@soat/cli 0.15.10 → 0.15.12

package/dist/index.mjs

@@ -13,7 +13,7 @@ import { load } from "js-yaml";
 import * as os from "node:os";
 
 //#region package.json
-var version = "0.15.10";
+var version = "0.15.12";
 
 //#endregion
 //#region src/cli-wrappers/wrappers/formations.ts
@@ -343,6 +343,7 @@ var routes = {
     operationId: "listActors",
     description: "Returns all actors the caller has access to. If projectId is provided, returns only actors in that project. project keys are scoped to a single project automatically. JWT users without projectId receive actors across all their accessible projects.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "external_id", "agent_id", "chat_id", "conversation_id", "limit", "offset"],
     flags: [{
@@ -394,6 +395,7 @@ var routes = {
     operationId: "createActor",
     description: "Creates a new actor. project keys automatically infer the project from the key's scope; JWT callers must supply projectId.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -451,6 +453,7 @@ var routes = {
     operationId: "getActor",
     description: "Returns an actor by its ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "get",
     pathParams: ["actor_id"],
     queryParams: [],
     flags: [{
@@ -466,6 +469,7 @@ var routes = {
     operationId: "updateActor",
     description: "Updates an actor's properties",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "patch",
     pathParams: ["actor_id"],
     queryParams: [],
     flags: [{
@@ -523,6 +527,7 @@ var routes = {
     operationId: "deleteActor",
     description: "Deletes an actor by its ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "delete",
     pathParams: ["actor_id"],
     queryParams: [],
     flags: [{
@@ -538,6 +543,7 @@ var routes = {
     operationId: "getActorTags",
     description: "Returns all tags attached to the actor",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "get",
     pathParams: ["actor_id"],
     queryParams: [],
     flags: [{
@@ -553,6 +559,7 @@ var routes = {
     operationId: "replaceActorTags",
     description: "Replaces all tags on the actor with the provided tags (not merged)",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "put",
     pathParams: ["actor_id"],
     queryParams: [],
     flags: [{
@@ -568,6 +575,7 @@ var routes = {
     operationId: "mergeActorTags",
     description: "Merges provided tags with existing tags (existing tags are preserved unless overridden)",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/actors",
+    httpMethod: "patch",
     pathParams: ["actor_id"],
     queryParams: [],
     flags: [{
@@ -583,6 +591,7 @@ var routes = {
     operationId: "listAgents",
     description: "Returns all agents in the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -598,6 +607,7 @@ var routes = {
     operationId: "createAgent",
     description: "Creates a new agent bound to an AI provider.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -672,6 +682,12 @@ var routes = {
       "required": false,
       "type": "array",
       "in": "body"
+    }, {
+      "name": "guardrail_ids",
+      "description": "Guardrails attached at the agent scope.",
+      "required": false,
+      "type": "array",
+      "in": "body"
     }, {
       "name": "step_rules",
       "description": "",
@@ -721,6 +737,7 @@ var routes = {
     operationId: "getAgent",
     description: "Returns a single agent by ID.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "get",
     pathParams: ["agent_id"],
     queryParams: [],
     flags: [{
@@ -736,6 +753,7 @@ var routes = {
     operationId: "updateAgent",
     description: "Updates an existing agent. Identical to PATCH — both perform partial updates.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "put",
     pathParams: ["agent_id"],
     queryParams: [],
     flags: [{
@@ -776,7 +794,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "tool_ids",
-      "description": "Deprecated shorthand — replaces only the reference (`tool_id`) bindings, rewriting them bare (any `approval_policy` on them is dropped). Use `tool_bindings` instead.",
+      "description": "Deprecated shorthand — replaces only the reference (`tool_id`) bindings, rewriting them bare. Use `tool_bindings` instead.",
       "required": false,
       "type": "array",
       "in": "body"
@@ -810,6 +828,12 @@ var routes = {
       "required": false,
       "type": "array",
       "in": "body"
+    }, {
+      "name": "guardrail_ids",
+      "description": "Guardrails attached at the agent scope.",
+      "required": false,
+      "type": "array",
+      "in": "body"
     }, {
       "name": "step_rules",
       "description": "",
@@ -859,6 +883,7 @@ var routes = {
     operationId: "patchAgent",
     description: "Partially updates an existing agent. Identical to PUT — both perform partial updates.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "patch",
     pathParams: ["agent_id"],
     queryParams: [],
     flags: [{
@@ -899,7 +924,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "tool_ids",
-      "description": "Deprecated shorthand — replaces only the reference (`tool_id`) bindings, rewriting them bare (any `approval_policy` on them is dropped). Use `tool_bindings` instead.",
+      "description": "Deprecated shorthand — replaces only the reference (`tool_id`) bindings, rewriting them bare. Use `tool_bindings` instead.",
       "required": false,
       "type": "array",
       "in": "body"
@@ -933,6 +958,12 @@ var routes = {
       "required": false,
       "type": "array",
       "in": "body"
+    }, {
+      "name": "guardrail_ids",
+      "description": "Guardrails attached at the agent scope.",
+      "required": false,
+      "type": "array",
+      "in": "body"
     }, {
       "name": "step_rules",
       "description": "",
@@ -982,6 +1013,7 @@ var routes = {
     operationId: "deleteAgent",
     description: "Deletes an agent by ID. Fails with `409` if the agent has dependent generations or traces, unless `force=true` is passed, in which case those generations and traces are deleted along with the agent.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "delete",
     pathParams: ["agent_id"],
     queryParams: ["force"],
     flags: [{
@@ -1003,6 +1035,7 @@ var routes = {
     operationId: "createAgentGeneration",
     description: "Sends messages to the agent, resolves its tools, and runs the AI model loop. Supports streaming via `stream: true`. Client tools pause the generation and return `requires_action`.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "post",
     pathParams: ["agent_id"],
     queryParams: [],
     flags: [{
@@ -1059,6 +1092,12 @@ var routes = {
       "required": false,
       "type": "string",
       "in": "body"
+    }, {
+      "name": "guardrail_context",
+      "description": "Caller-supplied guardrail context (the `context.*` namespace guard and class expressions read at tool-dispatch time). Free-form and never interpreted by the platform; a guardrail may combine it with a `context_tool` per its `context_mode`. See the guardrails module.",
+      "required": false,
+      "type": "object",
+      "in": "body"
     }, {
       "name": "metadata",
       "description": "Caller-supplied key/value metadata attached to the generation record for per-run audit attribution (e.g. the knowledge-corpus version that produced this action). Round-trips when the generation is fetched via the generations API. Reserved server-owned keys (`action_id`, `trigger_id`, `run_id`, `node_id`, `extraction`, and internal recovery state) cannot be set here and are rejected with 400.",
@@ -1084,6 +1123,7 @@ var routes = {
     operationId: "submitAgentToolOutputs",
     description: "Resumes a generation that was paused due to client tool calls. Provide tool outputs for each pending tool call.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/agents",
+    httpMethod: "post",
     pathParams: ["agent_id", "generation_id"],
     queryParams: [],
     flags: [{
@@ -1111,6 +1151,7 @@ var routes = {
     operationId: "listAiProviders",
     description: "Returns a list of AI provider configurations for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -1138,6 +1179,7 @@ var routes = {
     operationId: "createAiProvider",
     description: "Creates a new LLM provider configuration",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -1189,6 +1231,7 @@ var routes = {
     operationId: "getAiProvider",
     description: "Returns a specific AI provider configuration",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "get",
     pathParams: ["ai_provider_id"],
     queryParams: [],
     flags: [{
@@ -1204,6 +1247,7 @@ var routes = {
     operationId: "updateAiProvider",
     description: "Updates an AI provider configuration",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "patch",
     pathParams: ["ai_provider_id"],
     queryParams: [],
     flags: [{
@@ -1255,6 +1299,7 @@ var routes = {
     operationId: "deleteAiProvider",
     description: "Deletes an AI provider configuration. Live references — chats, agents, and discussions that use this provider — always block deletion with `409 AI_PROVIDER_HAS_DEPENDENTS`; `force` does not override them, so delete or repoint those resources first. Soft dependents — price overrides, usage/generation records, and discussion participants — also block with `409` unless `force=true`, which deletes the provider's price overrides and unlinks (nulls) its usage and participant history, preserving those rows. The `409` body's `error.meta` reports the counts, a sample of offending IDs, and a `forcible` flag that is `true` when a `force=true` retry would succeed.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "delete",
     pathParams: ["ai_provider_id"],
     queryParams: ["force"],
     flags: [{
@@ -1276,6 +1321,7 @@ var routes = {
     operationId: "getAiProviderPrices",
     description: "Returns the per-provider price overrides for this AI provider instance. An override prices this specific provider (e.g. an enterprise-negotiated rate or a gateway with markup) and wins over the global default at cost time. Authorized by the caller's access to the provider's project — so, unlike the global price book, a project's own overrides are visible here.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "get",
     pathParams: ["ai_provider_id"],
     queryParams: [],
     flags: [{
@@ -1291,6 +1337,7 @@ var routes = {
     operationId: "updateAiProviderPrices",
     description: "Upserts price overrides for this AI provider instance, keyed on (model, effective_from). The provider slug is taken from the AI provider itself, so only the model, rates, and effective_from are supplied. Authorized by the caller's access to the provider's project. `effective_from` must be in the future — past prices are immutable, so ship corrections as new future-dated rows.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ai-providers",
+    httpMethod: "put",
     pathParams: ["ai_provider_id"],
     queryParams: [],
     flags: [{
@@ -1312,6 +1359,7 @@ var routes = {
     operationId: "listApiKeys",
     description: "Lists API keys accessible to the caller. - JWT admin: returns all API keys. - JWT regular user: returns only the user's own API keys. - API key: returns only API keys scoped to the key's project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/api-keys",
+    httpMethod: "get",
     pathParams: [],
     queryParams: [],
     flags: []
@@ -1321,6 +1369,7 @@ var routes = {
     operationId: "createApiKey",
     description: "Creates a new API key for the authenticated user. - `project_id` is optional. When set, the key is scoped to that single project. When omitted or null, the key is **unscoped** and spans every project its owner can reach. - If `policy_ids` is provided, the key's effective permissions are the intersection of the user's policies and the key's policies. - Otherwise the key inherits the user's permissions (confined to the key's project when scoped).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/api-keys",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -1348,6 +1397,7 @@ var routes = {
     operationId: "getApiKey",
     description: "Returns details of an API key. Only the owner or an admin can access it.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/api-keys",
+    httpMethod: "get",
     pathParams: ["api_key_id"],
     queryParams: [],
     flags: [{
@@ -1363,6 +1413,7 @@ var routes = {
     operationId: "updateApiKey",
     description: "Updates an API key's name, project scope, or policies. The project scope can be changed to another project, set (scoping a previously unscoped key), or cleared with null (unscoping the key). Only the owner or an admin can update it.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/api-keys",
+    httpMethod: "put",
     pathParams: ["api_key_id"],
     queryParams: [],
     flags: [{
@@ -1396,6 +1447,7 @@ var routes = {
     operationId: "deleteApiKey",
     description: "Deletes an API key. Only the owner or an admin can delete it.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/api-keys",
+    httpMethod: "delete",
     pathParams: ["api_key_id"],
     queryParams: [],
     flags: [{
@@ -1411,6 +1463,7 @@ var routes = {
     operationId: "listApprovals",
     description: "Returns approval items for a project, filterable by status, origin, and expiry.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/approvals",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "status", "origin", "expires_before"],
     flags: [{
@@ -1444,6 +1497,7 @@ var routes = {
     operationId: "getApproval",
     description: "Returns a single approval item with its full evidence.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/approvals",
+    httpMethod: "get",
     pathParams: ["approval_id"],
     queryParams: [],
     flags: [{
@@ -1459,6 +1513,7 @@ var routes = {
     operationId: "approveApproval",
     description: "Approves the item. Optionally supply edited `arguments` to replace the proposed arguments (edit-then-approve); the original is preserved on the item. Expiry is re-checked at decision time — an expired item can never be approved.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/approvals",
+    httpMethod: "post",
     pathParams: ["approval_id"],
     queryParams: [],
     flags: [{
@@ -1480,6 +1535,7 @@ var routes = {
     operationId: "rejectApproval",
     description: "Rejects the item. A reason is required and preserved on the item.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/approvals",
+    httpMethod: "post",
     pathParams: ["approval_id"],
     queryParams: [],
     flags: [{
@@ -1496,11 +1552,92 @@ var routes = {
       "in": "body"
     }]
   },
+  "list-audit-entries": {
+    serviceClass: "AuditLog",
+    operationId: "listAuditEntries",
+    description: "Returns audit-log entries visible to the caller, newest first. All filters are optional and combine with AND. `resource_srn` is a prefix match (e.g. `soat:{project}:secret:` matches every secret action); every other filter is exact.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/audit-log",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id", "action", "actor_id", "resource_public_id", "resource_srn", "from", "to", "limit", "offset"],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (scopes results; required if not using project key auth for a specific project)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "action",
+      "description": "Exact permission-action string, e.g. `secrets:DeleteSecret`",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "actor_id",
+      "description": "Public id of the principal (`user_…` or `key_…`)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "resource_public_id",
+      "description": "Exact target resource public id, e.g. `sec_…`",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "resource_srn",
+      "description": "SRN prefix match, e.g. `soat:{project}:secret:`",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "from",
+      "description": "Only entries created at or after this timestamp (ISO 8601)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "to",
+      "description": "Only entries created at or before this timestamp (ISO 8601)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "limit",
+      "description": "Number of results per page (1–200, default 25)",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }, {
+      "name": "offset",
+      "description": "Number of results to skip",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }]
+  },
+  "get-audit-entry": {
+    serviceClass: "AuditLog",
+    operationId: "getAuditEntry",
+    description: "Returns a single audit-log entry, including its `detail` payload",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/audit-log",
+    httpMethod: "get",
+    pathParams: ["entry_id"],
+    queryParams: [],
+    flags: [{
+      "name": "entry_id",
+      "description": "Audit entry ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
   "list-chats": {
     serviceClass: "Chats",
     operationId: "listChats",
     description: "Returns all chats in the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/chats",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -1516,6 +1653,7 @@ var routes = {
     operationId: "createChat",
     description: "Creates a new chat resource bound to an AI provider.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/chats",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -1555,6 +1693,7 @@ var routes = {
     operationId: "getChat",
     description: "Returns a single chat by ID.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/chats",
+    httpMethod: "get",
     pathParams: ["chat_id"],
     queryParams: [],
     flags: [{
@@ -1570,6 +1709,7 @@ var routes = {
     operationId: "deleteChat",
     description: "Deletes a chat by ID.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/chats",
+    httpMethod: "delete",
     pathParams: ["chat_id"],
     queryParams: [],
     flags: [{
@@ -1585,6 +1725,7 @@ var routes = {
     operationId: "createChatCompletionForChat",
     description: "Runs a completion using the AI provider and settings stored in the chat. Pass `stream: true` for SSE streaming. A system message in `messages` overrides the chat's stored system message for this call only. Messages may use `documentId` instead of `content`.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/chats",
+    httpMethod: "post",
     pathParams: ["chat_id"],
     queryParams: [],
     flags: [{
@@ -1618,6 +1759,7 @@ var routes = {
     operationId: "createChatCompletion",
     description: "OpenAI Chat Completions-compatible endpoint. Mirrors OpenAI's `POST /v1/chat/completions` path so an OpenAI SDK can target it by base URL alone. Resolves the AI provider from `ai_provider_id`, decrypts its secret, and calls the appropriate Vercel AI SDK provider. `ai_provider_id` is required — there is no server-side model fallback.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/chats",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -1651,6 +1793,7 @@ var routes = {
     operationId: "listConversations",
     description: "Returns all conversations the caller has access to. If projectId is provided, returns only conversations in that project. project keys are scoped to a single project automatically.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "actor_id", "limit", "offset"],
     flags: [{
@@ -1684,6 +1827,7 @@ var routes = {
     operationId: "createConversation",
     description: "Creates a new conversation. project keys automatically infer the project from the key's scope; JWT callers must supply projectId.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -1717,6 +1861,7 @@ var routes = {
     operationId: "getConversation",
     description: "Returns a conversation by its ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "get",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1732,6 +1877,7 @@ var routes = {
     operationId: "updateConversation",
     description: "Updates the status of a conversation",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "patch",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1759,6 +1905,7 @@ var routes = {
     operationId: "deleteConversation",
     description: "Deletes a conversation by its ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "delete",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1774,6 +1921,7 @@ var routes = {
     operationId: "listConversationMessages",
     description: "Returns all messages (documents) attached to a conversation, ordered by position",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "get",
     pathParams: ["conversation_id"],
     queryParams: ["limit", "offset"],
     flags: [{
@@ -1801,6 +1949,7 @@ var routes = {
     operationId: "addConversationMessage",
     description: "Creates a document from the message text and attaches it to the conversation at the given position. If position is omitted, it is appended at the end.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "post",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1846,6 +1995,7 @@ var routes = {
     operationId: "generateConversationMessage",
     description: "Generates the next message using the specified actor's linked agent or chat. On `completed`, the reply is persisted as a new ConversationMessage authored by that actor. On `requires_action`, nothing is persisted; the caller must submit tool outputs via the Agents module and re-invoke generate.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "post",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1885,6 +2035,7 @@ var routes = {
     operationId: "removeConversationMessage",
     description: "Removes a document from a conversation",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "delete",
     pathParams: ["conversation_id", "document_id"],
     queryParams: [],
     flags: [{
@@ -1906,6 +2057,7 @@ var routes = {
     operationId: "getConversationTags",
     description: "Returns all tags attached to the conversation",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "get",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1921,6 +2073,7 @@ var routes = {
     operationId: "replaceConversationTags",
     description: "Replaces all tags on the conversation with the provided tags",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "put",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1936,6 +2089,7 @@ var routes = {
     operationId: "mergeConversationTags",
     description: "Merges provided tags with existing tags",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/conversations",
+    httpMethod: "patch",
     pathParams: ["conversation_id"],
     queryParams: [],
     flags: [{
@@ -1951,6 +2105,7 @@ var routes = {
     operationId: "listDiscussions",
     description: "Returns all discussions the caller has access to. If project_id is provided, returns only discussions in that project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -1978,6 +2133,7 @@ var routes = {
     operationId: "createDiscussion",
     description: "Creates a new discussion config. project keys infer the project from the key's scope; JWT callers must supply project_id.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2041,6 +2197,7 @@ var routes = {
     operationId: "getDiscussionRun",
     description: "Returns a single discussion run, including its outcome, transcript conversation, and outcome document.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "get",
     pathParams: ["run_id"],
     queryParams: [],
     flags: [{
@@ -2056,6 +2213,7 @@ var routes = {
     operationId: "getDiscussion",
     description: "Returns a discussion config with its participants.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "get",
     pathParams: ["discussion_id"],
     queryParams: [],
     flags: [{
@@ -2071,6 +2229,7 @@ var routes = {
     operationId: "updateDiscussion",
     description: "Updates a discussion. Providing participants replaces the full set (not merged).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "patch",
     pathParams: ["discussion_id"],
     queryParams: [],
     flags: [{
@@ -2134,6 +2293,7 @@ var routes = {
     operationId: "deleteDiscussion",
     description: "Deletes a discussion config and its participants.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "delete",
     pathParams: ["discussion_id"],
     queryParams: [],
     flags: [{
@@ -2149,6 +2309,7 @@ var routes = {
     operationId: "listDiscussionRuns",
     description: "Returns the run history of a discussion, most recent first.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "get",
     pathParams: ["discussion_id"],
     queryParams: ["limit", "offset"],
     flags: [{
@@ -2176,6 +2337,7 @@ var routes = {
     operationId: "createDiscussionRun",
     description: "Runs the discussion synchronously over the given topic and returns the completed run, whose outcome inlines the synthesized text. The run's transcript is persisted as a conversation and the outcome as a document.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/discussions",
+    httpMethod: "post",
     pathParams: ["discussion_id"],
     queryParams: [],
     flags: [{
@@ -2197,6 +2359,7 @@ var routes = {
     operationId: "listDocuments",
     description: "Returns all documents the caller has access to. If projectId is provided, returns only documents in that project. project keys are scoped to a single project automatically. JWT users without projectId receive documents across all their accessible projects.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -2224,6 +2387,7 @@ var routes = {
     operationId: "createDocument",
     description: "Creates a new text document and generates an embedding vector for semantic search. project keys automatically infer the project from the key's scope; JWT callers must supply projectId.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2293,6 +2457,7 @@ var routes = {
     operationId: "ingestDocument",
     description: "Parses an already-uploaded file and creates one Document split into one or more embedded chunks. The source format is detected from the file's content type: PDFs are parsed page-by-page; `text/plain` and `text/markdown` files are read as a single source. How the source is chunked is controlled by `chunk_strategy`.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "post",
     pathParams: [],
     queryParams: ["async"],
     flags: [{
@@ -2350,6 +2515,7 @@ var routes = {
     operationId: "getDocument",
     description: "Returns a document with its text content",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "get",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2365,6 +2531,7 @@ var routes = {
     operationId: "updateDocument",
     description: "Updates document content, title, path, metadata, or tags. Supplying `path` moves the document to a new logical path within the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "patch",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2410,6 +2577,7 @@ var routes = {
     operationId: "deleteDocument",
     description: "Deletes a document and its underlying file",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "delete",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2425,6 +2593,7 @@ var routes = {
     operationId: "getDocumentStatus",
     description: "Returns a lightweight ingestion status payload for polling — `status`, `chunk_count`, `total_pages`, and (when failed) `error`. Unlike `GET /documents/{document_id}`, it never returns the assembled chunk content, so it is cheap to poll on large documents. A document whose ingestion has stalled (no progress past the configured timeout) is transitioned to `failed` with `error=INGESTION_TIMEOUT` on read.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "get",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2440,6 +2609,7 @@ var routes = {
     operationId: "reingestDocument",
     description: "Re-runs ingestion for an existing document against its already-stored source file. Existing chunks are discarded and the document is reset to `status=pending` before re-processing. Use this to recover a document stuck in `processing`/`failed` or to re-chunk with a different strategy without re-uploading the file. Async by default (`202`); pass `?async=false` to run synchronously (`201`).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "post",
     pathParams: ["document_id"],
     queryParams: ["async"],
     flags: [{
@@ -2479,6 +2649,7 @@ var routes = {
     operationId: "completeIngestionCallback",
     description: "Token-authed callback for a tool converter that deferred conversion by returning `{ \"status\": \"pending\" }` (see the Ingestion Rules module docs). Not IAM-gated — the external converter is not a SOAT principal, so it authenticates with the single-use token minted for this document and ingestion attempt (delivered as `callback.token` / embedded in `callback.url` in the original converter invocation). Accepted only while the document is still awaiting that exact attempt; rejected with `409` if the attempt already completed, timed out, or was superseded by a re-ingest.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "post",
     pathParams: ["document_id"],
     queryParams: ["token"],
     flags: [{
@@ -2512,6 +2683,7 @@ var routes = {
     operationId: "getDocumentTags",
     description: "Returns all tags attached to the document",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "get",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2527,6 +2699,7 @@ var routes = {
     operationId: "replaceDocumentTags",
     description: "Replaces all tags on the document with the provided tags (not merged)",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "put",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2542,6 +2715,7 @@ var routes = {
     operationId: "mergeDocumentTags",
     description: "Merges provided tags with existing tags (existing tags are preserved unless overridden)",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/documents",
+    httpMethod: "patch",
     pathParams: ["document_id"],
     queryParams: [],
     flags: [{
@@ -2557,6 +2731,7 @@ var routes = {
     operationId: "createEmbeddings",
     description: "Generates embedding vectors for one or more text inputs using the server's configured embedding model. Provide `input` for a single text or `inputs` for a batch. At least one is required. Returns `embedding` when `input` is used, and `embeddings` when `inputs` is used.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/embeddings",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2573,11 +2748,100 @@ var routes = {
       "in": "body"
     }]
   },
+  "list-exceptions": {
+    serviceClass: "Exceptions",
+    operationId: "listExceptions",
+    description: "Returns exception items for a project, filterable by status, severity, and kind.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/exceptions",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id", "status", "severity", "kind"],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "status",
+      "description": "Filter by triage status",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "severity",
+      "description": "Filter by severity",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "kind",
+      "description": "Filter by how the exception was filed",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }]
+  },
+  "get-exception": {
+    serviceClass: "Exceptions",
+    operationId: "getException",
+    description: "Returns a single exception item with its full detail.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/exceptions",
+    httpMethod: "get",
+    pathParams: ["exception_id"],
+    queryParams: [],
+    flags: [{
+      "name": "exception_id",
+      "description": "Exception item ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "acknowledge-exception": {
+    serviceClass: "Exceptions",
+    operationId: "acknowledgeException",
+    description: "Moves the item to `acknowledged` (\"someone is on it\"), recording who. A no-op that returns the item unchanged when already acknowledged; rejected when already resolved.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/exceptions",
+    httpMethod: "post",
+    pathParams: ["exception_id"],
+    queryParams: [],
+    flags: [{
+      "name": "exception_id",
+      "description": "Exception item ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "resolve-exception": {
+    serviceClass: "Exceptions",
+    operationId: "resolveException",
+    description: "Moves the item to `resolved` (\"fixed\"), recording who and an optional note.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/exceptions",
+    httpMethod: "post",
+    pathParams: ["exception_id"],
+    queryParams: [],
+    flags: [{
+      "name": "exception_id",
+      "description": "Exception item ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "note",
+      "description": "Optional resolution note",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
   "list-files": {
     serviceClass: "Files",
     operationId: "listFiles",
     description: "Returns a list of all stored files",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -2605,6 +2869,7 @@ var routes = {
     operationId: "createFile",
     description: "Creates a new file record in the system",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2650,6 +2915,7 @@ var routes = {
     operationId: "uploadFile",
     description: "Uploads a file to the server and stores it in the configured storage directory",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: []
@@ -2659,6 +2925,7 @@ var routes = {
     operationId: "uploadFileBase64",
     description: "Uploads a file to the server using base64-encoded content",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2704,6 +2971,7 @@ var routes = {
     operationId: "createPresignedUrl",
     description: "Creates a short-lived, single-use presigned upload URL — the local-storage equivalent of an S3 presigned URL. The client then uploads the file content directly to the returned `upload_url` via `POST /api/v1/files/upload/{token}`, bypassing MCP payload size limits. When the server is configured with `SOAT_BASE_URL`, `upload_url` is a fully-qualified absolute URL so MCP agents and other clients can POST to it without knowing the server base URL in advance.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2737,6 +3005,7 @@ var routes = {
     operationId: "uploadFileWithToken",
     description: "Uploads file content authorized by a single-use token from `POST /api/v1/files/presigned-url`. No bearer credential is required — the token is the credential. Accepts either multipart/form-data (field `file`) or JSON with a base64-encoded `content` field.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "post",
     pathParams: ["token"],
     queryParams: [],
     flags: [{
@@ -2776,6 +3045,7 @@ var routes = {
     operationId: "getFile",
     description: "Returns the data and metadata of a specific file",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "get",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2791,6 +3061,7 @@ var routes = {
     operationId: "deleteFile",
     description: "Removes a file from the system by ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "delete",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2806,6 +3077,7 @@ var routes = {
     operationId: "downloadFile",
     description: "Streams the file content to the client",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "get",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2821,6 +3093,7 @@ var routes = {
     operationId: "updateFileMetadata",
     description: "Updates the metadata field of a file",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "patch",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2854,6 +3127,7 @@ var routes = {
     operationId: "downloadFileBase64",
     description: "Returns the file content encoded as base64",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "get",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2869,6 +3143,7 @@ var routes = {
     operationId: "getFileTags",
     description: "Returns all tags attached to the file",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "get",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2884,6 +3159,7 @@ var routes = {
     operationId: "replaceFileTags",
     description: "Replaces all tags on the file with the provided tags",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "put",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2899,6 +3175,7 @@ var routes = {
     operationId: "mergeFileTags",
     description: "Merges provided tags with existing tags",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/files",
+    httpMethod: "patch",
     pathParams: ["file_id"],
     queryParams: [],
     flags: [{
@@ -2914,6 +3191,7 @@ var routes = {
     operationId: "validateFormation",
     description: "Validates a formation template without creating any resources. Returns a list of errors and warnings. Accepts the template as a JSON object or as a YAML/JSON string.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2935,6 +3213,7 @@ var routes = {
     operationId: "planFormation",
     description: "Computes a diff between the desired template and the current stack state without making any changes. Returns the list of planned actions.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -2968,6 +3247,7 @@ var routes = {
     operationId: "listFormations",
     description: "Returns all formation stacks for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -2983,6 +3263,7 @@ var routes = {
     operationId: "createFormation",
     description: "Validates the template, creates the formation record, then provisions all declared resources in dependency order.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3022,6 +3303,7 @@ var routes = {
     operationId: "getFormation",
     description: "Returns the formation stack including its current resources.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "get",
     pathParams: ["formation_id"],
     queryParams: [],
     flags: [{
@@ -3037,6 +3319,7 @@ var routes = {
     operationId: "updateFormation",
     description: "Applies a new template to the formation. Resources are created, updated, or deleted to reconcile the current state with the desired state.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "put",
     pathParams: ["formation_id"],
     queryParams: [],
     flags: [{
@@ -3070,6 +3353,7 @@ var routes = {
     operationId: "deleteFormation",
     description: "Deletes the formation stack and all its managed resources in reverse dependency order.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "delete",
     pathParams: ["formation_id"],
     queryParams: [],
     flags: [{
@@ -3085,6 +3369,7 @@ var routes = {
     operationId: "listFormationEvents",
     description: "Returns all operations (create, update, delete) with their event logs for the formation, ordered chronologically.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/formations",
+    httpMethod: "get",
     pathParams: ["formation_id"],
     queryParams: [],
     flags: [{
@@ -3100,6 +3385,7 @@ var routes = {
     operationId: "listGenerations",
     description: "Returns generations the caller can access, optionally filtered by agent, trace, and status. Replaces the former per-trace generations endpoint (use the trace_id query filter).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/generations",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["agent_id", "trace_id", "initiator_generation_id", "status", "limit", "offset"],
     flags: [{
@@ -3145,6 +3431,7 @@ var routes = {
     operationId: "getGeneration",
     description: "Returns a single generation record by ID, including its status and the structured `error` payload when the generation failed (e.g. because the upstream AI provider returned an error).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/generations",
+    httpMethod: "get",
     pathParams: ["generation_id"],
     queryParams: [],
     flags: [{
@@ -3160,6 +3447,7 @@ var routes = {
     operationId: "updateGeneration",
     description: "Attaches caller-supplied key/value metadata to a generation record for per-run audit attribution (e.g. recording which knowledge-corpus version produced an AI action). The provided keys are shallow-merged over the existing metadata, so repeated patches accumulate and system-owned keys are preserved. Reserved keys (`action_id`, `trigger_id`, `run_id`, `node_id`, `extraction`, and internal recovery state) cannot be set and are rejected with 400.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/generations",
+    httpMethod: "patch",
     pathParams: ["generation_id"],
     queryParams: [],
     flags: [{
@@ -3176,11 +3464,208 @@ var routes = {
       "in": "body"
     }]
   },
+  "list-guardrails": {
+    serviceClass: "Guardrails",
+    operationId: "listGuardrails",
+    description: "Returns all guardrails in the project.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id"],
+    flags: [{
+      "name": "project_id",
+      "description": "Project public ID to filter by",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }]
+  },
+  "create-guardrail": {
+    serviceClass: "Guardrails",
+    operationId: "createGuardrail",
+    description: "Creates a new guardrail in the project. The `document` is validated on write: `class` must be a literal (A/B/C/D) or a JSON Logic expression, and every variable it (and `guard`) reference must resolve to the `args.*` / `context.*` / `soat.*` namespaces — an out-of-catalog `soat.*` key is rejected with 400.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "post",
+    pathParams: [],
+    queryParams: [],
+    flags: [{
+      "name": "project_id",
+      "description": "Public ID of the project",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "name",
+      "description": "Human-readable name",
+      "required": true,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "description",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "document",
+      "description": "The action-class document. `class` maps a call to an action class; `guard` gates class-B autonomy. Both are single JSON Logic expressions over the `args.*` / `context.*` / `soat.*` namespaces.\n",
+      "required": true,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "context_tool_id",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "context_mode",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
+  "get-guardrail": {
+    serviceClass: "Guardrails",
+    operationId: "getGuardrail",
+    description: "Returns a single guardrail by ID.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "get",
+    pathParams: ["guardrail_id"],
+    queryParams: [],
+    flags: [{
+      "name": "guardrail_id",
+      "description": "",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "update-guardrail": {
+    serviceClass: "Guardrails",
+    operationId: "updateGuardrail",
+    description: "Updates an existing guardrail. A `document` write increments `version` and archives the prior document as a GuardrailVersion; metadata-only edits (name / description / context) leave the version untouched.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "patch",
+    pathParams: ["guardrail_id"],
+    queryParams: [],
+    flags: [{
+      "name": "guardrail_id",
+      "description": "",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "name",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "description",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "document",
+      "description": "The action-class document. `class` maps a call to an action class; `guard` gates class-B autonomy. Both are single JSON Logic expressions over the `args.*` / `context.*` / `soat.*` namespaces.\n",
+      "required": false,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "context_tool_id",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "context_mode",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
+  "delete-guardrail": {
+    serviceClass: "Guardrails",
+    operationId: "deleteGuardrail",
+    description: "Deletes a guardrail and its archived versions by ID.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "delete",
+    pathParams: ["guardrail_id"],
+    queryParams: [],
+    flags: [{
+      "name": "guardrail_id",
+      "description": "",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "get-guardrail-version": {
+    serviceClass: "Guardrails",
+    operationId: "getGuardrailVersion",
+    description: "Returns the exact `document` that governed at a given version. Approval items, activity entries, and exceptions record the version that governed them, so the audit chain survives edits.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "get",
+    pathParams: ["guardrail_id", "version"],
+    queryParams: [],
+    flags: [{
+      "name": "guardrail_id",
+      "description": "",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "version",
+      "description": "",
+      "required": true,
+      "type": "integer",
+      "in": "path"
+    }]
+  },
+  "evaluate-guardrail": {
+    serviceClass: "Guardrails",
+    operationId: "evaluateGuardrail",
+    description: "Runs the full evaluation pipeline — the `class` expression, the guard, the context tool per `context_mode`, live `soat.*` resolution — against caller-supplied `args` and `guardrail_context`, and returns the exact `guardrail_evaluation` record a real call would produce. Nothing executes, no approval item is filed, and no activity entry is written. This is the adoption path: preview a document's decisions against production-shaped calls before attaching it — or before editing a widely-attached one. Pass an optional `tool_id` to resolve `soat.tool.*`.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/guardrails",
+    httpMethod: "post",
+    pathParams: ["guardrail_id"],
+    queryParams: [],
+    flags: [{
+      "name": "guardrail_id",
+      "description": "",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "args",
+      "description": "The proposed call's arguments (the `args.*` namespace).",
+      "required": false,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "guardrail_context",
+      "description": "The caller-supplied guardrail context (the `context.*` namespace), combined with the context tool per `context_mode`.\n",
+      "required": false,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "tool_id",
+      "description": "Optional tool to resolve `soat.tool.*` against.",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
   "list-ingestion-rules": {
     serviceClass: "IngestionRules",
     operationId: "listIngestionRules",
     description: "Returns the ingestion rules for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ingestion-rules",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -3208,6 +3693,7 @@ var routes = {
     operationId: "createIngestionRule",
     description: "Creates a rule mapping a content_type glob to a converter. Exactly one of tool_id or agent_id must be set.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ingestion-rules",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3289,6 +3775,7 @@ var routes = {
     operationId: "getIngestionRule",
     description: "Returns a specific ingestion rule",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ingestion-rules",
+    httpMethod: "get",
     pathParams: ["ingestion_rule_id"],
     queryParams: [],
     flags: [{
@@ -3304,6 +3791,7 @@ var routes = {
     operationId: "updateIngestionRule",
     description: "Updates fields of an ingestion rule",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ingestion-rules",
+    httpMethod: "patch",
     pathParams: ["ingestion_rule_id"],
     queryParams: [],
     flags: [{
@@ -3385,6 +3873,7 @@ var routes = {
     operationId: "deleteIngestionRule",
     description: "Deletes an ingestion rule",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/ingestion-rules",
+    httpMethod: "delete",
     pathParams: ["ingestion_rule_id"],
     queryParams: [],
     flags: [{
@@ -3400,6 +3889,7 @@ var routes = {
     operationId: "searchKnowledge",
     description: "Searches across documents and memory entries using semantic search, file paths, document IDs, or memory IDs/tags. At least one of `query`, `document_paths`, `document_ids`, `memory_ids`, or `memory_tags` must be provided.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/knowledge",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3457,6 +3947,7 @@ var routes = {
     operationId: "listMemories",
     description: "Returns a list of memory configurations for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memories",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "tags"],
     flags: [{
@@ -3478,6 +3969,7 @@ var routes = {
     operationId: "createMemory",
     description: "Creates a new memory configuration in a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memories",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3511,6 +4003,7 @@ var routes = {
     operationId: "getMemory",
     description: "Returns a single memory configuration by ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memories",
+    httpMethod: "get",
     pathParams: ["memory_id"],
     queryParams: [],
     flags: [{
@@ -3526,6 +4019,7 @@ var routes = {
     operationId: "updateMemory",
     description: "Updates an existing memory configuration",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memories",
+    httpMethod: "put",
     pathParams: ["memory_id"],
     queryParams: [],
     flags: [{
@@ -3559,6 +4053,7 @@ var routes = {
     operationId: "deleteMemory",
     description: "Deletes a memory configuration",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memories",
+    httpMethod: "delete",
     pathParams: ["memory_id"],
     queryParams: [],
     flags: [{
@@ -3574,6 +4069,7 @@ var routes = {
     operationId: "listMemoryEntries",
     description: "Returns all entries in a memory container",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memoryEntries",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["memory_id"],
     flags: [{
@@ -3589,6 +4085,7 @@ var routes = {
     operationId: "createMemoryEntry",
     description: "Creates a new entry in the specified memory container. Automatically generates an embedding for semantic search.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memoryEntries",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3640,6 +4137,7 @@ var routes = {
     operationId: "getMemoryEntry",
     description: "Returns a single memory entry by ID",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memoryEntries",
+    httpMethod: "get",
     pathParams: ["entry_id"],
     queryParams: [],
     flags: [{
@@ -3655,6 +4153,7 @@ var routes = {
     operationId: "updateMemoryEntry",
     description: "Updates an existing memory entry. Regenerates the embedding if content changes.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memoryEntries",
+    httpMethod: "put",
     pathParams: ["entry_id"],
     queryParams: [],
     flags: [{
@@ -3688,6 +4187,7 @@ var routes = {
     operationId: "deleteMemoryEntry",
     description: "Deletes a memory entry",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/memoryEntries",
+    httpMethod: "delete",
     pathParams: ["entry_id"],
     queryParams: [],
     flags: [{
@@ -3703,6 +4203,7 @@ var routes = {
     operationId: "listOrchestrations",
     description: "Returns orchestrations accessible to the caller.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -3718,6 +4219,7 @@ var routes = {
     operationId: "createOrchestration",
     description: "Creates a new orchestration (pipeline) definition in the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3769,6 +4271,7 @@ var routes = {
     operationId: "validateOrchestration",
     description: "Statically validates an orchestration graph without persisting anything. Checks that every node has its required field, node ids are unique, edges reference existing nodes, the graph is acyclic (unless it contains a loop node), and every `input_mapping` `{\"var\": \"...\"}` reference resolves to a state key written by an upstream node or seeded by `input_schema`. Returns blocking `errors` and non-blocking `warnings` (e.g. a state key only written on a conditional branch). The same `errors` checks are enforced on create and update, which fail with `400` when any error is present.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3791,11 +4294,22 @@ var routes = {
       "in": "body"
     }]
   },
+  "get-queue-stats": {
+    serviceClass: "Orchestrations",
+    operationId: "getQueueStats",
+    description: "Returns a point-in-time snapshot of the orchestration run queue: how many tasks are waiting to be claimed (`queue_depth`), how many are currently claimed with a valid lease (`claimed_tasks`), the age of the oldest waiting task, recent claim-latency percentiles over a rolling in-process window, and a per-project breakdown. Intended for admin/operator policies; guarded by `orchestrations:GetQueueStats`. A project-scoped caller sees only their own projects under `per_project`.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: [],
+    flags: []
+  },
   "get-orchestration": {
     serviceClass: "Orchestrations",
     operationId: "getOrchestration",
     description: "Returns the orchestration with nodes and edges.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "get",
     pathParams: ["orchestration_id"],
     queryParams: [],
     flags: [{
@@ -3811,6 +4325,7 @@ var routes = {
     operationId: "updateOrchestration",
     description: "Partially updates an orchestration definition.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "patch",
     pathParams: ["orchestration_id"],
     queryParams: [],
     flags: [{
@@ -3862,6 +4377,7 @@ var routes = {
     operationId: "deleteOrchestration",
     description: "Deletes an orchestration definition and all its runs.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "delete",
     pathParams: ["orchestration_id"],
     queryParams: [],
     flags: [{
@@ -3877,6 +4393,7 @@ var routes = {
     operationId: "listOrchestrationRuns",
     description: "Returns orchestration runs the caller can access, optionally filtered by orchestration.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["orchestration_id"],
     flags: [{
@@ -3892,6 +4409,7 @@ var routes = {
     operationId: "startOrchestrationRun",
     description: "Creates a new run for the orchestration named by orchestration_id. By default the run executes durably in the background: the response returns immediately with status \"running\" and progress is observed via get-orchestration-run or run lifecycle webhook events (orchestration_runs.started/awaiting_input/succeeded/failed). Delay and poll waits park the run as \"sleeping\" and are woken by a background scheduler, surviving restarts. Pass wait=true to block until the run reaches a terminal or awaiting_input state (the legacy synchronous behaviour).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -3919,6 +4437,7 @@ var routes = {
     operationId: "cancelOrchestrationRun",
     description: "Cancels a run that has not yet reached a terminal state.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "post",
     pathParams: ["run_id"],
     queryParams: [],
     flags: [{
@@ -3934,6 +4453,7 @@ var routes = {
     operationId: "submitHumanInput",
     description: "Provides human input to a run that is awaiting_input at a human node.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "post",
     pathParams: ["run_id"],
     queryParams: [],
     flags: [{
@@ -3961,6 +4481,7 @@ var routes = {
     operationId: "resumeOrchestrationRun",
     description: "Resumes an awaiting_input orchestration run from its last checkpoint.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "post",
     pathParams: ["run_id"],
     queryParams: [],
     flags: [{
@@ -3976,6 +4497,7 @@ var routes = {
     operationId: "getOrchestrationRun",
     description: "Returns the status, state, and artifacts of a specific run.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/orchestrations",
+    httpMethod: "get",
     pathParams: ["run_id"],
     queryParams: [],
     flags: [{
@@ -3991,6 +4513,7 @@ var routes = {
     operationId: "listPolicies",
     description: "Returns global policies. Requires admin role. Pass user_id to list only the policies attached to that user (replaces the former per-user policies endpoint).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/policies",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["user_id"],
     flags: [{
@@ -4006,6 +4529,7 @@ var routes = {
     operationId: "createPolicy",
     description: "Creates a new global policy. Requires admin role.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/policies",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -4033,6 +4557,7 @@ var routes = {
     operationId: "getPolicy",
     description: "Returns details of a specific policy. Requires admin role.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/policies",
+    httpMethod: "get",
     pathParams: ["policy_id"],
     queryParams: [],
     flags: [{
@@ -4048,6 +4573,7 @@ var routes = {
     operationId: "updatePolicy",
     description: "Updates an existing global policy. Requires admin role.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/policies",
+    httpMethod: "put",
     pathParams: ["policy_id"],
     queryParams: [],
     flags: [{
@@ -4081,6 +4607,7 @@ var routes = {
     operationId: "deletePolicy",
     description: "Deletes a global policy. Requires admin role.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/policies",
+    httpMethod: "delete",
     pathParams: ["policy_id"],
     queryParams: [],
     flags: [{
@@ -4096,6 +4623,7 @@ var routes = {
     operationId: "listProjects",
     description: "Lists projects accessible to the caller. - JWT admin: returns all projects. - JWT regular user: returns only projects granted by the user's policies. - API key scoped to a project: returns only that project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "get",
     pathParams: [],
     queryParams: [],
     flags: []
@@ -4105,6 +4633,7 @@ var routes = {
     operationId: "createProject",
     description: "Creates a new project. Requires admin role.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -4120,6 +4649,7 @@ var routes = {
     operationId: "getProject",
     description: "Returns details of a specific project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "get",
     pathParams: ["project_id"],
     queryParams: [],
     flags: [{
@@ -4133,8 +4663,9 @@ var routes = {
   "update-project": {
     serviceClass: "Projects",
     operationId: "updateProject",
-    description: "Updates a project's name. Requires admin role.",
+    description: "Updates a project's name and/or its attached guardrails (`guardrail_ids` — the project-scope baseline governing every tool call by every agent in the project). Requires admin role. Detaching a guardrail (removing an id) additionally requires guardrails:DetachGuardrail.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "patch",
     pathParams: ["project_id"],
     queryParams: [],
     flags: [{
@@ -4146,9 +4677,21 @@ var routes = {
     }, {
       "name": "name",
       "description": "",
-      "required": true,
+      "required": false,
       "type": "string",
       "in": "body"
+    }, {
+      "name": "guardrail_ids",
+      "description": "Guardrails attached at the project scope.",
+      "required": false,
+      "type": "array",
+      "in": "body"
+    }, {
+      "name": "max_concurrent_runs",
+      "description": "Maximum orchestration runs of this project driven at once. `null` clears the limit (unlimited); otherwise an integer >= 1. Enforced at queue claim time — excess runs stay queued until a slot frees.",
+      "required": false,
+      "type": "integer",
+      "in": "body"
     }]
   },
   "delete-project": {
@@ -4156,6 +4699,7 @@ var routes = {
     operationId: "deleteProject",
     description: "Deletes a project. Requires admin role. Fails with `409` if the project has any dependent resources (agents, ai providers, tools, conversations, chats, formations, memories, actors, webhooks, secrets, sessions, files, traces, generations, orchestrations, etc.), unless `force=true` is passed, in which case those resources are deleted along with the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "delete",
     pathParams: ["project_id"],
     queryParams: ["force"],
     flags: [{
@@ -4177,6 +4721,7 @@ var routes = {
     operationId: "getProjectPrices",
     description: "Returns the project's per-provider-slug price rows — the middle pricing tier that covers every one of the project's instances of a given provider slug. At cost time a per-provider-instance override wins over these, and these win over the global default. Authorized by the caller's access to the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "get",
     pathParams: ["project_id"],
     queryParams: [],
     flags: [{
@@ -4192,6 +4737,7 @@ var routes = {
     operationId: "updateProjectPrices",
     description: "Upserts project + provider-slug price rows, keyed on (provider, model, effective_from). A row covers all of the project's instances of that provider slug. Authorized by the caller's access to the project. `effective_from` must be in the future — past prices are immutable, so ship corrections as new future-dated rows.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
+    httpMethod: "put",
     pathParams: ["project_id"],
     queryParams: [],
     flags: [{
@@ -4208,11 +4754,140 @@ var routes = {
       "in": "body"
     }]
   },
+  "list-quotas": {
+    serviceClass: "Quotas",
+    operationId: "listQuotas",
+    description: "Returns the quotas defined in a project",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/quotas",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id"],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }]
+  },
+  "create-quota": {
+    serviceClass: "Quotas",
+    operationId: "createQuota",
+    description: "Creates a project-scoped quota. `scope: agent` with `metric: requests` and `scope: api_key` with `metric: tokens`/`cost_usd` are both rejected with 400 (no attribution exists to enforce them). A duplicate quota (same project, scope, scope_ref, metric, window) is rejected with 409.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/quotas",
+    httpMethod: "post",
+    pathParams: [],
+    queryParams: [],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "scope",
+      "description": "The scope the quota applies to",
+      "required": true,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "scope_ref",
+      "description": "Public id of the api key / agent the quota applies to. NULL means all entities of that scope type in the project.",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "metric",
+      "description": "The metric being capped",
+      "required": true,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "window",
+      "description": "The window over which the metric is aggregated",
+      "required": true,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "limit",
+      "description": "The cap. Must be a positive integer for requests/tokens; fractional values are allowed for cost_usd.",
+      "required": true,
+      "type": "number",
+      "in": "body"
+    }, {
+      "name": "mode",
+      "description": "enforce blocks with 429 (requests at the middleware, tokens/cost_usd at the pre-generation check); monitor is a pass-through no-op until the webhook phase ships.",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
+  "get-quota": {
+    serviceClass: "Quotas",
+    operationId: "getQuota",
+    description: "Returns a specific quota, including current window usage",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/quotas",
+    httpMethod: "get",
+    pathParams: ["quota_id"],
+    queryParams: [],
+    flags: [{
+      "name": "quota_id",
+      "description": "Quota ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "update-quota": {
+    serviceClass: "Quotas",
+    operationId: "updateQuota",
+    description: "Updates a quota's limit and/or mode. Other fields are immutable.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/quotas",
+    httpMethod: "patch",
+    pathParams: ["quota_id"],
+    queryParams: [],
+    flags: [{
+      "name": "quota_id",
+      "description": "Quota ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "limit",
+      "description": "New limit",
+      "required": false,
+      "type": "number",
+      "in": "body"
+    }, {
+      "name": "mode",
+      "description": "New mode",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
+  "delete-quota": {
+    serviceClass: "Quotas",
+    operationId: "deleteQuota",
+    description: "Deletes a quota and drops its window counters",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/quotas",
+    httpMethod: "delete",
+    pathParams: ["quota_id"],
+    queryParams: [],
+    flags: [{
+      "name": "quota_id",
+      "description": "Quota ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
   "list-secrets": {
     serviceClass: "Secrets",
     operationId: "listSecrets",
     description: "Returns a list of secrets for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/secrets",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -4240,6 +4915,7 @@ var routes = {
     operationId: "createSecret",
     description: "Creates a new encrypted secret in a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/secrets",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -4267,6 +4943,7 @@ var routes = {
     operationId: "getSecret",
     description: "Returns a specific secret",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/secrets",
+    httpMethod: "get",
     pathParams: ["secret_id"],
     queryParams: [],
     flags: [{
@@ -4282,6 +4959,7 @@ var routes = {
     operationId: "updateSecret",
     description: "Updates a secret's name and/or value",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/secrets",
+    httpMethod: "patch",
     pathParams: ["secret_id"],
     queryParams: [],
     flags: [{
@@ -4309,6 +4987,7 @@ var routes = {
     operationId: "deleteSecret",
     description: "Deletes a secret",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/secrets",
+    httpMethod: "delete",
     pathParams: ["secret_id"],
     queryParams: [],
     flags: [{
@@ -4324,6 +5003,7 @@ var routes = {
     operationId: "listSessions",
     description: "Returns sessions the caller can access, optionally filtered by agent, actor and status.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["agent_id", "actor_id", "status", "limit", "offset"],
     flags: [{
@@ -4363,6 +5043,7 @@ var routes = {
     operationId: "createSession",
     description: "Creates a new session for the specified agent. Internally creates a conversation and two actors (agent + user) so the caller only needs this single call to start interacting with the agent.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -4414,6 +5095,7 @@ var routes = {
     operationId: "getSession",
     description: "Returns details of a single session.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "get",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4429,6 +5111,7 @@ var routes = {
     operationId: "updateSession",
     description: "Updates the session name and/or status.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "patch",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4480,6 +5163,7 @@ var routes = {
     operationId: "deleteSession",
     description: "Deletes the session and its underlying conversation and messages. The session's actor is not deleted. Generations and traces produced by the session are not deleted either, since they are not linked to the session or conversation.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "delete",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4495,6 +5179,7 @@ var routes = {
     operationId: "addSessionMessage",
     description: "Saves a user message to the session. When autoGenerate is enabled on the session and no generation is currently in progress, generation is triggered automatically and the response mirrors GenerateSessionResponse. Otherwise returns the saved user message.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "post",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4534,6 +5219,7 @@ var routes = {
     operationId: "generateSessionResponse",
     description: "Triggers the agent to generate a response based on the current conversation. Returns the assistant reply or a requires_action status if the agent needs client tool outputs. Pass ?async=true for a 202 accepted response when you do not need to wait for the result.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "post",
     pathParams: ["session_id"],
     queryParams: ["async"],
     flags: [{
@@ -4567,6 +5253,7 @@ var routes = {
     operationId: "submitSessionToolOutputs",
     description: "Submits client tool outputs for a generation that returned requires_action. The agent continues its loop and returns the final or next requires_action result.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "post",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4594,6 +5281,7 @@ var routes = {
     operationId: "getSessionTags",
     description: "Returns the session's tags object.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "get",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4609,6 +5297,7 @@ var routes = {
     operationId: "replaceSessionTags",
     description: "Replaces all tags on the session.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "put",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4624,6 +5313,7 @@ var routes = {
     operationId: "mergeSessionTags",
     description: "Merges the provided tags into the session's existing tags.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/sessions",
+    httpMethod: "patch",
     pathParams: ["session_id"],
     queryParams: [],
     flags: [{
@@ -4639,6 +5329,7 @@ var routes = {
     operationId: "listTasks",
     description: "Lists tasks (the board query). Filter by workflow, state, status, or assignee — `GET /tasks?workflow_id=...&state=...` is one board column.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "workflow_id", "state", "status", "assignee"],
     flags: [{
@@ -4678,6 +5369,7 @@ var routes = {
     operationId: "createTask",
     description: "Creates a task bound to a workflow. The task is placed in the workflow's initial state and that state's `on_enter` automation fires.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -4717,6 +5409,7 @@ var routes = {
     operationId: "getTask",
     description: "Retrieves a task, including its active dispatch and automation status.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "get",
     pathParams: ["task_id"],
     queryParams: [],
     flags: [{
@@ -4732,6 +5425,7 @@ var routes = {
     operationId: "updateTask",
     description: "Updates a task's payload, title, or assignee. `state` is never directly writable — move it with a transition; sending a `state` field is rejected as an unknown field (`VALIDATION_FAILED`). `payload` is shallow-merged over the existing payload (PATCH semantics): keys the request omits are preserved, so setting one field never discards values an on_enter automation wrote (e.g. `last_result`). The merged payload is validated against the workflow's `payload_schema`.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "patch",
     pathParams: ["task_id"],
     queryParams: [],
     flags: [{
@@ -4765,6 +5459,7 @@ var routes = {
     operationId: "deleteTask",
     description: "Deletes a task. Its transition history cascades.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "delete",
     pathParams: ["task_id"],
     queryParams: [],
     flags: [{
@@ -4780,6 +5475,7 @@ var routes = {
     operationId: "transitionTask",
     description: "Fires a named transition on a task. The transition must exist in the workflow and be valid from the task's current state; its guard must pass. This is the single path every state change routes through. A transition declaring `requires_approval` does not move the task — it parks a pending ApprovalItem and returns the task with `pending_transition` set; the move applies only when the approval is approved.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "post",
     pathParams: ["task_id"],
     queryParams: [],
     flags: [{
@@ -4807,6 +5503,7 @@ var routes = {
     operationId: "getTaskHistory",
     description: "Returns the append-only transition history of a task.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tasks",
+    httpMethod: "get",
     pathParams: ["task_id"],
     queryParams: [],
     flags: [{
@@ -4822,6 +5519,7 @@ var routes = {
     operationId: "listTools",
     description: "Returns all tools in the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -4837,6 +5535,7 @@ var routes = {
     operationId: "createTool",
     description: "Creates a new tool in the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -4917,6 +5616,12 @@ var routes = {
       "required": false,
       "type": "object",
       "in": "body"
+    }, {
+      "name": "guardrail_ids",
+      "description": "Guardrails attached at the tool scope.",
+      "required": false,
+      "type": "array",
+      "in": "body"
     }]
   },
   "get-tool": {
@@ -4924,6 +5629,7 @@ var routes = {
     operationId: "getTool",
     description: "Returns a single tool by ID.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
+    httpMethod: "get",
     pathParams: ["tool_id"],
     queryParams: [],
     flags: [{
@@ -4939,6 +5645,7 @@ var routes = {
     operationId: "updateTool",
     description: "Updates an existing tool.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
+    httpMethod: "patch",
     pathParams: ["tool_id"],
     queryParams: [],
     flags: [{
@@ -5019,6 +5726,12 @@ var routes = {
       "required": false,
       "type": "object",
       "in": "body"
+    }, {
+      "name": "guardrail_ids",
+      "description": "Guardrails attached at the tool scope.",
+      "required": false,
+      "type": "array",
+      "in": "body"
     }]
   },
   "delete-tool": {
@@ -5026,6 +5739,7 @@ var routes = {
     operationId: "deleteTool",
     description: "Deletes a tool by ID.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
+    httpMethod: "delete",
     pathParams: ["tool_id"],
     queryParams: [],
     flags: [{
@@ -5041,6 +5755,7 @@ var routes = {
     operationId: "callTool",
     description: "Directly invokes a tool and returns its output. Supported for `http`, `soat`, `mcp`, and `pipeline` tools. `client` tools cannot be invoked server-side and will return 422. A `pipeline` tool runs its declared steps in order and returns the mapped `output` (or the last step's output); `action` is ignored and `input` is the pipeline input. For `soat` and `mcp` tools the `action` field is required and identifies which action (SOAT) or tool name (MCP) to invoke. For `http` tools `action` is ignored. When a `soat` or `mcp` tool declares an `actions` allowlist, an action outside it is rejected with `400 VALIDATION_FAILED` (\"not available on this tool\") before any outbound request is made. `preset_parameters` stored on the tool are merged with the caller-supplied `input` before execution; preset keys take lower precedence.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
+    httpMethod: "post",
     pathParams: ["tool_id"],
     queryParams: [],
     flags: [{
@@ -5068,6 +5783,7 @@ var routes = {
     operationId: "listTraces",
     description: "Returns a paginated list of execution traces for the project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/traces",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "limit", "offset"],
     flags: [{
@@ -5095,6 +5811,7 @@ var routes = {
     operationId: "getTrace",
     description: "Returns a single trace by ID.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/traces",
+    httpMethod: "get",
     pathParams: ["trace_id"],
     queryParams: [],
     flags: [{
@@ -5110,6 +5827,7 @@ var routes = {
     operationId: "getTraceTree",
     description: "Returns the full execution tree rooted at the given trace (or its root if the given trace is a child). Each node represents one agent's execution session. The `children` array contains traces triggered by sub-agent tool calls from that trace.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/traces",
+    httpMethod: "get",
     pathParams: ["trace_id"],
     queryParams: ["include"],
     flags: [{
@@ -5131,6 +5849,7 @@ var routes = {
     operationId: "listTriggers",
     description: "Lists triggers. Filter by project, starter type, or target type.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "type", "target_type"],
     flags: [{
@@ -5158,6 +5877,7 @@ var routes = {
     operationId: "createTrigger",
     description: "Creates a new trigger for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5233,6 +5953,7 @@ var routes = {
     operationId: "getTrigger",
     description: "Retrieves the details of a specific trigger",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "get",
     pathParams: ["trigger_id"],
     queryParams: [],
     flags: [{
@@ -5248,6 +5969,7 @@ var routes = {
     operationId: "updateTrigger",
     description: "Updates an existing trigger's configuration. The type is immutable.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "patch",
     pathParams: ["trigger_id"],
     queryParams: [],
     flags: [{
@@ -5317,6 +6039,7 @@ var routes = {
     operationId: "deleteTrigger",
     description: "Deletes a trigger",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "delete",
     pathParams: ["trigger_id"],
     queryParams: [],
     flags: [{
@@ -5332,6 +6055,7 @@ var routes = {
     operationId: "fireTrigger",
     description: "Fires a trigger synchronously and returns the terminal firing record.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "post",
     pathParams: ["trigger_id"],
     queryParams: [],
     flags: [{
@@ -5353,6 +6077,7 @@ var routes = {
     operationId: "getTriggerSecret",
     description: "Retrieves the signing secret for a webhook trigger",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "get",
     pathParams: ["trigger_id"],
     queryParams: [],
     flags: [{
@@ -5368,6 +6093,7 @@ var routes = {
     operationId: "rotateTriggerSecret",
     description: "Rotates the signing secret for a webhook trigger",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "post",
     pathParams: ["trigger_id"],
     queryParams: [],
     flags: [{
@@ -5383,6 +6109,7 @@ var routes = {
     operationId: "listTriggerFirings",
     description: "Lists firings for a trigger (trigger_id is required).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["trigger_id", "limit", "offset"],
     flags: [{
@@ -5410,6 +6137,7 @@ var routes = {
     operationId: "getTriggerFiring",
     description: "Retrieves the details of a specific trigger firing",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/triggers",
+    httpMethod: "get",
     pathParams: ["firing_id"],
     queryParams: [],
     flags: [{
@@ -5425,6 +6153,7 @@ var routes = {
     operationId: "listUsageMeters",
     description: "Returns the raw usage-meter rows the caller can access, most recent first, optionally filtered by agent and generation. Each row is the per-generation token usage as reported by the provider, for audit and reconciliation.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["agent_id", "generation_id", "trace_id", "trigger_id", "action_id", "meter_type", "limit", "offset"],
     flags: [{
@@ -5482,6 +6211,7 @@ var routes = {
     operationId: "getUsage",
     description: "Returns a project's usage rolled up over an optional `[from, to]` time window, bucketed by a single dimension. Each group and the grand total carry summed token counts and `cost_usd` (null when no event in the bucket was priced). This is the per-project cost-by-range/by-category query — a monthly figure without scanning raw meter rows client-side.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id", "group_by", "from", "to"],
     flags: [{
@@ -5515,6 +6245,7 @@ var routes = {
     operationId: "listUsageThresholds",
     description: "Lists the usage alert thresholds the caller can access, optionally filtered by project_id. Each threshold fires the `usage.threshold_crossed` webhook when a project's cost or token usage over a calendar-month or rolling-24h window crosses the configured value.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -5530,6 +6261,7 @@ var routes = {
     operationId: "createUsageThreshold",
     description: "Creates a usage alert threshold on a project. Thresholds are immutable apart from deletion — to change one, delete and recreate it (which resets its fire state).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5563,6 +6295,7 @@ var routes = {
     operationId: "deleteUsageThreshold",
     description: "Deletes a usage threshold, resetting its fire state. Recreating a threshold starts its once-per-window / hysteresis state fresh.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "delete",
     pathParams: ["threshold_id"],
     queryParams: [],
     flags: [{
@@ -5578,6 +6311,7 @@ var routes = {
     operationId: "getUsageReceipt",
     description: "Returns a billing receipt. Pass generation_id for a per-generation receipt, or run_id for a per-run receipt summed across the orchestration run's meters — both share the same shape (per-model line items with tokens, the price-book version that priced them, and cost, plus totals). Exactly one of generation_id or run_id must be supplied.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["generation_id", "run_id"],
     flags: [{
@@ -5599,6 +6333,7 @@ var routes = {
     operationId: "getPriceBook",
     description: "Returns the global price book — the versioned per-provider/model unit prices used to compute usage cost at write time. Readable by any authenticated user.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "get",
     pathParams: [],
     queryParams: [],
     flags: []
@@ -5608,6 +6343,7 @@ var routes = {
     operationId: "upsertPriceBook",
     description: "Upserts price rows keyed on (provider, model, effective_from). Admin only. `effective_from` must be in the future — past prices are immutable so recorded costs stay explainable; ship corrections as new future-dated rows.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/usage",
+    httpMethod: "put",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5623,6 +6359,7 @@ var routes = {
     operationId: "getCurrentUser",
     description: "Returns the profile of the currently authenticated user",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "get",
     pathParams: [],
     queryParams: [],
     flags: []
@@ -5632,6 +6369,7 @@ var routes = {
     operationId: "listUsers",
     description: "Returns a list of all users",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "get",
     pathParams: [],
     queryParams: [],
     flags: []
@@ -5641,6 +6379,7 @@ var routes = {
     operationId: "createUser",
     description: "Creates a new user in the system",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5668,6 +6407,7 @@ var routes = {
     operationId: "getUser",
     description: "Returns the data of a specific user",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "get",
     pathParams: ["user_id"],
     queryParams: [],
     flags: [{
@@ -5683,6 +6423,7 @@ var routes = {
     operationId: "deleteUser",
     description: "Deletes a specific user",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "delete",
     pathParams: ["user_id"],
     queryParams: [],
     flags: [{
@@ -5698,6 +6439,7 @@ var routes = {
     operationId: "bootstrapUser",
     description: "Creates the first admin user. Returns 409 if any user already exists.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5719,6 +6461,7 @@ var routes = {
     operationId: "loginUser",
     description: "Authenticates a user and returns a JWT token",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5740,6 +6483,7 @@ var routes = {
     operationId: "attachUserPolicies",
     description: "Replaces the user's policy list with the provided policy IDs. Requires admin role.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/users",
+    httpMethod: "put",
     pathParams: ["user_id"],
     queryParams: [],
     flags: [{
@@ -5761,6 +6505,7 @@ var routes = {
     operationId: "listWebhooks",
     description: "Lists webhooks. Use the project_id query parameter to filter by project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -5776,6 +6521,7 @@ var routes = {
     operationId: "createWebhook",
     description: "Creates a new webhook for a project",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -5821,6 +6567,7 @@ var routes = {
     operationId: "getWebhook",
     description: "Retrieves the details of a specific webhook",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "get",
     pathParams: ["webhook_id"],
     queryParams: [],
     flags: [{
@@ -5836,6 +6583,7 @@ var routes = {
     operationId: "updateWebhook",
     description: "Updates an existing webhook's configuration",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "put",
     pathParams: ["webhook_id"],
     queryParams: [],
     flags: [{
@@ -5887,6 +6635,7 @@ var routes = {
     operationId: "deleteWebhook",
     description: "Deletes a webhook and stops all event deliveries",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "delete",
     pathParams: ["webhook_id"],
     queryParams: [],
     flags: [{
@@ -5902,6 +6651,7 @@ var routes = {
     operationId: "listWebhookDeliveries",
     description: "Lists event deliveries for a webhook (webhook_id is required).",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["webhook_id", "limit", "offset"],
     flags: [{
@@ -5929,6 +6679,7 @@ var routes = {
     operationId: "getWebhookDelivery",
     description: "Retrieves the details of a specific webhook delivery",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "get",
     pathParams: ["delivery_id"],
     queryParams: [],
     flags: [{
@@ -5944,6 +6695,7 @@ var routes = {
     operationId: "getWebhookSecret",
     description: "Retrieves the signing secret for the specified webhook",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "get",
     pathParams: ["webhook_id"],
     queryParams: [],
     flags: [{
@@ -5959,6 +6711,7 @@ var routes = {
     operationId: "rotateWebhookSecret",
     description: "Rotates the secret key for the specified webhook",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/webhooks",
+    httpMethod: "post",
     pathParams: ["webhook_id"],
     queryParams: [],
     flags: [{
@@ -5974,6 +6727,7 @@ var routes = {
     operationId: "listWorkflows",
     description: "Lists workflow definitions in a project.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/workflows",
+    httpMethod: "get",
     pathParams: [],
     queryParams: ["project_id"],
     flags: [{
@@ -5989,6 +6743,7 @@ var routes = {
     operationId: "createWorkflow",
     description: "Creates a new workflow definition. The definition is statically validated.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/workflows",
+    httpMethod: "post",
     pathParams: [],
     queryParams: [],
     flags: [{
@@ -6034,6 +6789,7 @@ var routes = {
     operationId: "getWorkflow",
     description: "Retrieves a workflow definition.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/workflows",
+    httpMethod: "get",
     pathParams: ["workflow_id"],
     queryParams: [],
     flags: [{
@@ -6049,6 +6805,7 @@ var routes = {
     operationId: "updateWorkflow",
     description: "Updates a workflow definition. Structural changes (states/transitions) are re-validated. Existing tasks in a removed state stay put but can only leave via transitions valid in the new definition.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/workflows",
+    httpMethod: "patch",
     pathParams: ["workflow_id"],
     queryParams: [],
     flags: [{
@@ -6094,6 +6851,7 @@ var routes = {
     operationId: "deleteWorkflow",
     description: "Deletes a workflow. Rejected while open tasks exist.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/workflows",
+    httpMethod: "delete",
     pathParams: ["workflow_id"],
     queryParams: [],
     flags: [{
@@ -6351,7 +7109,7 @@ program.argument("[command]", "API command in kebab-case (e.g. list-actors)").ar
     const queryParam = route.queryParams.find(p => {
       return toCanonical(p) === canonical;
     });
-    if (pathParam) pathArgs[pathParam] = parsedValue;else if (queryParam) queryArgs[queryParam] = parsedValue;else bodyArgs[kebabToSnake(flagKey)] = parsedValue;
+    if (pathParam) pathArgs[pathParam] = parsedValue;else if (queryParam) queryArgs[queryParam] = parsedValue;else if (route.httpMethod === "get") queryArgs[kebabToSnake(flagKey)] = parsedValue;else bodyArgs[kebabToSnake(flagKey)] = parsedValue;
   }
   const positionalArgs = extractPositionalArgs({
     cliArgs: rawArgs