@serviceai/api-spec 1.2.418 → 1.2.420

package/types.d.ts

@@ -1065,7 +1065,7 @@ export interface paths {
                         "application/json": ({
                             [key: string]: unknown;
                         } & {
-                            /** @description RoomPlan-classified doors. Distinct from `windows[]` and `openings[]`; append-room `entryDoorwayId` tokens of the form `…-door-<idx>` resolve into THIS array only. */
+                            /** @description RoomPlan-classified doors. Distinct from `windows[]` and `openings[]`; append-room `entryDoorwayId` tokens of the form `…-door-<idx>` resolve into THIS array only. A door carrying `duplicateOf` is the hidden copy of a shared doorway (one door per doorway, from the room scanned first). */
                             doors?: {
                                 position: {
                                     x: number;
@@ -1079,6 +1079,13 @@ export interface paths {
                                 swingHand?: "left" | "right" | "none";
                                 /** @enum {string} */
                                 placementSource?: "auto" | "manual";
+                                /** @description Present only on the later-scanned room's copy of a doorway two rooms in this response share (the rooms are linked by a door link, or their doors coincide on one wall). Skip this door's glyph and keep its wall gap; the door it names is the one to draw. Absent on every other door. Read-time only: never send it back, it is never stored. */
+                                duplicateOf?: {
+                                    /** @description Id of the room whose copy of this doorway is drawn. */
+                                    roomId: number;
+                                    /** @description Index into that room's `doors[]`. */
+                                    doorIndex: number;
+                                };
                             }[];
                             /** @description RoomPlan-classified windows. Distinct from `doors[]` and `openings[]`; no append-room `entryDoorwayId` ever resolves into this array (windows are not traversable). */
                             windows?: {
@@ -1196,7 +1203,7 @@ export interface paths {
                             rooms: ({
                                 [key: string]: unknown;
                             } & {
-                                /** @description RoomPlan-classified doors. Distinct from `windows[]` and `openings[]`; append-room `entryDoorwayId` tokens of the form `…-door-<idx>` resolve into THIS array only. */
+                                /** @description RoomPlan-classified doors. Distinct from `windows[]` and `openings[]`; append-room `entryDoorwayId` tokens of the form `…-door-<idx>` resolve into THIS array only. A door carrying `duplicateOf` is the hidden copy of a shared doorway (one door per doorway, from the room scanned first). */
                                 doors?: {
                                     position: {
                                         x: number;
@@ -1210,6 +1217,13 @@ export interface paths {
                                     swingHand?: "left" | "right" | "none";
                                     /** @enum {string} */
                                     placementSource?: "auto" | "manual";
+                                    /** @description Present only on the later-scanned room's copy of a doorway two rooms in this response share (the rooms are linked by a door link, or their doors coincide on one wall). Skip this door's glyph and keep its wall gap; the door it names is the one to draw. Absent on every other door. Read-time only: never send it back, it is never stored. */
+                                    duplicateOf?: {
+                                        /** @description Id of the room whose copy of this doorway is drawn. */
+                                        roomId: number;
+                                        /** @description Index into that room's `doors[]`. */
+                                        doorIndex: number;
+                                    };
                                 }[];
                                 /** @description RoomPlan-classified windows. Distinct from `doors[]` and `openings[]`; no append-room `entryDoorwayId` ever resolves into this array (windows are not traversable). */
                                 windows?: {
@@ -1929,9 +1943,15 @@ export interface paths {
                         device?: "ios" | "web" | "android" | null;
                         /**
                          * Format: date-time
-                         * @description When the tap happened. The server clamps it.
+                         * @description When the tap happened, by the phone's clock. The server checks it against its own (tapElapsedMs) and clamps it. From the web (device 'web') it is ignored: the server's receipt time is used.
                          */
                         occurredAt?: string | null;
+                        /** @description Milliseconds from the tap to this send, from the phone's monotonic clock (a stopwatch the person can't change). An offline replay sends the time since the tap. The server's tap time is its own clock when the request arrives minus this. Within 2 minutes of the phone's time, the phone's time stands (never later than the tap); further apart, the server's tap time is recorded and the office is asked to look. A Clock Out or job time stop it proves this way keeps its real time however old; without it, a stop older than 12 hours is recorded at the 12-hour limit and flagged (T6). Send it with every queued tap, clock-outs included. */
+                        tapElapsedMs?: number | null;
+                        /** @description True when the phone restarted between the tap and this send, so there is no stopwatch reading (send no tapElapsedMs). A tap more than 2 minutes old keeps the phone's time and is flagged for the office. */
+                        tapTimeUnverified?: boolean | null;
+                        /** @description True when the phone's clock was changed by hand since the phone last synced. The tap is flagged for the office. */
+                        deviceClockChanged?: boolean | null;
                         notes?: string | null;
                     };
                 };
@@ -1964,7 +1984,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description Time tracking access denied, or no organization on the session. */
+                /** @description Time tracking access denied, no organization on the session, or code PAYROLL_OFF: the company has the time tracking add-on off (GET /api/time-tracking/day says payrollAddon: false). Don't retry; hide Clock In/Out and the other payroll controls. */
                 403: {
                     headers: {
                         [name: string]: unknown;
@@ -2013,7 +2033,10 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** End my day. Closes every open entry with it. */
+        /**
+         * End my day: the paid day only. Job time (fence or job timer) runs until it is stopped or the phone reports leaving, and is never paid past Clock Out.
+         * @description A late Clock Out (T6): with tapElapsedMs proving its time, it keeps its real time however old. When the safety net already closed the day (the automatic close), a proven Clock Out earlier than that close replaces it (replacedAutoClose, flagged for the office); anything else about that day is flagged for the office and changes nothing. A proven Clock Out from before the running day started never ends the running day.
+         */
         post: {
             parameters: {
                 query?: never;
@@ -2036,15 +2059,21 @@ export interface paths {
                         device?: "ios" | "web" | "android" | null;
                         /**
                          * Format: date-time
-                         * @description When the tap happened. The server clamps it.
+                         * @description When the tap happened, by the phone's clock. The server checks it against its own (tapElapsedMs) and clamps it. From the web (device 'web') it is ignored: the server's receipt time is used.
                          */
                         occurredAt?: string | null;
+                        /** @description Milliseconds from the tap to this send, from the phone's monotonic clock (a stopwatch the person can't change). An offline replay sends the time since the tap. The server's tap time is its own clock when the request arrives minus this. Within 2 minutes of the phone's time, the phone's time stands (never later than the tap); further apart, the server's tap time is recorded and the office is asked to look. A Clock Out or job time stop it proves this way keeps its real time however old; without it, a stop older than 12 hours is recorded at the 12-hour limit and flagged (T6). Send it with every queued tap, clock-outs included. */
+                        tapElapsedMs?: number | null;
+                        /** @description True when the phone restarted between the tap and this send, so there is no stopwatch reading (send no tapElapsedMs). A tap more than 2 minutes old keeps the phone's time and is flagged for the office. */
+                        tapTimeUnverified?: boolean | null;
+                        /** @description True when the phone's clock was changed by hand since the phone last synced. The tap is flagged for the office. */
+                        deviceClockChanged?: boolean | null;
                         note?: string | null;
                     };
                 };
             };
             responses: {
-                /** @description Day ended. */
+                /** @description Day ended, or the automatic close of the day this tap belongs to replaced (replacedAutoClose). */
                 200: {
                     headers: {
                         [name: string]: unknown;
@@ -2052,7 +2081,7 @@ export interface paths {
                     content: {
                         "application/json": {
                             day: components["schemas"]["WorkDay"] & (Record<string, never> | null);
-                            closedEntries: number;
+                            replacedAutoClose?: boolean;
                         };
                     };
                 };
@@ -2065,7 +2094,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description Time tracking access denied, or no organization on the session. */
+                /** @description Time tracking access denied, no organization on the session, or code PAYROLL_OFF: the company has the time tracking add-on off (GET /api/time-tracking/day says payrollAddon: false). Don't retry; hide Clock In/Out and the other payroll controls. */
                 403: {
                     headers: {
                         [name: string]: unknown;
@@ -2074,7 +2103,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description No day is running (code NO_OPEN_DAY). */
+                /** @description No day is running (code NO_OPEN_DAY). Also when the tap was only flagged for the office. */
                 404: {
                     headers: {
                         [name: string]: unknown;
@@ -2083,7 +2112,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description The day was already closed. */
+                /** @description The day was already closed; or code DAY_CLOSED_AUTOMATICALLY: the tap belongs to an earlier day the safety net closed, and was flagged for the office. */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -2306,7 +2335,7 @@ export interface paths {
             };
             requestBody?: never;
             responses: {
-                /** @description Fences, office first when requested. */
+                /** @description Fences, office first when requested. No job fences for someone the office turned job-site tracking off for (clock-config jobSiteTracking false), except with includeClosed for the manual picker. */
                 200: {
                     headers: {
                         [name: string]: unknown;
@@ -2359,12 +2388,12 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** My open entries right now (or the team's). */
+        /** My open entries right now, or who is on the clock. */
         get: {
             parameters: {
                 query?: {
-                    /** @description Everyone on the clock. Requires time_tracking.view_all. */
-                    scope?: "team";
+                    /** @description `team`: everyone on the clock, one OnTheClockRow per person; requires time_tracking.view_all. `me`: the caller's own row while on the clock. Without scope: the caller's open entries. */
+                    scope?: "team" | "me";
                 };
                 header?: {
                     /** @description Semver of the calling app build. Drives the 426 / soft-upgrade handshake. */
@@ -2377,13 +2406,13 @@ export interface paths {
             };
             requestBody?: never;
             responses: {
-                /** @description Open entries. Normally zero or one for a single user. */
+                /** @description Without scope: open entries, normally zero or one. With scope: one OnTheClockRow per person on the clock. */
                 200: {
                     headers: {
                         [name: string]: unknown;
                     };
                     content: {
-                        "application/json": components["schemas"]["TimeEntry"][];
+                        "application/json": components["schemas"]["TimeEntry"][] | components["schemas"]["OnTheClockRow"][];
                     };
                 };
                 /** @description Not signed in. */
@@ -2509,8 +2538,8 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Clock in to a job or the office by hand.
-         * @description A deliberate button press. On the day model a press with no day running starts the day at that moment; a fence-driven clock-in from an old-model client cannot, and is refused.
+         * Start time on a job or at the office by hand.
+         * @description A deliberate button press. The entry joins the person's work day when one is running. With none running: a job timer press (startDay: false) records job time only and never starts the paid day; a Clock In press (startDay omitted: older iPhones' job picker, the office's "Clock X in") starts the day at that moment; an automatic clock-in is refused with NO_OPEN_DAY, because the fence crossing already records the arrival. A person starting their own job time away from the job's site, or with no usable location, is asked first (send canConfirmAway: 409 JOB_TIME_AWAY carries the question; resend with confirmAway once they say yes) and the entry is flagged (startCheck) for the office to approve, move or not count. Older apps start straight away, flagged the same.
          */
         post: {
             parameters: {
@@ -2535,20 +2564,34 @@ export interface paths {
                         siteType?: "job" | "office";
                         /** @description Clock someone else in. Requires time_tracking.edit_all. */
                         userId?: string;
+                        /** @description Why, when clocking someone else in. Required with userId. */
+                        note?: string;
                         lat?: number;
                         lng?: number;
                         /** @enum {string} */
                         source?: "manual" | "auto";
+                        /** @description false: a job timer press, job time only; it never starts the paid day. Omitted: a Clock In press starts the day when none is running. */
+                        startDay?: boolean;
                         notes?: string;
                         budgetItemId?: number | null;
                         /**
                          * Format: date-time
-                         * @description When the tech actually arrived. The server clamps it.
+                         * @description When the tech actually arrived, by the phone's clock. The server checks it against its own (tapElapsedMs) and clamps it. From the web (device 'web') it is ignored: the server's receipt time is used.
                          */
                         occurredAt?: string;
                         accuracyM?: number | null;
                         /** @enum {string|null} */
                         device?: "ios" | "web" | "android" | null;
+                        /** @description This app can ask the person before starting job time away from the job (it handles 409 JOB_TIME_AWAY). */
+                        canConfirmAway?: boolean;
+                        /** @description The person said yes to starting away from the job. */
+                        confirmAway?: boolean;
+                        /** @description Milliseconds from the tap to this send, from the phone's monotonic clock (a stopwatch the person can't change). An offline replay sends the time since the tap. The server's tap time is its own clock when the request arrives minus this. Within 2 minutes of the phone's time, the phone's time stands (never later than the tap); further apart, the server's tap time is recorded and the office is asked to look. A Clock Out or job time stop it proves this way keeps its real time however old; without it, a stop older than 12 hours is recorded at the 12-hour limit and flagged (T6). Send it with every queued tap, clock-outs included. */
+                        tapElapsedMs?: number | null;
+                        /** @description True when the phone restarted between the tap and this send, so there is no stopwatch reading (send no tapElapsedMs). A tap more than 2 minutes old keeps the phone's time and is flagged for the office. */
+                        tapTimeUnverified?: boolean | null;
+                        /** @description True when the phone's clock was changed by hand since the phone last synced. The tap is flagged for the office. */
+                        deviceClockChanged?: boolean | null;
                     };
                 };
             };
@@ -2562,7 +2605,7 @@ export interface paths {
                         "application/json": components["schemas"]["TimeEntry"];
                     };
                 };
-                /** @description Validation failure, or jobId missing on a job clock-in. */
+                /** @description Validation failure, jobId missing on a job clock-in, or no note when clocking someone else in. */
                 400: {
                     headers: {
                         [name: string]: unknown;
@@ -2580,7 +2623,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description Time tracking access denied, or no organization on the session. */
+                /** @description Time tracking access denied, or no organization on the session. PAYROLL_OFF: a Clock In press that would start the day at a company with the time tracking add-on off. JOB_TIME_OFF: the company has both the time tracking add-on and location tracking off, so job time isn't used; stopping running job time still works. */
                 403: {
                     headers: {
                         [name: string]: unknown;
@@ -2598,7 +2641,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description Already clocked in at this site (code ALREADY_CLOCKED_IN_SAME_JOB). The body carries the existing entry — adopt it. */
+                /** @description ALREADY_CLOCKED_IN_SAME_JOB: already at this site; the body carries the existing entry — adopt it. ALREADY_CLOCKED_IN_OTHER_JOB: an automatic clock-in while another entry is open; the body carries it. NO_OPEN_DAY: an automatic clock-in with no work day running; the fence crossing records the arrival. JOB_SITE_TRACKING_OFF: an automatic clock-in for someone the office turned job-site tracking off for; start job time by hand. PERIOD_LOCKED: an admin clock-in inside a locked pay period. JOB_TIME_AWAY: starting job time away from the job (reason 'away', with distanceM) or with no usable location (reason 'no_location'); show message as the question and resend with confirmAway: true. */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -2607,7 +2650,11 @@ export interface paths {
                         "application/json": {
                             message: string;
                             code: string;
-                            entry: components["schemas"]["TimeEntry"];
+                            entry?: components["schemas"]["TimeEntry"];
+                            /** @enum {string} */
+                            reason?: "away" | "no_location";
+                            distanceM?: number | null;
+                            jobName?: string | null;
                         };
                     };
                 };
@@ -2667,17 +2714,23 @@ export interface paths {
                         notes?: string;
                         /**
                          * Format: date-time
-                         * @description When the tech actually left. Clamped to [entry.clockIn, now].
+                         * @description When the tech actually left, by the phone's clock. Checked against the server's (tapElapsedMs) and clamped to [entry.clockIn, now], and to the last 12 hours unless tapElapsedMs proves it (T6). From the web (device 'web') it is ignored: the server's receipt time is used.
                          */
                         occurredAt?: string;
                         accuracyM?: number | null;
                         /** @enum {string|null} */
                         device?: "ios" | "web" | "android" | null;
+                        /** @description Milliseconds from the tap to this send, from the phone's monotonic clock (a stopwatch the person can't change). An offline replay sends the time since the tap. The server's tap time is its own clock when the request arrives minus this. Within 2 minutes of the phone's time, the phone's time stands (never later than the tap); further apart, the server's tap time is recorded and the office is asked to look. A Clock Out or job time stop it proves this way keeps its real time however old; without it, a stop older than 12 hours is recorded at the 12-hour limit and flagged (T6). Send it with every queued tap, clock-outs included. */
+                        tapElapsedMs?: number | null;
+                        /** @description True when the phone restarted between the tap and this send, so there is no stopwatch reading (send no tapElapsedMs). A tap more than 2 minutes old keeps the phone's time and is flagged for the office. */
+                        tapTimeUnverified?: boolean | null;
+                        /** @description True when the phone's clock was changed by hand since the phone last synced. The tap is flagged for the office. */
+                        deviceClockChanged?: boolean | null;
                     };
                 };
             };
             responses: {
-                /** @description Entry closed. */
+                /** @description Entry closed; or, for a stop tapElapsedMs proves that is earlier than the automatic close of the job time there, that close replaced (T6). */
                 200: {
                     headers: {
                         [name: string]: unknown;
@@ -2713,7 +2766,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description No open entry at that site. */
+                /** @description No open entry at that site. Also when the stop belongs to job time the safety net closed and was only flagged for the office. */
                 404: {
                     headers: {
                         [name: string]: unknown;
@@ -2750,7 +2803,7 @@ export interface paths {
         put?: never;
         /**
          * Move my clock to another job in one atomic call.
-         * @description Closes the caller's open entry and opens one on the target. One request instead of clock-out + clock-in, so an offline drop between the two cannot strand the tech clocked out. Own entry only.
+         * @description Closes the caller's open entry and opens one on the target. One request instead of clock-out + clock-in, so an offline drop between the two cannot strand the tech clocked out. Own entry only. Moving job time to a job the person isn't at, or with no usable location, is asked first (send canConfirmAway: 409 JOB_TIME_AWAY carries the question; resend with confirmAway once they say yes) and the new entry is flagged (startCheck) for the office. Older apps move straight away, flagged the same. switchAt is a time the person picked, so earlier than the tap is normal. With tapElapsedMs it is never later than the tap by the server's clock, and more than 2 minutes later is replaced by the tap time and flagged (opened.clockInCheck). tapTimeUnverified doesn't apply; deviceClockChanged flags it.
          */
         post: {
             parameters: {
@@ -2773,6 +2826,17 @@ export interface paths {
                         switchAt?: string;
                         lat?: number;
                         lng?: number;
+                        accuracyM?: number | null;
+                        /** @description This app can ask the person before moving job time to a job they aren't at (it handles 409 JOB_TIME_AWAY). */
+                        canConfirmAway?: boolean;
+                        /** @description The person said yes to moving it anyway. */
+                        confirmAway?: boolean;
+                        /** @description Milliseconds from the tap to this send, from the phone's monotonic clock (a stopwatch the person can't change). An offline replay sends the time since the tap. The server's tap time is its own clock when the request arrives minus this. Within 2 minutes of the phone's time, the phone's time stands (never later than the tap); further apart, the server's tap time is recorded and the office is asked to look. A Clock Out or job time stop it proves this way keeps its real time however old; without it, a stop older than 12 hours is recorded at the 12-hour limit and flagged (T6). Send it with every queued tap, clock-outs included. */
+                        tapElapsedMs?: number | null;
+                        /** @description True when the phone restarted between the tap and this send, so there is no stopwatch reading (send no tapElapsedMs). A tap more than 2 minutes old keeps the phone's time and is flagged for the office. */
+                        tapTimeUnverified?: boolean | null;
+                        /** @description True when the phone's clock was changed by hand since the phone last synced. The tap is flagged for the office. */
+                        deviceClockChanged?: boolean | null;
                     };
                 };
             };
@@ -2808,7 +2872,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description Time tracking access denied, or no organization on the session. */
+                /** @description Time tracking access denied, or no organization on the session. JOB_TIME_OFF: the company has both the time tracking add-on and location tracking off, so job time isn't used; stopping running job time still works. */
                 403: {
                     headers: {
                         [name: string]: unknown;
@@ -2826,6 +2890,22 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
+                /** @description PERIOD_LOCKED: the switch time is inside a locked pay period. JOB_TIME_AWAY: the person isn't at the target job (reason 'away', with distanceM) or has no usable location (reason 'no_location'); nothing moved. Show message as the question and resend with confirmAway: true. */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            message: string;
+                            code: string;
+                            /** @enum {string} */
+                            reason?: "away" | "no_location";
+                            distanceM?: number | null;
+                            jobName?: string | null;
+                        };
+                    };
+                };
                 /** @description Client major below minClientVersion. */
                 426: {
                     headers: {
@@ -3127,7 +3207,7 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
-                /** @description Time tracking access denied, or no organization on the session. */
+                /** @description Time tracking access denied, no organization on the session, or code PAYROLL_OFF: the company has the time tracking add-on off (GET /api/time-tracking/day says payrollAddon: false). Don't retry; hide Clock In/Out and the other payroll controls. */
                 403: {
                     headers: {
                         [name: string]: unknown;
@@ -3369,6 +3449,15 @@ export interface paths {
                         "application/json": components["schemas"]["ErrorEnvelope"];
                     };
                 };
+                /** @description Time tracking access denied, no organization on the session, or code PAYROLL_OFF: the company has the time tracking add-on off (GET /api/time-tracking/day says payrollAddon: false). Don't retry; hide Clock In/Out and the other payroll controls. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
                 /** @description A request for those dates is already waiting. */
                 409: {
                     headers: {
@@ -3395,6 +3484,171 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/account/deletion-request": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** My newest account deletion request. */
+        get: {
+            parameters: {
+                query?: never;
+                header?: {
+                    /** @description Semver of the calling app build. Drives the 426 / soft-upgrade handshake. */
+                    "X-Client-Version"?: string;
+                };
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description The newest request, whatever its status. */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AccountDeletionRequest"];
+                    };
+                };
+                /** @description Not signed in. */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
+                /** @description No organization on the session. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
+                /** @description No request yet. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @example No deletion request */
+                            message: string;
+                        };
+                    };
+                };
+                /** @description Client major below minClientVersion. */
+                426: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["UpgradeRequiredEnvelope"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Ask for my account to be deleted.
+         * @description Nothing is deleted by this call. The request goes to the company's owner and Team admins (bell, push and email) and to ServiceAi support (email); the company removes the account. Asking again while a request is pending answers that request with 200 and creates nothing; everyone is reminded at most once a day. The reason is never put in a push.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: {
+                    /** @description Semver of the calling app build. Drives the 426 / soft-upgrade handshake. */
+                    "X-Client-Version"?: string;
+                };
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description Optional. Trimmed; at most 1000 characters after trimming. */
+                        reason?: string | null;
+                    };
+                };
+            };
+            responses: {
+                /** @description A request was already pending: this is that request. */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AccountDeletionRequest"];
+                    };
+                };
+                /** @description Request created. */
+                202: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AccountDeletionRequest"];
+                    };
+                };
+                /** @description Validation failure (a reason longer than 1000 characters). */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
+                /** @description Not signed in. */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
+                /** @description No organization on the session, or viewing the app as someone else. */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
+                /** @description Client major below minClientVersion. */
+                426: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["UpgradeRequiredEnvelope"];
+                    };
+                };
+                /** @description Too many requests from this person; try again later. */
+                429: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorEnvelope"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -3419,7 +3673,7 @@ export interface components {
         };
         /** @description Cross-platform version handshake manifest. See docs/api-versioning.md. */
         VersionManifest: {
-            /** @example 1.2.418 */
+            /** @example 1.2.420 */
             apiVersion: string;
             /** @example 1.0.0 */
             minClientVersion: string;
@@ -4019,6 +4273,39 @@ export interface components {
         RealtimeWebrtcRequest: {
             sdp: string;
         };
+        /** @description A tap whose time the office is asked to look at, with both times. It waits in Team › Needs attention. */
+        PunchTimeCheck: {
+            /** @description server_time: the phone's time was more than 2 minutes from the server's, and the server's was recorded. unverified: the phone restarted before sending, so the time couldn't be checked; the phone's was kept. clock_changed: the phone's clock was changed by hand. Late stops (T6): too_old: a stop more than 12 hours old that couldn't be proven was recorded at the 12-hour limit. replaced_auto_close: a proven stop replaced the automatic close (autoAt). after_auto_close: a stop later than the automatic close; the automatic close was kept. auto_close_kept: a stop earlier than the automatic close that wasn't applied (keptBecause). */
+            reasons: ("server_time" | "unverified" | "clock_changed" | "too_old" | "replaced_auto_close" | "after_auto_close" | "auto_close_kept")[];
+            /**
+             * Format: date-time
+             * @description The phone's own time for the tap.
+             */
+            phoneAt: string | null;
+            /**
+             * Format: date-time
+             * @description The tap by the server's clock (arrival minus tapElapsedMs); null when the phone couldn't say.
+             */
+            serverAt: string | null;
+            /**
+             * Format: date-time
+             * @description When the request reached the server.
+             */
+            receivedAt: string;
+            tapElapsedMs: number | null;
+            /** @description True when the phone's stopwatch proved the tap's time. */
+            verified?: boolean;
+            /**
+             * Format: date-time
+             * @description The automatic close a late stop replaced or was held against.
+             */
+            autoAt?: string;
+            /**
+             * @description Why a late stop wasn't applied: its time couldn't be proven, the office had already changed or approved the time, or the pay period is locked.
+             * @enum {string}
+             */
+            keptBecause?: "unverified" | "office" | "locked";
+        };
         /** @description One stretch of time at one site, inside a work day. durationMinutes stays gross; paid time is gross minus breakMinutes. */
         TimeEntry: {
             id: number;
@@ -4063,11 +4350,25 @@ export interface components {
             staleWarnedAt: string | null;
             /** @description Unpaid break minutes recorded against this entry. */
             breakMinutes: number;
+            /**
+             * @description Job time started by hand away from the job ('away') or with no usable location ('no_location'); null for a normal start. The office decides it.
+             * @enum {string|null}
+             */
+            startCheck?: "away" | "no_location" | null;
+            /** @description How far from the job's site center the start was, when startCheck is 'away'. */
+            startDistanceM?: number | null;
+            /**
+             * @description The office's decision on a flagged start; null while it waits. 'not_approved' stays on the timesheet but off the job's costing.
+             * @enum {string|null}
+             */
+            startReview?: "approved" | "not_approved" | "moved" | null;
+            clockInCheck?: components["schemas"]["PunchTimeCheck"] & (Record<string, never> | null);
+            clockOutCheck?: components["schemas"]["PunchTimeCheck"] & (Record<string, never> | null);
             /** Format: date-time */
             createdAt: string | null;
             /** @description Enrichment on /active and /entries. 'Office' for an office entry. */
             jobName?: string;
-            /** @description Enrichment on /entries and /active?scope=team. */
+            /** @description Enrichment on /entries. */
             userName?: string;
         };
         /** @description Where a day's minutes went (shared/workDays.ts splitDayMinutes). */
@@ -4125,6 +4426,8 @@ export interface components {
                 nearestJob?: unknown;
             } | null;
             notes: string | null;
+            clockInCheck?: components["schemas"]["PunchTimeCheck"] & (Record<string, never> | null);
+            clockOutCheck?: components["schemas"]["PunchTimeCheck"] & (Record<string, never> | null);
             editedBy: string | null;
             /** Format: date-time */
             editedAt: string | null;
@@ -4156,6 +4459,16 @@ export interface components {
         };
         /** @description Everything the phone needs to draw the day card and decide what it may record. */
         MyDayResponse: {
+            /** @description The company's time tracking (payroll) add-on. False: no Clock In/Out, no work days, schedules, time cards or pay; job time still runs. Then open is null, today is empty, shiftEnd is null, payroll.breakButton and locationTrail are false, and the payroll routes answer 403 PAYROLL_OFF. Not the same as payroll.enabled. */
+            payrollAddon: boolean;
+            /** @description The company's pay rules as they touch this person. */
+            payroll: {
+                /** @description A pay period is set (the company's pay rules are on). */
+                enabled: boolean;
+                /** @description Show the break button (false when this person's lunch comes off automatically). */
+                breakButton: boolean;
+                breaksPaid: boolean;
+            };
             /** @description True once this person is on the day model. */
             dayModel: boolean;
             open: components["schemas"]["WorkDay"] & (Record<string, never> | null);
@@ -4203,7 +4516,7 @@ export interface components {
             /** Format: date-time */
             stageChangedAt: string | null;
         };
-        /** @description One fence crossing as the device saw it. */
+        /** @description One fence crossing as the device saw it. With tapElapsedMs (the time since the crossing), the server checks occurredAt against its own clock before the resolver uses it, and the entry the crossing opens or closes carries the check. A departure it proves isn't held to the 12-hour limit (T6). */
         ClockCrossing: {
             /** @description Client-generated UUID. Re-delivery is a no-op (unique index), so retry freely. */
             clientEventId: string;
@@ -4227,6 +4540,12 @@ export interface components {
             device?: "ios" | "web" | "android" | null;
             /** @description The user's auto-clock toggle at crossing time. False → the crossing is logged but never acted on. */
             autoClockEnabled?: boolean;
+            /** @description Milliseconds from the tap to this send, from the phone's monotonic clock (a stopwatch the person can't change). An offline replay sends the time since the tap. The server's tap time is its own clock when the request arrives minus this. Within 2 minutes of the phone's time, the phone's time stands (never later than the tap); further apart, the server's tap time is recorded and the office is asked to look. A Clock Out or job time stop it proves this way keeps its real time however old; without it, a stop older than 12 hours is recorded at the 12-hour limit and flagged (T6). Send it with every queued tap, clock-outs included. */
+            tapElapsedMs?: number | null;
+            /** @description True when the phone restarted between the tap and this send, so there is no stopwatch reading (send no tapElapsedMs). A tap more than 2 minutes old keeps the phone's time and is flagged for the office. */
+            tapTimeUnverified?: boolean | null;
+            /** @description True when the phone's clock was changed by hand since the phone last synced. The tap is flagged for the office. */
+            deviceClockChanged?: boolean | null;
         };
         /** @description Always 202. The clock state to trust is `openEntries`, not the client's own guess. */
         CrossingsAck: {
@@ -4296,6 +4615,8 @@ export interface components {
             };
             /** @description True only for the primary account. */
             canEdit: boolean;
+            /** @description The caller's own switch, set by the office (owner's O9). False: watch no job-site fences and use no location for job time; job time comes only from Start/Stop job time. The office fence, Clock In/Out and the company switches are unaffected. Absent (an older server): treat as true. */
+            jobSiteTracking?: boolean;
         };
         /** @description Always 202. */
         TrailPingResponse: {
@@ -4374,6 +4695,8 @@ export interface components {
              * @description The org-local date, which is not necessarily the device's.
              */
             today: string;
+            /** @description False when the company has the time tracking add-on off: no shifts, hours or time off come back, and nothing covers now. */
+            payrollAddon: boolean;
             /** @description Keyed by org-local ISO date. */
             hours: {
                 [key: string]: {
@@ -4410,6 +4733,32 @@ export interface components {
             /** @description The last few decided ones, newest first. */
             recentTimeOff: components["schemas"]["TimeOffRequestSummary"][];
         };
+        /** @description One person on the clock (server/onTheClock.ts). Job time with no paid day behind it is left out: that person is at a job, not on the clock. */
+        OnTheClockRow: {
+            userId: string;
+            userName: string;
+            /** @description The open site entry; null between sites (a day with nothing open). */
+            entryId: number | null;
+            jobId: number | null;
+            /**
+             * @description 'none' between sites.
+             * @enum {string}
+             */
+            siteType: "job" | "office" | "none";
+            jobName: string | null;
+            /**
+             * Format: date-time
+             * @description When the work day began, else when the entry did.
+             */
+            since: string;
+        };
+        /** @description The signed-in person's request to have their account deleted. pending: waiting for the company; completed: the company marked it done; cancelled: the company cancelled it (asking again starts a new one). */
+        AccountDeletionRequest: {
+            /** @enum {string} */
+            status: "pending" | "completed" | "cancelled";
+            /** Format: date-time */
+            requestedAt: string;
+        };
     };
     responses: never;
     parameters: never;