@productcraft/trawl 0.1.0 → 0.1.2

package/dist/index.d.ts

@@ -6,6 +6,23 @@ import { makeClient, PCClientConfig } from '@productcraft/core';
  */
 
 interface paths {
+    "/v1/workspaces/{workspace_id}/credits": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Remaining Trawl steps for this workspace, whether the balance is low, and recent ledger entries */
+        get: operations["CreditsController_get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/jobs": {
         parameters: {
             query?: never;
@@ -58,6 +75,30 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Trawl stats for a workspace
+         * @description Total jobs, jobs created / succeeded / failed and steps used in the window, the credit balance, when the latest job was created and a daily jobs series.
+         *
+         *     **Active** means a job was created.
+         *
+         *     Days are UTC. Counts only: no target URLs, descriptions or job results. Cached for up to 60 seconds (`generated_at`).
+         */
+        get: operations["WorkspaceStatsController_get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/webhooks": {
         parameters: {
             query?: never;
@@ -65,10 +106,18 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** List webhooks for the workspace (secrets masked) */
+        /**
+         * List webhooks for the workspace (paginated, newest first, secrets masked)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         get: operations["WebhookController_list"];
         put?: never;
-        /** Create a workspace webhook. The response includes the signing secret in clear EXACTLY ONCE — copy it now. */
+        /**
+         * Create a workspace webhook. The response includes the signing secret in clear EXACTLY ONCE — copy it now.
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         post: operations["WebhookController_create"];
         delete?: never;
         options?: never;
@@ -76,6 +125,172 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List webhook endpoints, oldest first.
+         * @description At most 10, so this is always one page. Signing secrets are never returned here, only their last 4 characters.
+         */
+        get: operations["WebhooksController_trawl_workspace_listEndpoints"];
+        put?: never;
+        /**
+         * Add a webhook endpoint. Returns its signing secret once.
+         * @description Deliveries are signed with the Standard Webhooks headers `webhook-id`, `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of "<id>.<timestamp>.<body>">`); the returned `whsec_…` secret works unchanged with any Standard Webhooks library. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h.
+         */
+        post: operations["WebhooksController_trawl_workspace_createEndpoint"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints/{endpoint_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get one webhook endpoint (without its secret). */
+        get: operations["WebhooksController_trawl_workspace_getEndpoint"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete a webhook endpoint.
+         * @description Queued retries are dropped. Its past attempts stay in the event log until the events expire.
+         */
+        delete: operations["WebhooksController_trawl_workspace_deleteEndpoint"];
+        options?: never;
+        head?: never;
+        /**
+         * Change a webhook endpoint: URL, description, events, on/off.
+         * @description Only the fields sent change. `enabled: true` (or a new URL) also clears an automatic disable. Switching off cancels queued retries. The secret is unchanged; rotate it with `POST …/rotate-secret`.
+         */
+        patch: operations["WebhooksController_trawl_workspace_updateEndpoint"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints/{endpoint_id}/rotate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate the signing secret. The new one is returned once.
+         * @description For `grace_hours` (default 24) the previous secret keeps signing too: `webhook-signature` then lists one `v1,` signature per secret, so receivers can switch over without dropping a delivery.
+         */
+        post: operations["WebhooksController_trawl_workspace_rotateSecret"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints/{endpoint_id}/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a test event to this endpoint now and return the result.
+         * @description Delivers the catalogue example of `event_type`, signed like any delivery, with `"test": true` in the body. Works while the endpoint is switched off or not subscribed to that type, is logged in the event log, and is never retried or counted toward an automatic disable. Waits up to 15 s for your receiver.
+         */
+        post: operations["WebhooksController_trawl_workspace_sendTest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/event-types": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the events an endpoint can subscribe to.
+         * @description Each type with a plain description, its group and an example `data` object (what "Send test" delivers).
+         */
+        get: operations["WebhooksController_trawl_workspace_listEventTypes"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List webhook events, newest first (kept for 30 days).
+         * @description Every event logged while at least one endpoint existed, with the latest state per endpoint and when the next retry is due.
+         */
+        get: operations["WebhooksController_trawl_workspace_listEvents"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/events/{event_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get one webhook event with every delivery attempt. */
+        get: operations["WebhooksController_trawl_workspace_getEvent"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/events/{event_id}/replay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a logged event again, to its endpoints or to one endpoint.
+         * @description Same body and `webhook-id`, freshly signed, to every switched-on endpoint that receives this event type now, or only to `endpoint_id`. Waits for the receivers (up to 15 s each) and returns the attempts. A success cancels a retry still queued for that endpoint.
+         */
+        post: operations["WebhooksController_trawl_workspace_replay"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/webhooks/{id}": {
         parameters: {
             query?: never;
@@ -83,15 +298,27 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Get a webhook (secret masked) */
+        /**
+         * Get a webhook (secret masked)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         get: operations["WebhookController_get"];
         put?: never;
         post?: never;
-        /** Delete a webhook */
+        /**
+         * Delete a webhook
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         delete: operations["WebhookController_remove"];
         options?: never;
         head?: never;
-        /** Update url / active flag (active=true clears auto-disable) */
+        /**
+         * Update url / active flag (active=true clears auto-disable)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         patch: operations["WebhookController_update"];
         trace?: never;
     };
@@ -102,7 +329,11 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Recent delivery attempts for a webhook (default 50, max 200, newest first) */
+        /**
+         * Delivery attempts for a webhook (paginated, default 50, max 200, newest first)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         get: operations["WebhookController_recentDeliveries"];
         put?: never;
         post?: never;
@@ -121,7 +352,11 @@ interface paths {
         };
         get?: never;
         put?: never;
-        /** Rotate the signing secret. Returns the new secret in clear EXACTLY ONCE. */
+        /**
+         * Rotate the signing secret. Returns the new secret in clear EXACTLY ONCE; the old one stops at once.
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         post: operations["WebhookController_rotateSecret"];
         delete?: never;
         options?: never;
@@ -138,7 +373,11 @@ interface paths {
         };
         get?: never;
         put?: never;
-        /** Fire a synthetic event to this webhook (asynchronous; check the destination logs) */
+        /**
+         * Send the `job.succeeded` example to this webhook; the attempt shows in `/deliveries`
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event filter, event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         post: operations["WebhookController_fireTest"];
         delete?: never;
         options?: never;
@@ -170,15 +409,21 @@ interface components {
              *     }
              */
             json_schema: Record<string, never>;
-            /** @description Maximum number of worker steps before the job stops. */
-            max_steps?: number;
+            /**
+             * @description Maximum number of agent steps (one LLM call each) before the job stops. Defaults to 20. Multi-source extractions typically need 40+. The server additionally clamps this to an operator ceiling, so a very large value does not guarantee a very long run — `timeout_s` still applies.
+             * @default 20
+             */
+            max_steps: number;
             /** @description Model tier the worker should use (e.g. `standard`, `pro`). */
             model_tier?: string;
             /** @description Seed URLs the worker should start from. */
             suggested_urls?: string[];
             /** @description Wall-clock timeout for the job, in seconds. */
             timeout_s?: number;
-            /** @description Webhook id to notify when the job finishes. */
+            /**
+             * Format: uuid
+             * @description A webhook endpoint of this workspace to notify when the job finishes. Endpoints made before 17 Oct 2026 receive only the jobs that name them here; endpoints made under `/webhooks/endpoints` receive every job event they subscribe to, so leave this out for them.
+             */
             webhook_id?: string;
         };
         CreateWebhookDto: {
@@ -187,6 +432,86 @@ interface components {
             /** @description Destination URL (https required in prod). */
             url: string;
         };
+        CreateWebhookEndpointDto: {
+            /** @example Production receiver */
+            description?: string | null;
+            /**
+             * @description Create it switched off.
+             * @default true
+             */
+            enabled: boolean;
+            /**
+             * @description Event types from `GET …/webhooks/event-types`. Empty or omitted means every event, including types added later.
+             * @example [
+             *       "job.succeeded",
+             *       "job.failed"
+             *     ]
+             */
+            event_types?: ("job.succeeded" | "job.failed" | "credits.low")[];
+            /**
+             * Format: uri
+             * @description Where to send events: an absolute https:// URL on a public host.
+             * @example https://api.acme.com/webhooks
+             */
+            url: string;
+        };
+        CreditLedgerEntryDto: {
+            /** Format: date-time */
+            created_at: string;
+            /**
+             * @description Steps added (positive: allowance, top-up, grant) or used (negative: a job).
+             * @example -12
+             */
+            delta_steps: number;
+            /** Format: uuid */
+            id: string;
+            /**
+             * Format: uuid
+             * @description The job, for a `job` entry.
+             */
+            job_id: string | null;
+            /**
+             * @description Why: `initial_free_allowance`, `grant`, `job`, …
+             * @example job
+             */
+            reason: string;
+        };
+        CreditsResponseDto: {
+            /**
+             * @description Remaining steps. One agent step uses one credit; new jobs are refused (402) at zero. Can dip slightly below zero, because a running job is always allowed to finish.
+             * @example 8420
+             */
+            balance_steps: number;
+            /** @description Recent ledger entries, newest first. */
+            entries: components["schemas"]["CreditLedgerEntryDto"][];
+            /**
+             * @description True when the balance is under `low_balance_threshold_steps`. The `credits.low` webhook fires once when this turns true, and again only after the next top-up.
+             * @example false
+             */
+            low_balance: boolean;
+            /**
+             * @description The low-balance line: 10% of the last top-up, and never under 100 steps.
+             * @example 1000
+             */
+            low_balance_threshold_steps: number;
+        };
+        ErrorResponseDto: {
+            /**
+             * @description Stable, machine-readable error code; branch on this, not on `message`. Always present. A route-specific code when the route defines one (e.g. `WEBHOOK_ENDPOINT_NOT_FOUND`, `SERVICE_NOT_ENABLED`), otherwise the generic code for the status: `BAD_REQUEST`, `VALIDATION_ERROR` (400 from request validation), `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `CONFLICT`, `PAYLOAD_TOO_LARGE`, `UNPROCESSABLE_ENTITY`, `RATE_LIMITED`, `INTERNAL_SERVER_ERROR`, `SERVICE_UNAVAILABLE`.
+             * @example SERVICE_NOT_ENABLED
+             */
+            code: string;
+            /**
+             * @description Human-readable error message. May be a class-validator array on 400.
+             * @example Policy denies trawl.read on pcft:workspace/7a0c2f7e-2b8d-4f7f-9a51-3f1f0e1f3c11
+             */
+            message: string | string[];
+            /**
+             * @description HTTP status code echoed in the body. Spelled `statusCode` (camelCase) in every ProductCraft API.
+             * @example 403
+             */
+            statusCode: number;
+        };
         JobListPaginationDto: {
             has_more: boolean;
             next_cursor: string | null;
@@ -215,49 +540,551 @@ interface components {
             webhook_id: string | null;
             workspace_id: string;
         };
+        ListWebhookEndpointsResponseDto: {
+            data: components["schemas"]["WebhookEndpointDto"][];
+            /** @description Always one page (an endpoint limit applies). */
+            pagination: components["schemas"]["WebhookPaginationDto"];
+        };
+        ListWebhookEventTypesResponseDto: {
+            data: components["schemas"]["WebhookEventTypeDto"][];
+        };
+        ListWebhookEventsResponseDto: {
+            data: components["schemas"]["WebhookEventDto"][];
+            pagination: components["schemas"]["WebhookPaginationDto"];
+        };
+        ReplayWebhookEventResponseDto: {
+            /** @description One attempt per endpoint it was sent to. */
+            attempts: components["schemas"]["WebhookDeliveryAttemptDto"][];
+            event_id: string;
+        };
+        RotateWebhookSecretDto: {
+            /**
+             * @description Hours the previous secret keeps signing too (0 ends it now).
+             * @default 24
+             */
+            grace_hours: number;
+        };
+        SendWebhookTestDto: {
+            /**
+             * @description Which event to send; its catalogue example is the `data`.
+             * @example job.succeeded
+             * @enum {string}
+             */
+            event_type: "job.succeeded" | "job.failed" | "credits.low";
+        };
+        TrawlStatsInWindowDto: {
+            /**
+             * @description Of those, jobs that failed.
+             * @example 3
+             */
+            failed: number;
+            /**
+             * @description Jobs created in the window, in any status.
+             * @example 37
+             */
+            jobs: number;
+            /**
+             * @description Steps consumed by the jobs created in the window. Jobs still running, and jobs from before metering, add nothing.
+             * @example 512
+             */
+            steps_used: number;
+            /**
+             * @description Of those, jobs that succeeded.
+             * @example 33
+             */
+            succeeded: number;
+        };
+        TrawlStatsSeriesDto: {
+            /**
+             * @description Bucket width.
+             * @example day
+             * @enum {string}
+             */
+            granularity: "day";
+            /**
+             * @description Jobs created per UTC day in the workspace, in any status.
+             * @example jobs
+             * @enum {string}
+             */
+            metric: "jobs";
+            /** @description Dense and zero-filled: one point per UTC day in the window, oldest first, ending today. */
+            points: components["schemas"]["TrawlStatsSeriesPointDto"][];
+        };
+        TrawlStatsSeriesPointDto: {
+            /**
+             * Format: date
+             * @description UTC calendar day.
+             * @example 2026-10-07
+             */
+            date: string;
+            /**
+             * @description Value for that day.
+             * @example 4
+             */
+            value: number;
+        };
+        TrawlStatsTotalsDto: {
+            /**
+             * @description Remaining Trawl steps: the sum of the credit ledger, the same number `GET /v1/workspaces/{workspaceId}/credits` returns. Zero before the first job; can be slightly negative after the last job of a budget.
+             * @example 8650
+             */
+            balance_steps: number;
+            /**
+             * @description Jobs in the workspace, all time, in any status.
+             * @example 418
+             */
+            jobs: number;
+        };
+        TrawlWorkspaceStatsDto: {
+            /**
+             * Format: date-time
+             * @description When these numbers were computed. Responses are cached for up to 60 seconds.
+             * @example 2026-10-07T09:00:00.000Z
+             */
+            generated_at: string;
+            /** @description Counts for the window. */
+            in_window: components["schemas"]["TrawlStatsInWindowDto"];
+            /**
+             * Format: date-time
+             * @description When the workspace's most recent job was created. Null when there has never been one.
+             * @example 2026-10-07T08:41:12.000Z
+             */
+            last_activity_at: string | null;
+            /** @description Daily jobs. */
+            series: components["schemas"]["TrawlStatsSeriesDto"];
+            /** @description All-time counts and the credit balance. */
+            totals: components["schemas"]["TrawlStatsTotalsDto"];
+            /**
+             * @description Window the counts cover.
+             * @example 30d
+             * @enum {string}
+             */
+            window: "1d" | "7d" | "30d";
+        };
         UpdateWebhookDto: {
             /** @description Pause/resume the webhook. Setting active=true clears auto-disable. */
             active?: boolean;
             /** @description New destination URL. */
             url?: string;
         };
+        UpdateWebhookEndpointDto: {
+            description?: string | null;
+            /** @description Switch it on or off. Switching on also clears an automatic disable. */
+            enabled?: boolean;
+            /** @description Replaces the subscription. Event types from `GET …/webhooks/event-types`. Empty or omitted means every event, including types added later. */
+            event_types?: ("job.succeeded" | "job.failed" | "credits.low")[];
+            /**
+             * Format: uri
+             * @example https://api.acme.com/webhooks
+             */
+            url?: string;
+        };
         WebhookCreateResponseDto: {
+            /** @description Whether it receives events (`enabled` on the new routes). */
             active: boolean;
+            /**
+             * Format: date-time
+             * @description Set when it was switched off automatically after sustained failures.
+             */
             auto_disabled_at: string | null;
+            /** Format: date-time */
             created_at: string;
+            /** @description Failed deliveries in a row (`consecutive_failures` on the new routes). */
             failure_count: number;
+            /** Format: date-time */
             first_failure_at: string | null;
+            /** Format: uuid */
             id: string;
+            /**
+             * Format: date-time
+             * @description When the latest attempt was made.
+             */
             last_attempt_at: string | null;
+            /** @description HTTP status of the latest attempt. */
             last_status_code: number | null;
-            /** @description Plaintext signing secret returned EXACTLY ONCE on create + rotate. Persist immediately — it never appears on subsequent GETs. */
+            /** @description Always true: every webhook has a signing secret. */
+            secret_set?: boolean;
+            /** @description Plaintext signing secret (`whsec_…`), returned EXACTLY ONCE. Persist immediately; it does not appear on later reads. */
             signing_secret: string;
             url: string;
+            /** Format: uuid */
             workspace_id: string;
         };
-        WebhookListResponseDto: {
-            data: components["schemas"]["WebhookResponseDto"][];
+        WebhookDeliveryAttemptDto: {
+            /** @description 1 for the first delivery; retries and replays count up. */
+            attempt_number: number;
+            /** Format: date-time */
+            attempted_at: string;
+            /** Format: uuid */
+            endpoint_id: string;
+            /** @example request timed out */
+            error_message: string | null;
+            /** @example evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f */
+            event_id: string;
+            /** @example user.created */
+            event_type: string;
+            /** Format: uuid */
+            id: string;
+            latency_ms: number | null;
+            /** @description The first 1 KiB of the response body. */
+            response_body: string | null;
+            /** @description HTTP status; null when no response came back. */
+            status_code: number | null;
+            /** @description True for a 2xx response. */
+            succeeded: boolean;
+            /**
+             * @description `automatic` (first delivery or a retry), `replay` or `test`.
+             * @enum {string}
+             */
+            trigger: "automatic" | "replay" | "test";
+            /**
+             * Format: uri
+             * @description Where it was sent.
+             */
+            url: string;
         };
-        WebhookResponseDto: {
-            active: boolean;
-            auto_disabled_at: string | null;
+        WebhookDeliveryListResponseDto: {
+            data: components["schemas"]["WebhookDeliveryResponseDto"][];
+            pagination: components["schemas"]["WebhookListPaginationDto"];
+        };
+        WebhookDeliveryResponseDto: {
+            /** @description Which attempt this was for the event: 1 for the first delivery, then 2 to 7 for the automatic retries (1m, 5m, 30m, 2h, 6h and 24h after each failure). Retries keep the same `event_id`. A test or a replay is numbered in the same sequence. */
+            attempt_number: number;
+            /** Format: date-time */
+            attempted_at: string;
+            error_message: string | null;
+            /** @description Id of the event (`evt_…`), the same across retries. */
+            event_id: string;
+            /** @example job.succeeded */
+            event_type: string;
+            /** Format: uuid */
+            id: string;
+            /** @description The job the event was about; null for an event that is not about a job (`credits.low`). */
+            job_id: string | null;
+            latency_ms: number | null;
+            response_body_truncated: string | null;
+            /** @description HTTP status returned by the destination; null when no response was received. */
+            status_code: number | null;
+            /** Format: uuid */
+            webhook_id: string;
+        };
+        WebhookEndpointDto: {
+            /** @description Failed automatic deliveries in a row; a success resets it. */
+            consecutive_failures: number;
+            /** Format: date-time */
             created_at: string;
-            failure_count: number;
+            /** @example Production receiver */
+            description: string | null;
+            /** Format: date-time */
+            disabled_at: string | null;
+            /** @enum {string|null} */
+            disabled_reason: "manual" | "failing" | null;
+            /** @description The on/off switch (`PATCH … { enabled }`). */
+            enabled: boolean;
+            /**
+             * @description Subscribed event types. Empty means every event, including types added later.
+             * @example []
+             */
+            event_types: string[];
+            /**
+             * Format: date-time
+             * @description Start of the current failure streak.
+             */
             first_failure_at: string | null;
+            /** Format: uuid */
             id: string;
-            last_attempt_at: string | null;
-            last_status_code: number | null;
+            /** @description True for endpoints carried over from the product's previous webhook system: they also receive the old signature header until its sunset date. */
+            legacy_signature: boolean;
+            /** @description True while the previous secret still signs too (after a rotation, for its grace period). */
+            prev_signing_secret_active: boolean;
+            /**
+             * Format: date-time
+             * @description Until then the previous secret signs too (after a rotation).
+             */
+            prev_signing_secret_expires_at: string | null;
+            /** @description Id of the owning workspace, app or community. */
+            scope_id: string;
+            /**
+             * @description What owns the endpoint: `workspace`, `app` or `community`.
+             * @example workspace
+             */
+            scope_type: string;
+            /**
+             * @description Last 4 characters of the signing secret.
+             * @example x9Q=
+             */
+            signing_secret_hint: string;
+            /**
+             * @description `enabled` receives events. `disabled` was switched off. `auto_disabled` was switched off after 20 failed deliveries in a row or 24 hours of failures; `PATCH { enabled: true }` turns it back on.
+             * @enum {string}
+             */
+            status: "enabled" | "disabled" | "auto_disabled";
+            /** Format: date-time */
+            updated_at: string;
+            /**
+             * Format: uri
+             * @example https://api.acme.com/webhooks
+             */
             url: string;
-            workspace_id: string;
         };
-    };
-    responses: never;
+        WebhookEndpointWithSecretDto: {
+            /** @description Failed automatic deliveries in a row; a success resets it. */
+            consecutive_failures: number;
+            /** Format: date-time */
+            created_at: string;
+            /** @example Production receiver */
+            description: string | null;
+            /** Format: date-time */
+            disabled_at: string | null;
+            /** @enum {string|null} */
+            disabled_reason: "manual" | "failing" | null;
+            /** @description The on/off switch (`PATCH … { enabled }`). */
+            enabled: boolean;
+            /**
+             * @description Subscribed event types. Empty means every event, including types added later.
+             * @example []
+             */
+            event_types: string[];
+            /**
+             * Format: date-time
+             * @description Start of the current failure streak.
+             */
+            first_failure_at: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @description True for endpoints carried over from the product's previous webhook system: they also receive the old signature header until its sunset date. */
+            legacy_signature: boolean;
+            /** @description True while the previous secret still signs too (after a rotation, for its grace period). */
+            prev_signing_secret_active: boolean;
+            /**
+             * Format: date-time
+             * @description Until then the previous secret signs too (after a rotation).
+             */
+            prev_signing_secret_expires_at: string | null;
+            /** @description Id of the owning workspace, app or community. */
+            scope_id: string;
+            /**
+             * @description What owns the endpoint: `workspace`, `app` or `community`.
+             * @example workspace
+             */
+            scope_type: string;
+            /**
+             * @description The signing secret, shown once: pass it unchanged to any Standard Webhooks verifier. Store it now; it cannot be shown again.
+             * @example whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw
+             */
+            signing_secret: string;
+            /**
+             * @description Last 4 characters of the signing secret.
+             * @example x9Q=
+             */
+            signing_secret_hint: string;
+            /**
+             * @description `enabled` receives events. `disabled` was switched off. `auto_disabled` was switched off after 20 failed deliveries in a row or 24 hours of failures; `PATCH { enabled: true }` turns it back on.
+             * @enum {string}
+             */
+            status: "enabled" | "disabled" | "auto_disabled";
+            /** Format: date-time */
+            updated_at: string;
+            /**
+             * Format: uri
+             * @example https://api.acme.com/webhooks
+             */
+            url: string;
+        };
+        WebhookEventDeliveryDto: {
+            /** @description Number of the latest attempt; retries and replays count up. */
+            attempt_number: number;
+            /** Format: date-time */
+            attempted_at: string;
+            /** Format: uuid */
+            endpoint_id: string;
+            /**
+             * Format: date-time
+             * @description When the next automatic attempt is due; null when none is queued.
+             */
+            next_attempt_at: string | null;
+            status_code: number | null;
+            /** @description True when the latest attempt got a 2xx. */
+            succeeded: boolean;
+        };
+        WebhookEventDetailDto: {
+            /** @description Every attempt, newest first. */
+            attempts: components["schemas"]["WebhookDeliveryAttemptDto"][];
+            /** Format: date-time */
+            created_at: string;
+            /** @description Latest attempt per endpoint (an endpoint whose first attempt is still queued is not listed yet). */
+            deliveries: components["schemas"]["WebhookEventDeliveryDto"][];
+            /**
+             * @description Sent as `webhook-id`; the same on every retry and replay.
+             * @example evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
+            id: string;
+            /** @description The JSON body exactly as sent. */
+            payload: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description `pending`: a delivery is queued. `failed`: the latest attempt to some endpoint failed and none is queued. `delivered`: every endpoint answered 2xx. `not_sent`: no endpoint subscribed.
+             * @enum {string}
+             */
+            status: "pending" | "delivered" | "failed" | "not_sent";
+            /** @description Made by "Send test". */
+            test: boolean;
+            /**
+             * @example job.succeeded
+             * @enum {string}
+             */
+            type: "job.succeeded" | "job.failed" | "credits.low";
+        };
+        WebhookEventDto: {
+            /** Format: date-time */
+            created_at: string;
+            /** @description Latest attempt per endpoint (an endpoint whose first attempt is still queued is not listed yet). */
+            deliveries: components["schemas"]["WebhookEventDeliveryDto"][];
+            /**
+             * @description Sent as `webhook-id`; the same on every retry and replay.
+             * @example evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
+            id: string;
+            /** @description The JSON body exactly as sent. */
+            payload: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description `pending`: a delivery is queued. `failed`: the latest attempt to some endpoint failed and none is queued. `delivered`: every endpoint answered 2xx. `not_sent`: no endpoint subscribed.
+             * @enum {string}
+             */
+            status: "pending" | "delivered" | "failed" | "not_sent";
+            /** @description Made by "Send test". */
+            test: boolean;
+            /**
+             * @example job.succeeded
+             * @enum {string}
+             */
+            type: "job.succeeded" | "job.failed" | "credits.low";
+        };
+        WebhookEventTypeDto: {
+            /**
+             * @description Group shown in the event picker.
+             * @example Users
+             */
+            category: string;
+            /** @example A user signed up or was created by an admin. */
+            description: string;
+            /** @description An example `data` object; "Send test" delivers exactly this. */
+            example: {
+                [key: string]: unknown;
+            };
+            /**
+             * @example job.succeeded
+             * @enum {string}
+             */
+            type: "job.succeeded" | "job.failed" | "credits.low";
+        };
+        WebhookListPaginationDto: {
+            has_more: boolean;
+            next_cursor: string | null;
+        };
+        WebhookListResponseDto: {
+            data: components["schemas"]["WebhookResponseDto"][];
+            pagination: components["schemas"]["WebhookListPaginationDto"];
+        };
+        WebhookPaginationDto: {
+            /** @description Whether another page follows. */
+            has_more: boolean;
+            /** @description Pass as `cursor` to get the next page; null on the last page. */
+            next_cursor: string | null;
+        };
+        WebhookResponseDto: {
+            /** @description Whether it receives events (`enabled` on the new routes). */
+            active: boolean;
+            /**
+             * Format: date-time
+             * @description Set when it was switched off automatically after sustained failures.
+             */
+            auto_disabled_at: string | null;
+            /** Format: date-time */
+            created_at: string;
+            /** @description Failed deliveries in a row (`consecutive_failures` on the new routes). */
+            failure_count: number;
+            /** Format: date-time */
+            first_failure_at: string | null;
+            /** Format: uuid */
+            id: string;
+            /**
+             * Format: date-time
+             * @description When the latest attempt was made.
+             */
+            last_attempt_at: string | null;
+            /** @description HTTP status of the latest attempt. */
+            last_status_code: number | null;
+            /** @description Always true: every webhook has a signing secret. */
+            secret_set?: boolean;
+            url: string;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        WebhookRotateSecretResponseDto: {
+            /** Format: uuid */
+            id: string;
+            /** @description New plaintext signing secret, returned EXACTLY ONCE. Persist immediately; the old secret stops working at once. */
+            secret: string;
+        };
+        WebhookTestAcceptedDto: {
+            /** @example true */
+            accepted: boolean;
+        };
+    };
+    responses: never;
     parameters: never;
     requestBodies: never;
     headers: never;
     pathItems: never;
 }
 interface operations {
+    CreditsController_get: {
+        parameters: {
+            query?: {
+                /** @description How many recent entries to return. Defaults to 50, capped at 200. */
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Balance, low-balance state and recent entries. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CreditsResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.read`, or the service is not enabled. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
     JobController_list: {
         parameters: {
             query?: {
@@ -281,134 +1108,861 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["JobListResponseDto"];
+                    "application/json": components["schemas"]["JobListResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.list`, or workspace has not enabled the `trawl` service. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    JobController_create: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Pass a key (1..256 chars, [A-Za-z0-9_\-:]) to make retries safe — replays return the original response for 24h. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateJobDto"];
+            };
+        };
+        responses: {
+            /** @description Job created and queued. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["JobResponseDto"];
+                };
+            };
+            /** @description Invalid JSON Schema (must be a non-empty `type: object`). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.create`, or workspace has not enabled the `trawl` service. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Rate limited. `RATE_LIMITED` — submission window exceeded (default 10/min per workspace); the `Retry-After` header gives the seconds until the window resets. `TOO_MANY_ACTIVE_JOBS` — too many queued/running jobs (default 25); retry once some finish. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    JobController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Job row. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["JobResponseDto"];
+                };
+            };
+            /** @description Job not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    JobController_cancel: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Job cancelled. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["JobResponseDto"];
+                };
+            };
+            /** @description Job not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Job is already in a terminal state and cannot be cancelled. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WorkspaceStatsController_get: {
+        parameters: {
+            query?: {
+                /** @description Window for `in_window` and the length of `series`, in UTC days ending today. */
+                window?: "1d" | "7d" | "30d";
+            };
+            header?: never;
+            path: {
+                /** @description Workspace id. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Trawl stats. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TrawlWorkspaceStatsDto"];
+                };
+            };
+            /** @description `window` is not one of 1d, 7d, 30d. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.read` on the workspace, or Trawl is not enabled on it (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Workspace not found: the id is unknown, is not a UUID, or is not visible to the caller. Same answer as the service's other workspace routes. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhookController_list: {
+        parameters: {
+            query?: {
+                /** @description Opaque cursor from the previous response's `pagination.next_cursor`. */
+                cursor?: string;
+                /** @description Page size. Defaults to 20, capped at 100. */
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Page of webhooks with a pagination cursor. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookListResponseDto"];
+                };
+            };
+            /** @description Invalid cursor or limit. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhookController_create: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Stripe-style idempotency key. The signing secret is returned exactly once; a retry without this header creates a second webhook + secret. 24h TTL. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWebhookDto"];
+            };
+        };
+        responses: {
+            /** @description Webhook created. Includes plaintext `signing_secret` exactly once. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookCreateResponseDto"];
+                };
+            };
+            /** @description Invalid URL (must be public HTTPS). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The workspace already has 10 webhooks. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_trawl_workspace_listEndpoints: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListWebhookEndpointsResponseDto"];
+                };
+            };
+            /** @description The scope id in the path is malformed. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_trawl_workspace_createEndpoint: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWebhookEndpointDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointWithSecretDto"];
+                };
+            };
+            /** @description Validation failure: URL not https with a public host, or an unknown event type (`WEBHOOK_EVENT_TYPE_UNKNOWN`). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Already 10 endpoints (`WEBHOOK_ENDPOINT_LIMIT`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The URL points at a private, loopback or internal address. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_trawl_workspace_getEndpoint: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointDto"];
+                };
+            };
+            /** @description `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_trawl_workspace_deleteEndpoint: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_trawl_workspace_updateEndpoint: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateWebhookEndpointDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointDto"];
+                };
+            };
+            /** @description Validation failure, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The new URL points at a private, loopback or internal address. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_trawl_workspace_rotateSecret: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RotateWebhookSecretDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointWithSecretDto"];
+                };
+            };
+            /** @description `grace_hours` out of range, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller lacks `trawl.list`, or workspace has not enabled the `trawl` service. */
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    JobController_create: {
+    WebhooksController_trawl_workspace_sendTest: {
         parameters: {
             query?: never;
             header?: {
-                /** @description Pass a key (1..256 chars, [A-Za-z0-9_\-:]) to make retries safe — replays return the original response for 24h. */
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
                 "Idempotency-Key"?: string;
             };
             path: {
                 workspace_id: string;
+                endpoint_id: string;
             };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateJobDto"];
+                "application/json": components["schemas"]["SendWebhookTestDto"];
             };
         };
         responses: {
-            /** @description Job created and queued. */
-            201: {
+            /** @description The attempt, successful or not. */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["JobResponseDto"];
+                    "application/json": components["schemas"]["WebhookDeliveryAttemptDto"];
                 };
             };
-            /** @description Invalid JSON Schema (must be a non-empty `type: object`). */
+            /** @description Unknown `event_type`, or `endpoint_id` is not a UUID. */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            /** @description Caller lacks `trawl.create`, or workspace has not enabled the `trawl` service. */
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    JobController_get: {
+    WebhooksController_trawl_workspace_listEventTypes: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspace_id: string;
-                id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Job row. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["JobResponseDto"];
+                    "application/json": components["schemas"]["ListWebhookEventTypesResponseDto"];
                 };
             };
-            /** @description Job not found in this workspace. */
-            404: {
+            /** @description Missing or invalid bearer token. */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    JobController_cancel: {
+    WebhooksController_trawl_workspace_listEvents: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Only these types. Repeat the parameter or comma-separate. */
+                type?: ("job.succeeded" | "job.failed" | "credits.low")[];
+                /** @description Only events sent (or queued) to this endpoint. */
+                endpoint_id?: string;
+                status?: "pending" | "delivered" | "failed" | "not_sent";
+                /** @description Only events created at or after this instant. */
+                created_after?: string;
+                /** @description Only events created before this instant. */
+                created_before?: string;
+                limit?: number;
+                /** @description The previous page's `pagination.next_cursor`. */
+                cursor?: string;
+            };
             header?: never;
             path: {
                 workspace_id: string;
-                id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Job cancelled. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["JobResponseDto"];
+                    "application/json": components["schemas"]["ListWebhookEventsResponseDto"];
                 };
             };
-            /** @description Job not found in this workspace. */
-            404: {
+            /** @description Invalid filter value or cursor. */
+            400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            /** @description Job is already in a terminal state and cannot be cancelled. */
-            422: {
+            /** @description Missing or invalid bearer token. */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    WebhookController_list: {
+    WebhooksController_trawl_workspace_getEvent: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspace_id: string;
+                /** @description The event id, `evt_<uuid>`. */
+                event_id: string;
             };
             cookie?: never;
         };
@@ -419,36 +1973,117 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookListResponseDto"];
+                    "application/json": components["schemas"]["WebhookEventDetailDto"];
+                };
+            };
+            /** @description `event_id` is not `evt_<uuid>`. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
         };
     };
-    WebhookController_create: {
+    WebhooksController_trawl_workspace_replay: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Send to this endpoint only. */
+                endpoint_id?: string;
+            };
             header?: {
-                /** @description Stripe-style idempotency key. The signing secret is returned exactly once; a retry without this header creates a second webhook + secret. 24h TTL. */
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
                 "Idempotency-Key"?: string;
             };
             path: {
                 workspace_id: string;
+                /** @description The event id, `evt_<uuid>`. */
+                event_id: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateWebhookDto"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Webhook created. Includes plaintext `signing_secret` exactly once. */
-            201: {
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookCreateResponseDto"];
+                    "application/json": components["schemas"]["ReplayWebhookEventResponseDto"];
+                };
+            };
+            /** @description `event_id` is not `evt_<uuid>`, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `trawl.webhook.read` (reads) or `trawl.webhook.manage` (changes, Send test, replay), or Trawl is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days. Or No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description `endpoint_id` is switched off or does not receive this event type (`WEBHOOK_ENDPOINT_NOT_SUBSCRIBED`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
         };
@@ -465,6 +2100,7 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Webhook. */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -473,12 +2109,23 @@ interface operations {
                     "application/json": components["schemas"]["WebhookResponseDto"];
                 };
             };
+            /** @description `id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
             /** @description Webhook not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -494,12 +2141,22 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Deleted. */
             204: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WebhookController_update: {
@@ -518,6 +2175,7 @@ interface operations {
             };
         };
         responses: {
+            /** @description Updated webhook (secret masked). */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -526,11 +2184,36 @@ interface operations {
                     "application/json": components["schemas"]["WebhookResponseDto"];
                 };
             };
+            /** @description Invalid URL. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WebhookController_recentDeliveries: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Filter by outcome. `succeeded` = 2xx response; `failed` = any non-2xx, including attempts where the destination never responded. */
+                status?: "succeeded" | "failed";
+                /** @description Opaque cursor from the previous response's `pagination.next_cursor`. */
+                cursor?: string;
+                /** @description Page size. Defaults to 50, capped at 200. */
+                limit?: number;
+            };
             header?: never;
             path: {
                 workspace_id: string;
@@ -540,12 +2223,32 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Recent delivery attempts. */
+            /** @description Page of delivery attempts with a pagination cursor. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookDeliveryListResponseDto"];
+                };
+            };
+            /** @description Invalid cursor, limit or `status` filter. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Webhook not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -561,11 +2264,23 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Secret rotated. Includes the new plaintext secret exactly once. */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookRotateSecretResponseDto"];
+                };
+            };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -581,11 +2296,32 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Sent. Read the outcome from `/deliveries`. */
             202: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookTestAcceptedDto"];
+                };
+            };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The webhook is switched off. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };