
+     * addresses.
+     *
+     * @param body - The token from the invitation email.
+     * @returns The new membership.
+     * @throws {NotFoundError} When no invitation with this token is addressed to
+     *   this buyer.
+     * @throws {LedewireError} With `statusCode === 409` when already accepted, or
+     *   when the buyer already belongs to a Company (leave it first); with
+     *   `statusCode === 410` when the invitation has expired or was withdrawn.
+     */
+    accept(body: CompanyInvitationAcceptRequest): Promise<CompanyMembership>;
+}
+
+/**
+ * A Machine user: a Buyer with a name and no email, password or login, owned by
+ * a Company and joined as a non-admin member. It authenticates only with the
+ * Buyer keys and MCP API keys a Company admin issues it. Deactivation is
+ * permanent.
+ */
+export declare type CompanyMachineUser = components['schemas']['CompanyMachineUser'];
+
+/**
+ * A Machine user's Buyer key (secret never included after creation). It logs in
+ * through `auth.loginWithBuyerApiKey()`; its limit is the Machine user's
+ * membership Spend cap.
+ */
+export declare type CompanyMachineUserBuyerKey = components['schemas']['CompanyMachineUserBuyerKey'];
+
+/** Request body for creating a Machine user's Buyer key. */
+export declare type CompanyMachineUserBuyerKeyCreateRequest = components['schemas']['CompanyMachineUserBuyerKeyRequest'];
+
+/**
+ * Returned once when a Machine user's Buyer key is created. The `secret` is
+ * shown exactly once and cannot be retrieved again.
+ */
+export declare type CompanyMachineUserBuyerKeyCreateResponse = components['schemas']['CompanyMachineUserBuyerKeyCreateResponse'];
+
+/** A Machine user's Buyer keys, oldest first. */
+export declare type CompanyMachineUserBuyerKeyList = components['schemas']['CompanyMachineUserBuyerKeyList'];
+
+/**
+ * Issue and revoke a Machine user's Buyer keys. Company admins only.
+ *
+ * A Machine user's Buyer key logs in through `auth.loginWithBuyerApiKey()` (or
+ * `createAgentClient()`), exactly like a buyer's own key. Its spending limit is
+ * the Machine user's membership Spend cap, so a key carries no
+ * `spending_limit_cents` of its own.
+ *
+ * **Secret handling:** `create()` returns the `secret` exactly once.
+ *
+ * Obtain via `client.company.machineUsers.buyerKeys` — do not construct directly.
+ */
+declare class CompanyMachineUserBuyerKeysNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Lists a Machine user's Buyer keys, oldest first. Secrets are never included.
+     *
+     * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
+     * @returns The keys.
+     * @throws {NotFoundError} When the Machine user is not in the caller's Company.
+     */
+    list(machineUserId: string): Promise<CompanyMachineUserBuyerKeyList>;
+    /**
+     * Creates a Buyer key for a Machine user.
+     *
+     * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
+     * @param body - The key's name, unique among this Machine user's Buyer keys.
+     * @returns The key with its one-time `secret` — store it immediately.
+     * @throws {LedewireError} With `statusCode === 409` when the Machine user is
+     *   deactivated; with `statusCode === 422` for a duplicate name.
+     */
+    create(machineUserId: string, body: CompanyMachineUserBuyerKeyCreateRequest): Promise<CompanyMachineUserBuyerKeyCreateResponse>;
+    /**
+     * Revokes a Machine user's Buyer key.
+     *
+     * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
+     * @param id - The key id.
+     * @throws {NotFoundError} When there is no such Machine user in the caller's
+     *   Company, or no such active key.
+     */
+    revoke(machineUserId: string, id: string): Promise<void>;
+}
+
+/** Request body for creating a Machine user. */
+export declare type CompanyMachineUserCreateRequest = components['schemas']['CompanyMachineUserRequest'];
+
+/** The Company's Machine users. */
+export declare type CompanyMachineUserList = components['schemas']['CompanyMachineUserList'];
+
+/**
+ * A Machine user's active MCP API key. Carries buyer scopes only
+ * (`mcp:search`, `mcp:purchase`), never a store, and does not expire.
+ */
+export declare type CompanyMachineUserMcpKey = components['schemas']['CompanyMachineUserMcpKey'];
+
+/** Request body for creating a Machine user's MCP API key. */
+export declare type CompanyMachineUserMcpKeyCreateRequest = components['schemas']['CompanyMachineUserMcpKeyRequest'];
+
+/**
+ * Returned once when a Machine user's MCP API key is created. The `secret` is
+ * shown exactly once and cannot be retrieved again.
+ */
+export declare type CompanyMachineUserMcpKeyCreateResponse = components['schemas']['CompanyMachineUserMcpKeyCreateResponse'];
+
+/** A Machine user's MCP API keys, oldest first. */
+export declare type CompanyMachineUserMcpKeyList = components['schemas']['CompanyMachineUserMcpKeyList'];
+
+/**
+ * Issue and revoke a Machine user's MCP API keys. Company admins only.
+ *
+ * A Machine user's MCP key carries buyer scopes only — `mcp:search` and
+ * `mcp:purchase` — never a store, and does not expire; revoke it instead. It is
+ * presented to the Ledewire MCP server as `Authorization: Bearer <key>:<secret>`.
+ *
+ * **Secret handling:** `create()` returns the `secret` exactly once.
+ *
+ * Obtain via `client.company.machineUsers.mcpKeys` — do not construct directly.
+ */
+declare class CompanyMachineUserMcpKeysNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Lists a Machine user's active MCP API keys, oldest first. Secrets are never
+     * included.
+     *
+     * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
+     * @returns The keys.
+     * @throws {NotFoundError} When the Machine user is not in the caller's Company.
+     */
+    list(machineUserId: string): Promise<CompanyMachineUserMcpKeyList>;
+    /**
+     * Creates an MCP API key for a Machine user.
+     *
+     * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
+     * @param body - A label and at least one of `'mcp:search'`, `'mcp:purchase'`.
+     *   Any other scope, or a `store_id`, is refused with `400`.
+     * @returns The key with its one-time `secret` — store it immediately.
+     * @throws {LedewireError} With `statusCode === 409` when the Machine user is
+     *   deactivated; with `statusCode === 422` for a duplicate label.
+     */
+    create(machineUserId: string, body: CompanyMachineUserMcpKeyCreateRequest): Promise<CompanyMachineUserMcpKeyCreateResponse>;
+    /**
+     * Revokes a Machine user's MCP API key.
+     *
+     * @param machineUserId - The Machine user id (`CompanyMachineUser.id`).
+     * @param id - The key id.
+     * @throws {NotFoundError} When there is no such Machine user in the caller's
+     *   Company, or no such active key.
+     */
+    revoke(machineUserId: string, id: string): Promise<void>;
+}
+
+/**
+ * Manage the Company's Machine users. Company admins only.
+ *
+ * A Machine user is a Buyer with a name and no email, password or login — an
+ * identity for an autonomous agent that spends the Company's money. It joins at
+ * once as a non-admin member with the default daily Spend cap (change it with
+ * `company.members.update()`), and authenticates only with the keys an admin
+ * issues it through {@link buyerKeys} and {@link mcpKeys}. Every human-only flow
+ * (login, Google sign-in, password reset, accepting or leaving a membership)
+ * refuses it.
+ *
+ * Obtain via `client.company.machineUsers` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const agentUser = await client.company.machineUsers.create({ name: 'research-agent' })
+ * const { key, secret } = await client.company.machineUsers.buyerKeys.create(agentUser.id, {
+ *   name: 'production',
+ * })
+ * // Store immediately — the secret cannot be retrieved again
+ * await secretsManager.put('LEDEWIRE_AGENT_KEY', `${key}:${secret}`)
+ *
+ * // The agent then authenticates as the Machine user (server-side, @ledewire/node)
+ * const agent = createAgentClient({ key, secret })
+ * ```
+ */
+declare class CompanyMachineUsersNamespace {
+    private readonly http;
+    /** A Machine user's Buyer keys: list, create, revoke. */
+    readonly buyerKeys: CompanyMachineUserBuyerKeysNamespace;
+    /** A Machine user's MCP API keys: list, create, revoke. */
+    readonly mcpKeys: CompanyMachineUserMcpKeysNamespace;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Lists the Company's Machine users, deactivated ones included
+     * (`deactivated_at` set).
+     *
+     * @returns The Machine users.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {NotFoundError} When the caller belongs to no Company.
+     */
+    list(): Promise<CompanyMachineUserList>;
+    /**
+     * Creates a Machine user, joined at once as an active non-admin member.
+     *
+     * @param body - A name (at most 100 characters, unique among the Company's
+     *   active Machine users) and an optional description.
+     * @returns The Machine user.
+     * @throws {LedewireError} With `statusCode === 409` when an active Machine
+     *   user already has this name; with `statusCode === 422` when the name is
+     *   blank or too long.
+     */
+    create(body: CompanyMachineUserCreateRequest): Promise<CompanyMachineUser>;
+    /**
+     * Deactivates a Machine user, **permanently**. In one step this closes its
+     * membership, revokes every key it holds, and ends its sessions. It cannot be
+     * reactivated; create a new one, which may reuse the name.
+     *
+     * @param id - The Machine user id (`CompanyMachineUser.id`).
+     * @returns The deactivated Machine user.
+     * @throws {NotFoundError} When the Machine user is not in the caller's Company.
+     * @throws {LedewireError} With `statusCode === 409` when already deactivated.
+     */
+    deactivate(id: string): Promise<CompanyMachineUser>;
+}
+
+/**
+ * An open Company membership as a Company admin sees it. `id` is the membership
+ * id the `company.members` methods take — not the member's `user_id`.
+ */
+export declare type CompanyMember = components['schemas']['CompanyMember'];
+
+/** The Company's open memberships. */
+export declare type CompanyMemberList = components['schemas']['CompanyMemberList'];
+
+/**
+ * The authenticated buyer's own open Company membership. Names the Company but
+ * never its balance: a member sees only what they may still spend.
+ */
+export declare type CompanyMembership = components['schemas']['CompanyMembership'];
+
+/**
+ * Read or close the authenticated buyer's own Company membership.
+ *
+ * While a buyer holds an open membership, the Company wallet pays for their
+ * purchases and their own membership Spend cap limits them. They never see the
+ * Company balance: `wallet.balance()` reports `balance_cents: null` and a
+ * `remaining_cents` allowance instead, with `company_name` naming whose wallet
+ * pays.
+ *
+ * Obtain via `client.company.membership` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   const { company_name, role } = await client.company.membership.get()
+ *   console.log(`Purchases are paid by ${company_name} (${role})`)
+ * } catch (err) {
+ *   if (err instanceof NotFoundError) console.log('Not in a Company')
+ *   else throw err
+ * }
+ * ```
+ */
+declare class CompanyMembershipNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Returns the authenticated buyer's open Company membership. Names the
+     * Company, never its balance.
+     *
+     * @returns The membership.
+     * @throws {NotFoundError} When the buyer belongs to no Company.
+     */
+    get(): Promise<CompanyMembership>;
+    /**
+     * Leaves the Company. The buyer's purchases are paid from their personal
+     * wallet again afterwards.
+     *
+     * @throws {NotFoundError} When the buyer belongs to no Company.
+     * @throws {ForbiddenError} For a Machine user, which cannot leave — an admin
+     *   deactivates it instead.
+     * @throws {LedewireError} With `statusCode === 422` when the buyer is the
+     *   Company's last admin.
+     */
+    leave(): Promise<void>;
+}
+
+/**
+ * Manage the Company's open memberships: list them, change a member's role or
+ * daily Spend cap, and remove a member. Company admins only.
+ *
+ * Every method takes the **membership id** (`CompanyMember.id`), not the
+ * member's `user_id`.
+ *
+ * A member's daily Spend cap is never `null` — Company members are never
+ * uncapped. It defaults to 1000 cents ($10) on joining, is read in the
+ * Company's timezone, and also binds bulk acquisitions.
+ *
+ * Obtain via `client.company.members` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const { data: members } = await client.company.members.list()
+ * const analyst = members.find((m) => m.email === 'analyst@example.com')
+ * if (analyst) {
+ *   await client.company.members.update(analyst.id, { daily_spend_limit_cents: 5000 })
+ * }
+ * ```
+ */
+declare class CompanyMembersNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Lists the Company's open memberships, Machine users included
+     * (`kind: 'machine'`, `email: null`).
+     *
+     * @returns The members.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {NotFoundError} When the caller belongs to no Company.
+     */
+    list(): Promise<CompanyMemberList>;
+    /**
+     * Changes a member's role, daily Spend cap, or both. Any admin may set any
+     * member's cap, their own included.
+     *
+     * @param id - The membership id (`CompanyMember.id`).
+     * @param body - At least one of `role` and `daily_spend_limit_cents`.
+     * @returns The updated member.
+     * @throws {LedewireError} With `statusCode === 400` when neither field is
+     *   given or the cap is `null`/negative; with `statusCode === 422` for an
+     *   unknown role, or a change that would leave the Company with no admin.
+     */
+    update(id: string, body: CompanyMemberUpdateRequest): Promise<CompanyMember>;
+    /**
+     * Removes a member, closing their membership. Their ledger accounts stay
+     * with the Company. Removing a Machine user deactivates it permanently.
+     *
+     * @param id - The membership id (`CompanyMember.id`).
+     * @throws {LedewireError} With `statusCode === 422` when it would leave the
+     *   Company with no admin.
+     */
+    remove(id: string): Promise<void>;
+}
+
+/**
+ * Request body for changing a member's role or daily Spend cap — at least one
+ * of the two. `daily_spend_limit_cents` cannot be `null`: a Company member is
+ * never uncapped.
+ */
+export declare type CompanyMemberUpdateRequest = components['schemas']['CompanyMemberRoleRequest'];
+
+/**
+ * Company operations for the authenticated buyer.
+ *
+ * A Company is a shared wallet that pays for its members' purchases. Each
+ * member spends under their own daily Spend cap, set by a Company admin, and
+ * never sees the Company balance. Admins fund the wallet, manage members and
+ * Machine users (agent identities with no login), and report on spend.
+ *
+ * `membership` and `invitations.accept()` are for any buyer; everything else is
+ * Company-admin only and throws {@link ForbiddenError} for a plain member.
+ *
+ * Obtain via `client.company` — do not construct directly.
+ */
+declare class CompanyNamespace {
+    /** The authenticated buyer's own membership: read it, or leave the Company. */
+    readonly membership: CompanyMembershipNamespace;
+    /** Invite people to the Company (admin), and accept an invitation (invitee). */
+    readonly invitations: CompanyInvitationsNamespace;
+    /** List members, change a member's role or daily Spend cap, remove a member (admin). */
+    readonly members: CompanyMembersNamespace;
+    /** Machine users and their Buyer keys and MCP API keys (admin). */
+    readonly machineUsers: CompanyMachineUsersNamespace;
+    /** Fund the Company wallet and list unsettled top-ups (admin). */
+    readonly wallet: CompanyWalletNamespace;
+    /** Everything the Company paid for, attributed to its members (admin). */
+    readonly purchases: CompanyPurchasesNamespace;
+    /** What each member has spent of the Company's money (admin). */
+    readonly spend: CompanySpendNamespace;
+    /* Excluded from this release type: __constructor */
+}
+
+/** A Company wallet top-up that has not settled yet. */
+export declare type CompanyPendingTopUp = components['schemas']['CompanyPendingTopUp'];
+
+/** The Company's unsettled top-ups, newest first. */
+export declare type CompanyPendingTopUpList = components['schemas']['CompanyPendingTopUpList'];
+
+/**
+ * One thing the Company paid for — a purchase or a Bulk acquisition drawn on
+ * the Company wallet — attributed to the membership that bought it.
+ */
+export declare type CompanyPurchase = components['schemas']['CompanyPurchase'];
+
+/** Everything the Company paid for, newest first, paginated. */
+export declare type CompanyPurchaseList = components['schemas']['CompanyPurchaseList'];
+
+/**
+ * The membership a {@link CompanyPurchase} or spend row is attributed to.
+ * Recorded at payment time, so it still names a member who has since left.
+ */
+export declare type CompanyPurchaseMember = components['schemas']['CompanyPurchaseMember'];
+
+/**
+ * Everything the Company paid for. Company admins only.
+ *
+ * Obtain via `client.company.purchases` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const { data, pagination } = await client.company.purchases.list({
+ *   kind: 'bulk_acquisition',
+ *   from: '2026-09-01',
+ *   to: '2026-09-30',
+ * })
+ * ```
+ */
+declare class CompanyPurchasesNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Lists every purchase and Bulk acquisition drawn on the Company wallet,
+     * newest first, each attributed to the membership that bought it — including
+     * members who have since left. A Bulk acquisition's per-work purchases are
+     * not listed separately, and a failed purchase is not listed.
+     *
+     * A Bulk acquisition's corpus and manifest are reachable by a Company admin
+     * through `acquisitions.getCorpus()` / `downloadCorpus()` / `getManifest()`
+     * with its `id`.
+     *
+     * @param params - Optional filters (`member`, `from`, `to`, `kind`) and pagination.
+     * @returns A paginated list of Company purchases.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {LedewireError} With `statusCode === 400` for an invalid filter.
+     */
+    list(params?: CompanyPurchasesParams): Promise<CompanyPurchaseList>;
+}
+
+/** Query parameters accepted by `GET /v1/company/purchases`. */
+export declare interface CompanyPurchasesParams extends CompanyReportFilters {
+    /** Only purchases, or only Bulk acquisitions. Both by default. */
+    kind?: CompanyPurchase['kind'];
+    /** Page number (1-based). Defaults to 1. */
+    page?: number;
+    /** Items per page. Maximum 100. Defaults to 25. */
+    per_page?: number;
+}
+
+/**
+ * Filters shared by the Company purchase and spend reports. `from`/`to` are
+ * inclusive `YYYY-MM-DD` days read in the Company's timezone.
+ */
+export declare interface CompanyReportFilters {
+    /** A membership id (`member.id`), open or closed. */
+    member?: string;
+    /** The first day to include, `YYYY-MM-DD`, in the Company's timezone. */
+    from?: string;
+    /** The last day to include, `YYYY-MM-DD`, in the Company's timezone. */
+    to?: string;
+    [key: string]: string | number | undefined;
+}
+
+/** A Company membership role. Only an `admin` can manage the Company. */
+export declare type CompanyRole = CompanyMembership['role'];
+
+/** What each membership, open or closed, has spent of the Company's money. */
+export declare type CompanySpendList = components['schemas']['CompanySpendList'];
+
+/**
+ * What each member has spent of the Company's money. Company admins only.
+ *
+ * Obtain via `client.company.spend` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const { data } = await client.company.spend.list({ from: '2026-09-01' })
+ * for (const { member, spend_cents } of data) console.log(member.name, spend_cents)
+ * ```
+ */
+declare class CompanySpendNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Returns one row per membership the Company has had, open or closed, oldest
+     * first, with what each spent in the range — lifetime when neither `from`
+     * nor `to` is given.
+     *
+     * `spend_cents` is net of refunds and counts what a Bulk acquisition
+     * captured; a live hold does not count until it captures, so it can be lower
+     * than the same member's `amount_cents` in `company.purchases.list()`.
+     *
+     * @param params - Optional `member`, `from`, and `to` filters.
+     * @returns Spend per membership.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {LedewireError} With `statusCode === 400` for an invalid filter.
+     */
+    list(params?: CompanySpendParams): Promise<CompanySpendList>;
+}
+
+/**
+ * Query parameters accepted by `GET /v1/company/spend`. Lifetime spend when
+ * neither `from` nor `to` is given.
+ */
+export declare type CompanySpendParams = CompanyReportFilters;
+
+/**
+ * Fund the Company wallet and track top-ups that have not settled. Company
+ * admins only.
+ *
+ * Members never see the Company balance and cannot fund the Company wallet; a
+ * member who runs short is refused at purchase and must ask an admin.
+ *
+ * Obtain via `client.company.wallet` — do not construct directly.
+ *
+ * @example
+ * ```ts
+ * const session = await client.company.wallet.createPaymentSession({ amount_cents: 50000 })
+ * // Confirm with session.client_secret in the payment widget, as for a personal top-up.
+ *
+ * const { data: pending } = await client.company.wallet.listPendingTopUps()
+ * ```
+ */
+declare class CompanyWalletNamespace {
+    private readonly http;
+    /* Excluded from this release type: __constructor */
+    /**
+     * Starts a Company wallet top-up, by card or ACH (`us_bank_account`). Confirm
+     * it client-side with the returned `client_secret`, as for a personal top-up.
+     *
+     * The top-up is spendable only once it settles: a card usually settles at
+     * once, an ACH debit after about four business days. Starting another top-up
+     * never cancels an ACH debit already processing. Track it with
+     * {@link listPendingTopUps}: a top-up drops off that list once it settles.
+     * (`wallet.getPaymentStatus()` covers personal top-ups only and does not
+     * find a Company session.)
+     *
+     * @param body - The amount to fund.
+     * @returns Payment session details for the payment provider widget.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     * @throws {LedewireError} With `statusCode === 402` when the payment provider
+     *   refused to create the session.
+     */
+    createPaymentSession(body: WalletPaymentSessionRequest): Promise<WalletPaymentSessionResponse>;
+    /**
+     * Lists the Company's top-ups that are not yet spendable, newest first:
+     * `pending` (a session not yet paid), `awaiting_verification` (a bank account
+     * whose microdeposits are not yet confirmed, up to ten days), and
+     * `processing` (an ACH debit under way).
+     *
+     * @returns The pending top-ups.
+     * @throws {ForbiddenError} When the caller is not a Company admin.
+     */
+    listPendingTopUps(): Promise<CompanyPendingTopUpList>;
+}
+
 declare interface components {
     schemas: {
         /** @description Platform-level public configuration. No authentication required. */
@@ -653,10 +1298,19 @@ declare interface components {
         ContentAccessInfo: {
             user_id: string | null;
             has_purchased: boolean;
+            /** @description Whether the buyer can afford the price. For a Company member, whether their Remaining covers it — the Company balance is never consulted, and a shortfall there surfaces only as the refusal at purchase. */
             has_sufficient_funds: boolean;
-            wallet_balance_cents: number;
-            /** @enum {string} */
+            /** @description The buyer's wallet balance. null for a Company member, who never sees the Company balance. */
+            wallet_balance_cents: number | null;
+            /**
+             * @description Never fund_wallet for a Company member, who cannot fund the Company wallet.
+             * @enum {string}
+             */
             next_required_action: 'authenticate' | 'fund_wallet' | 'purchase';
+            /** @description Spend cap minus spend so far today — for a Company member, their membership's cap. null when the buyer is uncapped or unauthenticated. */
+            remaining_cents: number | null;
+            /** @description The buyer's Company, if they hold an open membership. */
+            company_name: string | null;
         };
         AuthenticationResponse: {
             /** @enum {string} */
@@ -666,7 +1320,7 @@ declare interface components {
             refresh_token: string;
             /**
              * Format: date-time
-             * @description When the Access Token expires
+             * @description When the access token expires, about 30 minutes after it was issued. Equal to the token's `exp` claim. Refresh before then.
              */
             expires_at: string;
         };
@@ -676,7 +1330,10 @@ declare interface components {
             token_type: 'Bearer';
             access_token: string;
             refresh_token: string;
-            /** Format: date-time */
+            /**
+             * Format: date-time
+             * @description When the access token expires, about 30 minutes after it was issued. Equal to the token's `exp` claim. Refresh before then.
+             */
             expires_at: string;
             /** @description Stores the authenticated user can manage, for store-selection on the client. */
             stores: components['schemas']['MerchantLoginStore'][];
@@ -731,15 +1388,19 @@ declare interface components {
                 message: string;
                 /**
                  * @description Machine-readable reason, present on refusals that carry one. Branch on this rather than on `message`, which is prose and may be reworded. `retrieval_failed` is transient and worth retrying; `not_licensable` means report it undelivered; `price_drifted` means re-quote; `client_error` is ours to fix and must never be retried unchanged; `insufficient_funds` is cleared by funding the wallet and `daily_spend_cap_reached` deliberately is not.
+                 *
+                 *     On the Bulk acquisition steps: `exclusions_unacknowledged` means post the acknowledgement first; `quote_not_ready` means keep polling a `pending` quote or re-quote a `failed` one (`quote_state` says which); `quote_expired` and `quote_in_progress` mean re-quote, and wait for the re-quote already running; `invalid_acquisition_state` means re-read the acquisition (`status` and `expected_status` are alongside); `nothing_to_hold` means every work was excluded and a different selection is needed; `run_not_started` means the run could not be queued, so nothing was held and the same authorization is safe to retry.
                  * @enum {string}
                  */
-                type?: 'retrieval_failed' | 'not_licensable' | 'price_drifted' | 'client_error' | 'insufficient_funds' | 'daily_spend_cap_reached';
+                type?: 'retrieval_failed' | 'not_licensable' | 'price_drifted' | 'client_error' | 'insufficient_funds' | 'daily_spend_cap_reached' | 'exclusions_unacknowledged' | 'invalid_acquisition_state' | 'quote_not_ready' | 'nothing_to_hold' | 'quote_expired' | 'quote_in_progress' | 'run_not_started';
             };
         };
         AuthSignupRequest: {
             email: string;
             password: string;
             name: string;
+            /** @description The token from a Company invitation email. When it names a pending invitation addressed to this email, signup also accepts it and the new buyer joins the Company. Otherwise the account is created without a membership. */
+            company_invitation_token?: string;
         };
         AuthLoginEmailRequest: {
             email?: string;
@@ -793,7 +1454,7 @@ declare interface components {
             /** @description 64-char hex authentication secret. Store immediately — shown once only. */
             secret: string;
         };
-        /** @description The authenticated buyer's daily spend cap, read against the current spend window. The cap governs every wallet debit the buyer makes — MCP, REST, or the web payment gate — and spend is derived from completed purchases, so a refund returns allowance. cap_cents, spent_cents, remaining_cents and resets_at are spelled exactly as they are in DailySpendCapReachedError, so a refusal and this resource describe the same numbers. */
+        /** @description The authenticated buyer's daily spend cap, read against the current spend window. The cap governs every wallet debit the buyer makes — MCP, REST, or the web payment gate — and spend is derived from completed purchases, so a refund returns allowance. cap_cents, spent_cents, remaining_cents and resets_at are spelled exactly as they are in DailySpendCapReachedError, so a refusal and this resource describe the same numbers. For a Company member it is the membership's cap, read-only, in the Company's timezone, counting only spend paid through the membership; company_name names the Company. The Company balance never appears here. */
         UserSpendCap: {
             /** @description The daily spend cap in cents. null means uncapped. */
             cap_cents: number | null;
@@ -808,8 +1469,259 @@ declare interface components {
              * @description The instant the current spend window rolls, in UTC.
              */
             resets_at: string;
-            /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. */
+            /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. Always false for a Company member, whose cap binds bulk acquisitions too. */
             bulk_exempt: boolean;
+            /** @description The Company whose cap this is, for a buyer with an open Company membership; null otherwise. A member sees the Company's name, never its balance. */
+            company_name: string | null;
+        };
+        /** @description A pending invitation to join a Company. Joining always waits for the invitee to accept, because it moves their Agents' spending onto the Company wallet. Never carries the signup token, which reaches only the invited address. */
+        CompanyInvitation: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            company_id: string;
+            company_name: string;
+            /** @description The invited address, lowercased. */
+            email: string;
+            /** @enum {string} */
+            role: 'admin' | 'member';
+            /** Format: date-time */
+            invited_at: string;
+            /**
+             * Format: date-time
+             * @description Seven days after it was sent. An expired invitation cannot be accepted.
+             */
+            expires_at: string;
+        };
+        CompanyInvitationList: {
+            data: components['schemas']['CompanyInvitation'][];
+        };
+        CompanyInvitationRequest: {
+            email: string;
+            /**
+             * @default member
+             * @enum {string}
+             */
+            role: 'admin' | 'member';
+        };
+        /** @description An open membership as a Company admin sees it. */
+        CompanyMember: {
+            /**
+             * Format: uuid
+             * @description The membership id, used by the members/{id} routes.
+             */
+            id: string;
+            /** Format: uuid */
+            user_id: string;
+            name: string;
+            /** @description Null for a Machine user, which has no email address. */
+            email: string | null;
+            /**
+             * @description A machine member is a Machine user: it cannot be made an admin, and removing it deactivates it permanently.
+             * @enum {string}
+             */
+            kind: 'human' | 'machine';
+            /** @enum {string} */
+            role: 'admin' | 'member';
+            /** Format: date-time */
+            joined_at: string;
+            /** @description The member's daily Spend cap, read in the Company's timezone. Never null: a member is never uncapped. Defaults to 1000 ($10) on joining, and again on rejoining. */
+            daily_spend_limit_cents: number;
+        };
+        /** @description One thing the Company paid for, as a Company admin sees it: a purchase or a Bulk acquisition drawn on the Company wallet, attributed to the member who bought it. */
+        CompanyPurchase: {
+            /** @enum {string} */
+            kind: 'purchase' | 'bulk_acquisition';
+            /**
+             * Format: uuid
+             * @description The purchase id, or the acquisition id for a Bulk acquisition.
+             */
+            id: string;
+            member: components['schemas']['CompanyPurchaseMember'];
+            /** @description The purchase's or the acquisition's own status. */
+            status: string;
+            /** @description A purchase's price. A Bulk acquisition's captured amount once it has settled, failed or been cancelled, and the amount still held while it is authorized or acquiring — so while a Hold is live this is more than the member's `spend_cents`, which counts only what was captured. */
+            amount_cents: number;
+            /**
+             * Format: date-time
+             * @description When the purchase was made, or when the Bulk acquisition was authorized — the moment it counts against the member's Spend window.
+             */
+            occurred_at: string;
+        };
+        /** @description The membership that paid. Recorded when it was paid, so it still names the member after they leave; a person who left and rejoined appears under each membership. */
+        CompanyPurchaseMember: {
+            /**
+             * Format: uuid
+             * @description The membership id, which the `member` filter takes.
+             */
+            id: string;
+            /** Format: uuid */
+            user_id: string;
+            name: string;
+            /** @enum {string} */
+            kind: 'human' | 'machine';
+            /**
+             * Format: date-time
+             * @description When the membership closed, or null while it is open.
+             */
+            left_at: string | null;
+        };
+        CompanyPurchaseList: {
+            data: components['schemas']['CompanyPurchase'][];
+            pagination: components['schemas']['PaginationMeta'];
+        };
+        CompanySpendList: {
+            /** @description Every membership the Company has had, open or closed, oldest first. */
+            data: {
+                member: components['schemas']['CompanyPurchaseMember'];
+                /** @description What the member has spent of the Company's money in the range, net of refunds, read from the member's own ledger account. A Bulk acquisition counts what it captured; a live Hold does not count until it captures. */
+                spend_cents: number;
+            }[];
+        };
+        /** @description A Machine user as a Company admin sees it: a Buyer with a name and no email, password or login, created as an active non-admin member. Deactivation is permanent. */
+        CompanyMachineUser: {
+            /**
+             * Format: uuid
+             * @description The Machine user id, used by the machine-users/{id} routes.
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @description Its Buyer id, which attribution and history name it by.
+             */
+            user_id: string;
+            /** @description Unique among the Company's active Machine users; a deactivated one's may be reused. */
+            name: string;
+            description: string | null;
+            /** Format: uuid */
+            created_by_user_id: string | null;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            deactivated_at: string | null;
+        };
+        CompanyMachineUserList: {
+            data: components['schemas']['CompanyMachineUser'][];
+        };
+        CompanyMachineUserRequest: {
+            name: string;
+            description?: string | null;
+        };
+        /** @description A Machine user's Buyer key as a Company admin sees it. It logs in through POST /v1/auth/login/buyer-api-key. Its limit is the Machine user's membership Spend cap. */
+        CompanyMachineUserBuyerKey: {
+            /** Format: uuid */
+            id: string;
+            name: string;
+            /** @description Structured public identifier (e.g. bktst_abc123) */
+            key: string;
+            /**
+             * Format: uuid
+             * @description The Company admin who created it.
+             */
+            created_by_user_id: string | null;
+            /** Format: date-time */
+            last_used_at: string | null;
+            /** Format: date-time */
+            created_at: string;
+        };
+        /** @description Returned once only at creation. The secret is not stored and cannot be retrieved again. */
+        CompanyMachineUserBuyerKeyCreateResponse: components['schemas']['CompanyMachineUserBuyerKey'] & {
+            /** @description 64-char hex authentication secret. Store immediately — shown once only. */
+            secret: string;
+        };
+        CompanyMachineUserBuyerKeyList: {
+            data: components['schemas']['CompanyMachineUserBuyerKey'][];
+        };
+        /** @description spending_limit_cents is refused with 400: the Machine user's membership Spend cap is its limit. */
+        CompanyMachineUserBuyerKeyRequest: {
+            /** @description Unique among this Machine user's Buyer keys. */
+            name: string;
+        };
+        /** @description A Machine user's active MCP API Key as a Company admin sees it. Presented as a `key:secret` Bearer token. It carries buyer Scopes only, never a Store, and does not expire; revoke it instead. */
+        CompanyMachineUserMcpKey: {
+            /** Format: uuid */
+            id: string;
+            label: string;
+            key: string;
+            scopes: ('mcp:search' | 'mcp:purchase')[];
+            /**
+             * Format: uuid
+             * @description The Company admin who created it.
+             */
+            created_by_user_id: string | null;
+            /**
+             * Format: date-time
+             * @description Always null for a key an admin created.
+             */
+            expires_at: string | null;
+            /** Format: date-time */
+            last_used_at: string | null;
+            /** Format: date-time */
+            created_at: string;
+        };
+        /** @description Returned once only at creation. The secret cannot be retrieved again. */
+        CompanyMachineUserMcpKeyCreateResponse: components['schemas']['CompanyMachineUserMcpKey'] & {
+            /** @description Authentication secret. Store immediately — shown once only. */
+            secret: string;
+        };
+        CompanyMachineUserMcpKeyList: {
+            data: components['schemas']['CompanyMachineUserMcpKey'][];
+        };
+        /** @description Any Scope other than mcp:search and mcp:purchase, or a store_id, is refused with 400. */
+        CompanyMachineUserMcpKeyRequest: {
+            label: string;
+            scopes: ('mcp:search' | 'mcp:purchase')[];
+        };
+        CompanyMemberList: {
+            data: components['schemas']['CompanyMember'][];
+        };
+        /** @description A Company wallet top-up that has not yet settled, as a Company admin sees it. */
+        CompanyPendingTopUp: {
+            /** Format: uuid */
+            id: string;
+            /** @description The payment session id returned when the top-up was started. */
+            session_id: string | null;
+            amount_cents: number;
+            /** @enum {string} */
+            status: 'pending' | 'awaiting_verification' | 'processing';
+            /**
+             * Format: uuid
+             * @description The admin who started the top-up.
+             */
+            initiated_by_user_id: string;
+            /** Format: date-time */
+            created_at: string;
+            /**
+             * Format: date
+             * @description The payment provider's estimate of when an ACH debit lands. Not guaranteed, and null until the provider can determine it, and always for a card.
+             */
+            expected_debit_date: string | null;
+        };
+        CompanyPendingTopUpList: {
+            data: components['schemas']['CompanyPendingTopUp'][];
+        };
+        CompanyInvitationAcceptRequest: {
+            /** @description The token from the invitation email. */
+            token: string;
+        };
+        /** @description At least one of role and daily_spend_limit_cents. */
+        CompanyMemberRoleRequest: {
+            /** @enum {string} */
+            role?: 'admin' | 'member';
+            /** @description The member's daily Spend cap in cents. Any admin may set any member's, their own included. null is refused — a member is never uncapped. Writes an AuditEvent. */
+            daily_spend_limit_cents?: number;
+        };
+        /** @description The authenticated buyer's own open Company membership. Names the Company but never its balance. */
+        CompanyMembership: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            company_id: string;
+            company_name: string;
+            /** @enum {string} */
+            role: 'admin' | 'member';
+            /** Format: date-time */
+            joined_at: string;
         };
         /** @description Sets the buyer's cap. The field is required and nullable: null is how a buyer becomes uncapped, and an omitted field is treated as a client error rather than as a request to be uncapped. A cap below spend already made in the current window is accepted — it simply leaves remaining_cents at zero until the window rolls. Zero is a valid cap and refuses every priced purchase. */
         UserSpendCapUpdateRequest: {
@@ -828,9 +1740,9 @@ declare interface components {
              * @description Scopes the key to a specific store. User must be an owner or author of that store.
              */
             store_id?: string | null;
-            /** @description Grants access to seller content management tools. Defaults to false. */
+            /** @description Grants access to seller content management tools. Defaults to false. Requires a `store_id` for which the user is an owner or author; otherwise the request is refused with 403. Re-checked on every use, so a key stops working if the holder loses the role. */
             can_manage_content?: boolean;
-            /** @description Grants access to seller analytics tools. Defaults to false. */
+            /** @description Grants access to seller analytics tools. Defaults to false. Requires a `store_id` for which the user is an owner or author; an author's analytics cover only their own content. Otherwise refused with 403, and re-checked on every use. */
             can_read_analytics?: boolean;
         };
         /** @description Returned once only at creation. The secret cannot be retrieved again. */
@@ -891,7 +1803,7 @@ declare interface components {
             /** @description Academic citation count from source metadata. Null for non-academic content or unknown values. */
             citation_count: number | null;
         };
-        /** @description Content returned to a store team member (owner or author) accessing their own content without a purchase. */
+        /** @description Content returned without a purchase to a store team member reading their own store's content — any of it for an owner, only what they wrote for an author. */
         McpSellerContent: components['schemas']['McpContentSearchResult'] & {
             /** @description Article body. Present when content_type is `markdown` or inline `html`. */
             content_body?: string | null;
@@ -960,8 +1872,12 @@ declare interface components {
             } | null;
         };
         McpGetWalletBalanceResult: {
-            /** @description Current wallet balance in cents for the authenticated MCP key owner. */
-            wallet_balance_cents: number;
+            /** @description Current wallet balance in cents for the authenticated MCP key owner. null for a Company member, who never sees the Company balance; read remaining_cents instead. */
+            wallet_balance_cents: number | null;
+            /** @description Spend cap minus spend so far today — for a Company member, their membership's cap, never reduced by the Company balance. null when uncapped. */
+            remaining_cents: number | null;
+            /** @description The Company whose wallet pays, for a member; null otherwise. */
+            company_name: string | null;
         };
         McpRegisterResult: {
             /** @description The API key identifier (not secret). */
@@ -976,8 +1892,12 @@ declare interface components {
             content: components['schemas']['McpContentSearchResult'];
             /** @description Whether the authenticated user has a completed purchase for this content. */
             has_purchased: boolean;
-            /** @description Current wallet balance in cents for the authenticated MCP key owner. */
-            wallet_balance_cents: number;
+            /** @description Current wallet balance in cents for the authenticated MCP key owner. null for a Company member, who never sees the Company balance. */
+            wallet_balance_cents: number | null;
+            /** @description Spend cap minus spend so far today; a member's membership cap. null when uncapped. */
+            remaining_cents: number | null;
+            /** @description The Company whose wallet pays, for a member; null otherwise. */
+            company_name: string | null;
         };
         McpListPurchasesResult: {
             /** @description Receipts, newest first, one per purchase and never collapsed — a Buyer may hold several purchases of one work, each at the price in force when it was made. These were `McpFullContent` until #939, which meant this endpoint returned the body of every article the Buyer had ever bought. */
@@ -987,7 +1907,7 @@ declare interface components {
             offset: number;
             limit: number;
         };
-        /** @description Returned as structuredContent when a get_content payment attempt fails due to insufficient wallet balance. Always accompanied by isError: true. */
+        /** @description Returned as structuredContent when a get_content payment attempt fails due to insufficient wallet balance. Always accompanied by isError: true. A Company member instead receives McpCompanyInsufficientFundsError, with the same error code. */
         McpInsufficientFundsError: {
             /** @enum {string} */
             error: 'insufficient_funds';
@@ -1003,6 +1923,14 @@ declare interface components {
              */
             funding_url: string;
         };
+        /** @description A Company member's get_content payment the Company wallet cannot cover. Always accompanied by isError: true. Same error code as McpInsufficientFundsError, but no balance, shortfall or funding_url: a member never sees the Company balance and cannot fund the Company wallet. The remedy is to ask a Company admin. */
+        McpCompanyInsufficientFundsError: {
+            /** @enum {string} */
+            error: 'insufficient_funds';
+            /** @description Price of the content in cents. */
+            required_cents: number;
+            message: string;
+        };
         /** @description Returned as structuredContent when a get_content call is refused because the buyer's daily spend cap would be exceeded. Always accompanied by isError: true. Deliberately carries no funding_url — adding money to the wallet cannot raise a cap, and a payload resembling McpInsufficientFundsError would send agents to the wrong remedy. The cap resets at resets_at; until then the only remedies are raising the cap or waiting. */
         McpDailySpendCapReachedError: {
             /** @enum {string} */
@@ -1018,8 +1946,10 @@ declare interface components {
              * @description The instant the current spend window rolls, in UTC. One calendar day boundary in the buyer's own timezone.
              */
             resets_at: string;
-            /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. */
+            /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only — an authorized bulk acquisition does not consume them — so a client presenting remaining_cents must say which number it is. Always false for a Company member, whose cap binds bulk acquisitions too. */
             bulk_exempt: boolean;
+            /** @description The remedy in words. A Company member is told to ask a Company admin, who sets their cap; anyone else, that the daily cap is reached. */
+            message?: string;
         };
         /** @description The REST and x402 web-gate form of the same refusal, returned with HTTP 402 Payment Required by POST /v1/purchases and GET /v1/x402/contents/{id}. Carries the same fields as McpDailySpendCapReachedError alongside the standard error envelope, and the same absence of a funding URL. `error.type` is the machine-readable discriminator. */
         DailySpendCapReachedError: {
@@ -1043,6 +1973,8 @@ declare interface components {
             resets_at: string;
             /** @description Whether this buyer's bulk acquisitions are exempt from the cap. When true, spent_cents and remaining_cents describe ordinary spend only. */
             bulk_exempt: boolean;
+            /** @description The remedy in words. A Company member is told to ask a Company admin, who sets their cap; anyone else, that the daily cap is reached. */
+            message?: string;
         };
         /** @description Returned by the fund_wallet tool. Contains the buyer portal wallet URL. Open this link in a browser to add funds using the Ledewire wallet funding page. */
         McpFundWalletResult: {
@@ -1272,13 +2204,13 @@ declare interface components {
                 [key: string]: unknown;
             };
         };
-        /** @description The buyer's wallet. balance_cents and spendable_cents are the same number and always will be — balance_cents has always meant "what you can spend", and money committed to a bulk acquisition is a hold, which moves it out of the wallet rather than annotating it. held_cents and holds exist so a buyer mid-acquisition can see why their balance is lower than their purchase history explains. */
+        /** @description The buyer's wallet. balance_cents and spendable_cents are the same number and always will be — balance_cents has always meant "what you can spend", and money committed to a bulk acquisition is a hold, which moves it out of the wallet rather than annotating it. held_cents and holds exist so a buyer mid-acquisition can see why their balance is lower than their purchase history explains. For a Company member the balances are null — a member never sees the Company balance — and remaining_cents and company_name say what they may still spend and whose wallet pays. */
         WalletBalanceResponse: {
-            /** @description Spendable balance in cents. Excludes funds held against a bulk acquisition. */
-            balance_cents: number;
-            /** @description The same figure as balance_cents, named in the vocabulary holds require. */
-            spendable_cents: number;
-            /** @description Total committed to active bulk acquisitions and not yet spent or released. */
+            /** @description Spendable balance in cents. Excludes held funds — those held against a bulk acquisition, and a brokered purchase's price while its content is being retrieved. */
+            balance_cents: number | null;
+            /** @description The same figure as balance_cents, named in the vocabulary holds require. null for a Company member. */
+            spendable_cents: number | null;
+            /** @description Total held and not yet spent or released. Includes, for the few seconds its content is being retrieved, the price of a brokered purchase in progress, which has no entry in holds. */
             held_cents: number;
             /** @description One entry per bulk acquisition currently holding funds. Empty when none is. */
             holds: {
@@ -1292,6 +2224,10 @@ declare interface components {
                  */
                 authorized_at: string;
             }[];
+            /** @description Spend cap minus spend so far today — for a Company member, their membership's cap, never reduced by the Company balance. null when uncapped. */
+            remaining_cents: number | null;
+            /** @description The Company whose wallet pays, for a member; null otherwise. */
+            company_name: string | null;
         };
         WalletTransactionItem: {
             /** @description ID of the transaction entry (matches the source record) */
@@ -1879,10 +2815,11 @@ declare interface components {
         };
         WalletPaymentStatusResponse: {
             /** @enum {string} */
-            status: 'pending' | 'completed' | 'failed';
+            status: 'pending' | 'awaiting_verification' | 'processing' | 'completed' | 'failed' | 'cancelled';
             /** Format: date-time */
             updated_at: string;
-            balance_cents: number;
+            /** @description The wallet balance. null for a Company member, as on GET /v1/wallet/balance. */
+            balance_cents: number | null;
         };
         SalesSummaryResponse: {
             /** @description Amount in cents */
@@ -2010,7 +2947,7 @@ declare interface components {
              */
             line_state: 'pending' | 'firm' | 'estimated' | 'excluded';
             /**
-             * @description Present only on an excluded line. `excluded_rate_unavailable` is the one transient reason.
+             * @description Present only on an excluded line. `excluded_rate_unavailable` is the one transient reason. `excluded_free_not_supported` is retired — a work published at zero is now included at no cost — and appears only on lines quoted before that; a re-quote prices them back in.
              * @enum {string|null}
              */
             exclusion_reason?: 'excluded_malformed' | 'excluded_duplicate' | 'excluded_no_rate' | 'excluded_free_not_supported' | 'excluded_not_deliverable' | 'excluded_insufficient_rights' | 'excluded_above_price_ceiling' | 'excluded_rate_unavailable' | null;
@@ -2049,6 +2986,28 @@ declare interface components {
             domains: string[];
             /** @description Whether works from this publication can come back in a Bulk acquisition's corpus — true when it publishes a `FULL_USE` rate. */
             bulk_licensable: boolean;
+            /** @description The oldest date we have swept this publication back to, when that was true as of, and where we looked. Coverage is stated this way and never as a percentage. Null means "no horizon established yet" — it is not a horizon of zero, and is never sent as an object of nulls. */
+            coverage_horizon: {
+                /**
+                 * Format: date-time
+                 * @description The oldest date swept back to.
+                 * @example 2019-03-01T00:00:00Z
+                 */
+                horizon_at: string;
+                /**
+                 * Format: date-time
+                 * @description When the sweep behind the horizon began. The Broker adds works behind a horizon after the fact, so the horizon holds only of the catalog as it stood at this time.
+                 * @example 2026-09-27T04:30:00Z
+                 */
+                as_of: string;
+                /**
+                 * @description Where the sweep looked — today always the Broker's catalog.
+                 * @example [
+                 *       "catalog"
+                 *     ]
+                 */
+                sources: string[];
+            } | null;
         };
         /** @description Every Publication the Broker reports as ready to license, paginated. */
         PublicationListResponse: {
@@ -2108,7 +3067,7 @@ declare interface components {
              */
             status: 'quoted' | 'authorized' | 'acquiring' | 'settled' | 'cancelled' | 'failed';
             /**
-             * @description Whether the Selection has been priced. Pricing is asynchronous — resolving rates for 10,000 works is ~200 upstream batch calls under undocumented limits — so a submitted Selection comes back `pending` and the client polls this.
+             * @description Whether the Selection has been priced. Pricing is asynchronous — resolving rates for 10,000 works is ~200 upstream batch calls under undocumented limits — so a submitted Selection comes back `pending` and the client polls this. Stop polling once `status` leaves `quoted`: a quote cancelled while still being priced stays `pending`.
              * @enum {string}
              */
             quote_state: 'pending' | 'ready' | 'failed';
@@ -2138,6 +3097,8 @@ declare interface components {
                 /** @description Quoted and not yet reached. What a resumed run will attempt. */
                 outstanding: number;
             };
+            /** @description Seconds to wait before polling again, also sent as `Retry-After`. Present only while there is something to wait for — `quote_state` is `pending` on a `quoted` acquisition, or `status` is `authorized` or `acquiring` — and absent otherwise, so a client can poll for as long as the field is there. Grows with the size of the Selection, from 2 seconds to at most 60. */
+            poll_after_seconds?: number;
             /** Format: date-time */
             created_at: string;
         };
@@ -2174,10 +3135,12 @@ declare interface components {
          *     A corpus is a rendering of Purchases the Buyer already holds, not an entitlement of its own, which is what makes everything about it cheap: it can be discarded and rebuilt, and rebuilding grants nothing that was not already granted. So a blob past its 30-day retention answers `rebuild_required` at 200 rather than 404 or 410 — those would tell the Buyer something was lost, and nothing was.
          *
          *     `rebuild_required` covers "never assembled" as well as "expired", on purpose: from the Buyer's side they are one situation — there is no file, ask for one — and splitting them would put our bookkeeping into their contract.
+         *
+         *     **Assembly starts by itself when the acquisition settles** with at least one work delivered, so a client polls the acquisition until `settled` and then polls this until `ready` — there is nothing to ask for in between. `POST` is for a corpus that has expired or failed. An acquisition that delivered nothing has nothing to render and reads `rebuild_required`.
          */
         CorpusResponse: {
             /**
-             * @description `ready` is downloadable now. `assembling` means a run is in flight and `pending` that one is queued — poll either. `rebuild_required` means ask for it again, with `POST /v1/acquisitions/{id}/corpus`. `failed` carries a reason.
+             * @description `ready` is downloadable now. `assembling` means a run is in flight and `pending` that one is queued — poll either. `rebuild_required` means ask for it again, with `POST /v1/acquisitions/{id}/corpus`, and is also what a run abandoned mid-assembly (a worker that died) reads as once it has gone two hours without progress. `failed` carries a reason; a POST retries one that failed transiently, and leaves one that failed because our records disagree with the signed manifest as it is.
              * @enum {string}
              */
             state: 'pending' | 'assembling' | 'ready' | 'rebuild_required' | 'failed';
@@ -2195,6 +3158,8 @@ declare interface components {
             expires_at?: string | null;
             /** @description Why assembly broke. Present only when `state` is `failed`. */
             failure_reason?: string | null;
+            /** @description Seconds to wait before polling again, also sent as `Retry-After`. Present only while `state` is `pending` or `assembling`; `ready`, `failed` and `rebuild_required` carry neither, since nothing changes until the Buyer acts. Grows with the number of works the corpus renders, from 2 seconds to at most 60. */
+            poll_after_seconds?: number;
             /**
              * @description Where to fetch the archive, relative to this API, and null in every state but `ready`.
              *
@@ -2391,7 +3356,10 @@ declare interface components {
     responses: never;
     parameters: never;
     requestBodies: never;
-    headers: never;
+    headers: {
+        /** @description Seconds to wait before polling again, sent only while a bulk step is still in progress — a quote being priced, a run in flight, a corpus queued or assembling — and equal to the body's `poll_after_seconds`. Absent once there is nothing left to wait for. Sized from the selection: at least 2 and at most 60. */
+        PollRetryAfter: number;
+    };
     pathItems: never;
 }
 
@@ -2423,6 +3391,19 @@ export declare type DailySpendCapReachedErrorBody = components['schemas']['Daily
  * - `insufficient_funds` — cleared by funding the wallet.
  * - `daily_spend_cap_reached` — deliberately **not** cleared by funding the wallet; see
  *   {@link SpendCapReachedError}.
+ *
+ * On the bulk acquisition steps:
+ *
+ * - `exclusions_unacknowledged` — call `acquisitions.acknowledgeExclusions()` first.
+ * - `quote_not_ready` — keep polling a `pending` quote, or re-quote a `failed` one
+ *   (`quote_state` says which).
+ * - `quote_expired` — re-quote.
+ * - `quote_in_progress` — wait for the re-quote already running.
+ * - `invalid_acquisition_state` — re-read the acquisition; `status` and
+ *   `expected_status` arrive in `LedewireError.details`.
+ * - `nothing_to_hold` — every work was excluded; a different Selection is needed.
+ * - `run_not_started` — the run could not be queued, so nothing was held and the same
+ *   authorization is safe to retry.
  */
 export declare type ErrorType = NonNullable<components['schemas']['ErrorResponse']['error']['type']>;
 
@@ -3063,6 +4044,8 @@ declare class UserApiKeysNamespace {
      *
      * @param body - Name and optional spend ceiling for the new key.
      * @returns The new key's public identifier and one-time secret.
+     * @throws {ForbiddenError} When the caller is a Machine user, whose keys its
+     *   Company's admins manage through `company.machineUsers.buyerKeys`.
      *
      * @example
      * ```ts
@@ -3082,6 +4065,7 @@ declare class UserApiKeysNamespace {
      * token refresh. Revocation takes effect immediately.
      *
      * @param id - UUID of the API key to revoke.
+     * @throws {ForbiddenError} When the caller is a Machine user.
      */
     revoke(id: string): Promise<void>;
 }
@@ -3141,6 +4125,12 @@ declare class UserMcpKeysNamespace {
      *
      * @param body - Label and scopes for the new key.
      * @returns The new key's public identifier, scopes, and one-time secret.
+     * @throws {ForbiddenError} When a seller-tier scope or `store_id` names a store
+     *   the user is not an owner or author of (plain store members cannot hold a
+     *   store-scoped key), or when the caller is a Machine user, whose keys its
+     *   Company's admins manage through `company.machineUsers.mcpKeys`. Seller-tier
+     *   scopes are re-checked on every use, so a key stops working if its holder
+     *   loses the role.
      *
      * @example
      * ```ts
@@ -3159,6 +4149,7 @@ declare class UserMcpKeysNamespace {
      * desired scopes — scopes cannot be edited in place.
      *
      * @param id - UUID of the MCP API key to revoke.
+     * @throws {ForbiddenError} When the caller is a Machine user.
      */
     revoke(id: string): Promise<void>;
 }
@@ -3241,6 +4232,12 @@ declare class UserSpendCapNamespace {
      * Returns the authenticated buyer's spend cap, read against the current spend
      * window.
      *
+     * For a buyer with an open Company membership this is the membership's cap —
+     * read in the Company's timezone, counting only spend paid through the
+     * membership, never uncapped, and always binding bulk acquisitions
+     * (`bulk_exempt: false`). `company_name` names the Company; it is `null` for
+     * anyone else.
+     *
      * @returns The current spend cap, spend-to-date, and reset time.
      */
     get(): Promise<UserSpendCap>;
@@ -3254,6 +4251,9 @@ declare class UserSpendCapNamespace {
      *
      * @param body - The new cap in whole cents, or `null` to remove it.
      * @returns The updated spend cap.
+     * @throws {ForbiddenError} When the buyer holds an open Company membership. A
+     *   member's cap — an admin's own included — is set by a Company admin through
+     *   `company.members.update()`.
      */
     update(body: UserSpendCapUpdateRequest): Promise<UserSpendCap>;
 }
@@ -3268,8 +4268,13 @@ export declare type UserSpendCapUpdateRequest = components['schemas']['UserSpend
 /** Current wallet balance for the authenticated buyer. */
 export declare type WalletBalanceResponse = components['schemas']['WalletBalanceResponse'];
 
-/** Request body for creating a wallet payment session. */
-export declare type WalletPaymentSessionRequest = components['schemas']['WalletPaymentSessionRequest'];
+/**
+ * Request body for creating a wallet payment session (personal or Company).
+ * `currency` is optional; the server defaults it to `'usd'`.
+ */
+export declare type WalletPaymentSessionRequest = Omit<components['schemas']['WalletPaymentSessionRequest'], 'currency'> & {
+    currency?: string;
+};
 
 /** Response from creating a wallet payment session. */
 export declare type WalletPaymentSessionResponse = components['schemas']['WalletPaymentSessionResponse'];