@takaro/apiclient 0.0.0-dev.2513f9a → 0.0.0-dev.276af35

package/dist/generated-management/api.js

@@ -91,6 +91,11 @@ export const DomainOutputDTOStateEnum = {
     Disabled: 'DISABLED',
     Maintenance: 'MAINTENANCE',
 };
+export const DomainOutputDTOCustomDomainStateEnum = {
+    Pending: 'PENDING',
+    Verified: 'VERIFIED',
+    Failed: 'FAILED',
+};
 export const DomainSearchInputAllowedFiltersStateEnum = {
     Active: 'ACTIVE',
     Disabled: 'DISABLED',
@@ -100,6 +105,11 @@ export const DomainSearchInputDTOSortDirectionEnum = {
     Asc: 'asc',
     Desc: 'desc',
 };
+export const DomainStateCountDTOStateEnum = {
+    Active: 'ACTIVE',
+    Disabled: 'DISABLED',
+    Maintenance: 'MAINTENANCE',
+};
 export const DomainUpdateInputDTOStateEnum = {
     Active: 'ACTIVE',
     Disabled: 'DISABLED',
@@ -572,6 +582,16 @@ export const JobStatusOutputDTOStatusEnum = {
     Waiting: 'waiting',
     WaitingChildren: 'waiting-children',
 };
+export const ManagementDomainOutputDTOStateEnum = {
+    Active: 'ACTIVE',
+    Disabled: 'DISABLED',
+    Maintenance: 'MAINTENANCE',
+};
+export const ManagementDomainOutputDTOCustomDomainStateEnum = {
+    Pending: 'PENDING',
+    Verified: 'VERIFIED',
+    Failed: 'FAILED',
+};
 export const OrderStatusCountDTOStatusEnum = {
     Completed: 'COMPLETED',
     Paid: 'PAID',
@@ -609,6 +629,12 @@ export const PERMISSIONS = {
     SendDiscordMessage: 'SEND_DISCORD_MESSAGE',
     ManageApiKeys: 'MANAGE_API_KEYS',
 };
+export const PlanPriceDTOIntervalEnum = {
+    Day: 'day',
+    Week: 'week',
+    Month: 'month',
+    Year: 'year',
+};
 export const PlayerOnGameServerSearchInputDTOExtendEnum = {
     GameServer: 'gameServer',
     Player: 'player',
@@ -660,6 +686,45 @@ export const ShopListingBulkInputDTOActionEnum = {
     Publish: 'publish',
     Unpublish: 'unpublish',
 };
+export const ShopListingCancellationPreviewInputDTOActionEnum = {
+    Unpublish: 'unpublish',
+    Delete: 'delete',
+    Replace: 'replace',
+};
+export const ShopListingCreateDTODeliveryMethodEnum = {
+    Claim: 'claim',
+    Instant: 'instant',
+};
+export const ShopListingCreateDTOPerUserPeriodEnum = {
+    Day: 'day',
+    Week: 'week',
+    Month: 'month',
+};
+export const ShopListingCreateDTORequiredVariableOperatorEnum = {
+    Gte: 'gte',
+    Lte: 'lte',
+    Eq: 'eq',
+    Ne: 'ne',
+    Gt: 'gt',
+    Lt: 'lt',
+};
+export const ShopListingOutputDTODeliveryMethodEnum = {
+    Claim: 'claim',
+    Instant: 'instant',
+};
+export const ShopListingOutputDTOPerUserPeriodEnum = {
+    Day: 'day',
+    Week: 'week',
+    Month: 'month',
+};
+export const ShopListingOutputDTORequiredVariableOperatorEnum = {
+    Gte: 'gte',
+    Lte: 'lte',
+    Eq: 'eq',
+    Ne: 'ne',
+    Gt: 'gt',
+    Lt: 'lt',
+};
 export const ShopListingSearchInputDTOExtendEnum = {
     GameServer: 'gameServer',
     Items: 'items',
@@ -669,6 +734,23 @@ export const ShopListingSearchInputDTOSortDirectionEnum = {
     Asc: 'asc',
     Desc: 'desc',
 };
+export const ShopListingUpdateDTODeliveryMethodEnum = {
+    Claim: 'claim',
+    Instant: 'instant',
+};
+export const ShopListingUpdateDTOPerUserPeriodEnum = {
+    Day: 'day',
+    Week: 'week',
+    Month: 'month',
+};
+export const ShopListingUpdateDTORequiredVariableOperatorEnum = {
+    Gte: 'gte',
+    Lte: 'lte',
+    Eq: 'eq',
+    Ne: 'ne',
+    Gt: 'gt',
+    Lt: 'lt',
+};
 export const ShopOrderOutputDTOStatusEnum = {
     Completed: 'COMPLETED',
     Paid: 'PAID',
@@ -679,6 +761,16 @@ export const ShopOrderUpdateDTOStatusEnum = {
     Paid: 'PAID',
     Canceled: 'CANCELED',
 };
+export const StaffMeOutputDTOTierEnum = {
+    Viewer: 'viewer',
+    Operator: 'operator',
+    Owner: 'owner',
+};
+export const StorefrontDomainOutputDTOCustomDomainStateEnum = {
+    Pending: 'PENDING',
+    Verified: 'VERIFIED',
+    Failed: 'FAILED',
+};
 export const TakaroEventPlayerInventoryChangedChangeTypeEnum = {
     Added: 'added',
     Removed: 'removed',
@@ -727,6 +819,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -755,6 +848,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -788,6 +882,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -800,41 +895,6 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
-        /**
-         * Clears the domain’s distributor attribution and its Plan reference, removes the domain’s Distributor Service Account, and leaves the domain on the self-service path. Both ids are taken so the domain’s distributor is explicit in the URL; a mismatched or unattributed pair is a 404 rather than confirming another distributor’s domain, which also makes a second detach a 404. The domain’s limits, users, roles, game servers and server registration token are left exactly as they are — app-api’s half of the hand-off is this state, and no Stripe object is created or cancelled here.<br> OperationId: `DistributorControllerDetachDomain`
-         * @summary Detach a domain from a distributor
-         * @param {string} id
-         * @param {string} domainId
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        distributorControllerDetachDomain: async (id, domainId, options = {}) => {
-            // verify required parameter 'id' is not null or undefined
-            assertParamExists('distributorControllerDetachDomain', 'id', id);
-            // verify required parameter 'domainId' is not null or undefined
-            assertParamExists('distributorControllerDetachDomain', 'domainId', domainId);
-            const localVarPath = `/distributor/{id}/domain/{domainId}`
-                .replace(`{${'id'}}`, encodeURIComponent(String(id)))
-                .replace(`{${'domainId'}}`, encodeURIComponent(String(domainId)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication adminAuth required
-            await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
-            setSearchParams(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            return {
-                url: toPathString(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
         /**
          * Idempotent: disabling an already-disabled distributor succeeds and returns the unchanged row. There is no delete verb — a distributor is disabled so the attribution its domains carry stays resolvable.<br> OperationId: `DistributorControllerDisable`
          * @summary Disable a distributor
@@ -855,6 +915,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -885,6 +946,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -915,6 +977,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -950,6 +1013,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -978,6 +1042,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -990,6 +1055,40 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Returns the distributor’s keys as METADATA ONLY: name, prefix, suffix, status, created and last-used. The secret is returned once at creation and can never be read back — no route on this API returns it or its hash a second time. A revoked key stays listed as REVOKED for 30 days, which is how a revocation stays visible. The distributor is taken from the path, never from the body; an unknown id is a 404.<br> OperationId: `DistributorControllerSearchKeys`
+         * @summary Search a distributor’s keys
+         * @param {string} id
+         * @param {DistributorKeySearchInputDTO} [distributorKeySearchInputDTO] DistributorKeySearchInputDTO
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        distributorControllerSearchKeys: async (id, distributorKeySearchInputDTO, options = {}) => {
+            // verify required parameter 'id' is not null or undefined
+            assertParamExists('distributorControllerSearchKeys', 'id', id);
+            const localVarPath = `/distributor/{id}/key/search`.replace(`{${'id'}}`, encodeURIComponent(String(id)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication staffSession required
+            // authentication adminAuth required
+            await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            localVarRequestOptions.data = serializeDataIfNeeded(distributorKeySearchInputDTO, localVarRequestOptions, configuration);
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * <br> OperationId: `DistributorControllerUpdate`
          * @summary Update
@@ -1011,6 +1110,7 @@ export const DistributorApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -1073,20 +1173,6 @@ export const DistributorApiFp = function (configuration) {
             const localVarOperationServerBasePath = operationServerMap['DistributorApi.distributorControllerCreateKey']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
-        /**
-         * Clears the domain’s distributor attribution and its Plan reference, removes the domain’s Distributor Service Account, and leaves the domain on the self-service path. Both ids are taken so the domain’s distributor is explicit in the URL; a mismatched or unattributed pair is a 404 rather than confirming another distributor’s domain, which also makes a second detach a 404. The domain’s limits, users, roles, game servers and server registration token are left exactly as they are — app-api’s half of the hand-off is this state, and no Stripe object is created or cancelled here.<br> OperationId: `DistributorControllerDetachDomain`
-         * @summary Detach a domain from a distributor
-         * @param {string} id
-         * @param {string} domainId
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async distributorControllerDetachDomain(id, domainId, options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.distributorControllerDetachDomain(id, domainId, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = operationServerMap['DistributorApi.distributorControllerDetachDomain']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
         /**
          * Idempotent: disabling an already-disabled distributor succeeds and returns the unchanged row. There is no delete verb — a distributor is disabled so the attribution its domains carry stays resolvable.<br> OperationId: `DistributorControllerDisable`
          * @summary Disable a distributor
@@ -1153,6 +1239,20 @@ export const DistributorApiFp = function (configuration) {
             const localVarOperationServerBasePath = operationServerMap['DistributorApi.distributorControllerSearch']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Returns the distributor’s keys as METADATA ONLY: name, prefix, suffix, status, created and last-used. The secret is returned once at creation and can never be read back — no route on this API returns it or its hash a second time. A revoked key stays listed as REVOKED for 30 days, which is how a revocation stays visible. The distributor is taken from the path, never from the body; an unknown id is a 404.<br> OperationId: `DistributorControllerSearchKeys`
+         * @summary Search a distributor’s keys
+         * @param {string} id
+         * @param {DistributorKeySearchInputDTO} [distributorKeySearchInputDTO] DistributorKeySearchInputDTO
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async distributorControllerSearchKeys(id, distributorKeySearchInputDTO, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.distributorControllerSearchKeys(id, distributorKeySearchInputDTO, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['DistributorApi.distributorControllerSearchKeys']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * <br> OperationId: `DistributorControllerUpdate`
          * @summary Update
@@ -1214,19 +1314,6 @@ export const DistributorApiFactory = function (configuration, basePath, axios) {
                 .distributorControllerCreateKey(id, distributorKeyCreateInputDTO, options)
                 .then((request) => request(axios, basePath));
         },
-        /**
-         * Clears the domain’s distributor attribution and its Plan reference, removes the domain’s Distributor Service Account, and leaves the domain on the self-service path. Both ids are taken so the domain’s distributor is explicit in the URL; a mismatched or unattributed pair is a 404 rather than confirming another distributor’s domain, which also makes a second detach a 404. The domain’s limits, users, roles, game servers and server registration token are left exactly as they are — app-api’s half of the hand-off is this state, and no Stripe object is created or cancelled here.<br> OperationId: `DistributorControllerDetachDomain`
-         * @summary Detach a domain from a distributor
-         * @param {string} id
-         * @param {string} domainId
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        distributorControllerDetachDomain(id, domainId, options) {
-            return localVarFp
-                .distributorControllerDetachDomain(id, domainId, options)
-                .then((request) => request(axios, basePath));
-        },
         /**
          * Idempotent: disabling an already-disabled distributor succeeds and returns the unchanged row. There is no delete verb — a distributor is disabled so the attribution its domains carry stays resolvable.<br> OperationId: `DistributorControllerDisable`
          * @summary Disable a distributor
@@ -1280,6 +1367,19 @@ export const DistributorApiFactory = function (configuration, basePath, axios) {
                 .distributorControllerSearch(distributorSearchInputDTO, options)
                 .then((request) => request(axios, basePath));
         },
+        /**
+         * Returns the distributor’s keys as METADATA ONLY: name, prefix, suffix, status, created and last-used. The secret is returned once at creation and can never be read back — no route on this API returns it or its hash a second time. A revoked key stays listed as REVOKED for 30 days, which is how a revocation stays visible. The distributor is taken from the path, never from the body; an unknown id is a 404.<br> OperationId: `DistributorControllerSearchKeys`
+         * @summary Search a distributor’s keys
+         * @param {string} id
+         * @param {DistributorKeySearchInputDTO} [distributorKeySearchInputDTO] DistributorKeySearchInputDTO
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        distributorControllerSearchKeys(id, distributorKeySearchInputDTO, options) {
+            return localVarFp
+                .distributorControllerSearchKeys(id, distributorKeySearchInputDTO, options)
+                .then((request) => request(axios, basePath));
+        },
         /**
          * <br> OperationId: `DistributorControllerUpdate`
          * @summary Update
@@ -1343,20 +1443,6 @@ export class DistributorApi extends BaseAPI {
             .distributorControllerCreateKey(id, distributorKeyCreateInputDTO, options)
             .then((request) => request(this.axios, this.basePath));
     }
-    /**
-     * Clears the domain’s distributor attribution and its Plan reference, removes the domain’s Distributor Service Account, and leaves the domain on the self-service path. Both ids are taken so the domain’s distributor is explicit in the URL; a mismatched or unattributed pair is a 404 rather than confirming another distributor’s domain, which also makes a second detach a 404. The domain’s limits, users, roles, game servers and server registration token are left exactly as they are — app-api’s half of the hand-off is this state, and no Stripe object is created or cancelled here.<br> OperationId: `DistributorControllerDetachDomain`
-     * @summary Detach a domain from a distributor
-     * @param {string} id
-     * @param {string} domainId
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof DistributorApi
-     */
-    distributorControllerDetachDomain(id, domainId, options) {
-        return DistributorApiFp(this.configuration)
-            .distributorControllerDetachDomain(id, domainId, options)
-            .then((request) => request(this.axios, this.basePath));
-    }
     /**
      * Idempotent: disabling an already-disabled distributor succeeds and returns the unchanged row. There is no delete verb — a distributor is disabled so the attribution its domains carry stays resolvable.<br> OperationId: `DistributorControllerDisable`
      * @summary Disable a distributor
@@ -1423,6 +1509,20 @@ export class DistributorApi extends BaseAPI {
             .distributorControllerSearch(distributorSearchInputDTO, options)
             .then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Returns the distributor’s keys as METADATA ONLY: name, prefix, suffix, status, created and last-used. The secret is returned once at creation and can never be read back — no route on this API returns it or its hash a second time. A revoked key stays listed as REVOKED for 30 days, which is how a revocation stays visible. The distributor is taken from the path, never from the body; an unknown id is a 404.<br> OperationId: `DistributorControllerSearchKeys`
+     * @summary Search a distributor’s keys
+     * @param {string} id
+     * @param {DistributorKeySearchInputDTO} [distributorKeySearchInputDTO] DistributorKeySearchInputDTO
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof DistributorApi
+     */
+    distributorControllerSearchKeys(id, distributorKeySearchInputDTO, options) {
+        return DistributorApiFp(this.configuration)
+            .distributorControllerSearchKeys(id, distributorKeySearchInputDTO, options)
+            .then((request) => request(this.axios, this.basePath));
+    }
     /**
      * <br> OperationId: `DistributorControllerUpdate`
      * @summary Update
@@ -2259,6 +2359,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2272,7 +2373,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. roleIds is passed through as-is and every id must name a role in this domain; omit it to mint a powerless key. Attribution is limited: the admin secret is a single shared identity, so the key records the domain\'s system root user as its creator and cannot name the individual staff caller.<br> OperationId: `DomainControllerCreateApiKey`
+         * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. Every id in roleIds must name a role in this domain; omit roleIds to mint a powerless key. Only an Owner may grant the domain’s `root` role. From a Staff session the key records the domain’s `Takaro staff` service account as its creator and the event meta names the individual staff member by subject id. With the shared admin secret the key records the domain\'s system root user and names no individual.<br> OperationId: `DomainControllerCreateApiKey`
          * @summary Mint a Domain Key for a domain
          * @param {string} id
          * @param {DomainApiKeyCreateInputDTO} [domainApiKeyCreateInputDTO] DomainApiKeyCreateInputDTO
@@ -2292,6 +2393,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2305,7 +2407,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. roleIds is passed through as-is; omit it to grant no extra roles (plain member). Attribution is limited: the admin secret is a single shared identity; this event records that staff acted on the domain but cannot name the individual.<br> OperationId: `DomainControllerCreateInviteLink`
+         * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. Every id in roleIds must name a role in this domain; omit roleIds to grant no extra roles (plain member). Only an Owner may grant the domain’s `root` role. From a Staff session the link is attributed to the domain’s `Takaro staff` service account and the event meta names the individual staff member by subject id. With the shared admin secret attribution stays limited to \"some staff member\".<br> OperationId: `DomainControllerCreateInviteLink`
          * @summary Create staff-recovery invite link for a domain
          * @param {string} id
          * @param {InviteLinkCreateInputDTO} [inviteLinkCreateInputDTO] InviteLinkCreateInputDTO
@@ -2325,6 +2427,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2357,6 +2460,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -2385,6 +2489,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2397,6 +2502,37 @@ export const DomainApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Lists the roles of the target domain, projected to id, name and system — enough to pick roles for an invite link or a Domain Key, and nothing about what a role grants. Roles that carry the root permission are listed; only an Owner may hand one out.<br> OperationId: `DomainControllerListRoles`
+         * @summary List a domain\'s roles
+         * @param {string} id
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        domainControllerListRoles: async (id, options = {}) => {
+            // verify required parameter 'id' is not null or undefined
+            assertParamExists('domainControllerListRoles', 'id', id);
+            const localVarPath = `/domain/{id}/roles`.replace(`{${'id'}}`, encodeURIComponent(String(id)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication staffSession required
+            // authentication adminAuth required
+            await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * <br> OperationId: `DomainControllerRemove`
          * @summary Remove
@@ -2418,6 +2554,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             if (hardDelete !== undefined) {
@@ -2451,6 +2588,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2481,6 +2619,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2494,7 +2633,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: `POST /domain/search` deliberately does not expose `planId`. Never returns a subscription-backed domain.<br> OperationId: `DomainControllerSearchDistributorBacked`
+         * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: it never returns a subscription-backed domain, which is what makes it a reconciler sweep rather than a domain listing.<br> OperationId: `DomainControllerSearchDistributorBacked`
          * @summary Search distributor-backed domains
          * @param {DistributorBackedDomainSearchInputDTO} [distributorBackedDomainSearchInputDTO] DistributorBackedDomainSearchInputDTO
          * @param {*} [options] Override http request option.
@@ -2511,6 +2650,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2544,6 +2684,7 @@ export const DomainApiAxiosParamCreator = function (configuration) {
             const localVarRequestOptions = { method: 'PUT', ...baseOptions, ...options };
             const localVarHeaderParameter = {};
             const localVarQueryParameter = {};
+            // authentication staffSession required
             // authentication adminAuth required
             await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -2579,7 +2720,7 @@ export const DomainApiFp = function (configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. roleIds is passed through as-is and every id must name a role in this domain; omit it to mint a powerless key. Attribution is limited: the admin secret is a single shared identity, so the key records the domain\'s system root user as its creator and cannot name the individual staff caller.<br> OperationId: `DomainControllerCreateApiKey`
+         * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. Every id in roleIds must name a role in this domain; omit roleIds to mint a powerless key. Only an Owner may grant the domain’s `root` role. From a Staff session the key records the domain’s `Takaro staff` service account as its creator and the event meta names the individual staff member by subject id. With the shared admin secret the key records the domain\'s system root user and names no individual.<br> OperationId: `DomainControllerCreateApiKey`
          * @summary Mint a Domain Key for a domain
          * @param {string} id
          * @param {DomainApiKeyCreateInputDTO} [domainApiKeyCreateInputDTO] DomainApiKeyCreateInputDTO
@@ -2593,7 +2734,7 @@ export const DomainApiFp = function (configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. roleIds is passed through as-is; omit it to grant no extra roles (plain member). Attribution is limited: the admin secret is a single shared identity; this event records that staff acted on the domain but cannot name the individual.<br> OperationId: `DomainControllerCreateInviteLink`
+         * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. Every id in roleIds must name a role in this domain; omit roleIds to grant no extra roles (plain member). Only an Owner may grant the domain’s `root` role. From a Staff session the link is attributed to the domain’s `Takaro staff` service account and the event meta names the individual staff member by subject id. With the shared admin secret attribution stays limited to \"some staff member\".<br> OperationId: `DomainControllerCreateInviteLink`
          * @summary Create staff-recovery invite link for a domain
          * @param {string} id
          * @param {InviteLinkCreateInputDTO} [inviteLinkCreateInputDTO] InviteLinkCreateInputDTO
@@ -2632,6 +2773,19 @@ export const DomainApiFp = function (configuration) {
             const localVarOperationServerBasePath = operationServerMap['DomainApi.domainControllerGetToken']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Lists the roles of the target domain, projected to id, name and system — enough to pick roles for an invite link or a Domain Key, and nothing about what a role grants. Roles that carry the root permission are listed; only an Owner may hand one out.<br> OperationId: `DomainControllerListRoles`
+         * @summary List a domain\'s roles
+         * @param {string} id
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async domainControllerListRoles(id, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.domainControllerListRoles(id, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['DomainApi.domainControllerListRoles']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * <br> OperationId: `DomainControllerRemove`
          * @summary Remove
@@ -2673,7 +2827,7 @@ export const DomainApiFp = function (configuration) {
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: `POST /domain/search` deliberately does not expose `planId`. Never returns a subscription-backed domain.<br> OperationId: `DomainControllerSearchDistributorBacked`
+         * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: it never returns a subscription-backed domain, which is what makes it a reconciler sweep rather than a domain listing.<br> OperationId: `DomainControllerSearchDistributorBacked`
          * @summary Search distributor-backed domains
          * @param {DistributorBackedDomainSearchInputDTO} [distributorBackedDomainSearchInputDTO] DistributorBackedDomainSearchInputDTO
          * @param {*} [options] Override http request option.
@@ -2721,7 +2875,7 @@ export const DomainApiFactory = function (configuration, basePath, axios) {
                 .then((request) => request(axios, basePath));
         },
         /**
-         * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. roleIds is passed through as-is and every id must name a role in this domain; omit it to mint a powerless key. Attribution is limited: the admin secret is a single shared identity, so the key records the domain\'s system root user as its creator and cannot name the individual staff caller.<br> OperationId: `DomainControllerCreateApiKey`
+         * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. Every id in roleIds must name a role in this domain; omit roleIds to mint a powerless key. Only an Owner may grant the domain’s `root` role. From a Staff session the key records the domain’s `Takaro staff` service account as its creator and the event meta names the individual staff member by subject id. With the shared admin secret the key records the domain\'s system root user and names no individual.<br> OperationId: `DomainControllerCreateApiKey`
          * @summary Mint a Domain Key for a domain
          * @param {string} id
          * @param {DomainApiKeyCreateInputDTO} [domainApiKeyCreateInputDTO] DomainApiKeyCreateInputDTO
@@ -2734,7 +2888,7 @@ export const DomainApiFactory = function (configuration, basePath, axios) {
                 .then((request) => request(axios, basePath));
         },
         /**
-         * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. roleIds is passed through as-is; omit it to grant no extra roles (plain member). Attribution is limited: the admin secret is a single shared identity; this event records that staff acted on the domain but cannot name the individual.<br> OperationId: `DomainControllerCreateInviteLink`
+         * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. Every id in roleIds must name a role in this domain; omit roleIds to grant no extra roles (plain member). Only an Owner may grant the domain’s `root` role. From a Staff session the link is attributed to the domain’s `Takaro staff` service account and the event meta names the individual staff member by subject id. With the shared admin secret attribution stays limited to \"some staff member\".<br> OperationId: `DomainControllerCreateInviteLink`
          * @summary Create staff-recovery invite link for a domain
          * @param {string} id
          * @param {InviteLinkCreateInputDTO} [inviteLinkCreateInputDTO] InviteLinkCreateInputDTO
@@ -2766,6 +2920,16 @@ export const DomainApiFactory = function (configuration, basePath, axios) {
         domainControllerGetToken(tokenInputDTO, options) {
             return localVarFp.domainControllerGetToken(tokenInputDTO, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Lists the roles of the target domain, projected to id, name and system — enough to pick roles for an invite link or a Domain Key, and nothing about what a role grants. Roles that carry the root permission are listed; only an Owner may hand one out.<br> OperationId: `DomainControllerListRoles`
+         * @summary List a domain\'s roles
+         * @param {string} id
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        domainControllerListRoles(id, options) {
+            return localVarFp.domainControllerListRoles(id, options).then((request) => request(axios, basePath));
+        },
         /**
          * <br> OperationId: `DomainControllerRemove`
          * @summary Remove
@@ -2802,7 +2966,7 @@ export const DomainApiFactory = function (configuration, basePath, axios) {
                 .then((request) => request(axios, basePath));
         },
         /**
-         * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: `POST /domain/search` deliberately does not expose `planId`. Never returns a subscription-backed domain.<br> OperationId: `DomainControllerSearchDistributorBacked`
+         * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: it never returns a subscription-backed domain, which is what makes it a reconciler sweep rather than a domain listing.<br> OperationId: `DomainControllerSearchDistributorBacked`
          * @summary Search distributor-backed domains
          * @param {DistributorBackedDomainSearchInputDTO} [distributorBackedDomainSearchInputDTO] DistributorBackedDomainSearchInputDTO
          * @param {*} [options] Override http request option.
@@ -2849,7 +3013,7 @@ export class DomainApi extends BaseAPI {
             .then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. roleIds is passed through as-is and every id must name a role in this domain; omit it to mint a powerless key. Attribution is limited: the admin secret is a single shared identity, so the key records the domain\'s system root user as its creator and cannot name the individual staff caller.<br> OperationId: `DomainControllerCreateApiKey`
+     * Mints a Domain Key scoped to the target domain, so a non-interactive caller (domain provisioning, the billing reconciler, an end-to-end suite) can act in a freshly created domain without a human login. The `key` field is returned ONCE and is not stored on the server — Takaro keeps only a hash. Hardened for provisioning use: `kind` is forced to `domain`, the scope is forced to unrestricted, and the expiry is forced to ONE HOUR, regardless of request body values — mint a key through `POST /apikey` for anything longer-lived. Every id in roleIds must name a role in this domain; omit roleIds to mint a powerless key. Only an Owner may grant the domain’s `root` role. From a Staff session the key records the domain’s `Takaro staff` service account as its creator and the event meta names the individual staff member by subject id. With the shared admin secret the key records the domain\'s system root user and names no individual.<br> OperationId: `DomainControllerCreateApiKey`
      * @summary Mint a Domain Key for a domain
      * @param {string} id
      * @param {DomainApiKeyCreateInputDTO} [domainApiKeyCreateInputDTO] DomainApiKeyCreateInputDTO
@@ -2863,7 +3027,7 @@ export class DomainApi extends BaseAPI {
             .then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. roleIds is passed through as-is; omit it to grant no extra roles (plain member). Attribution is limited: the admin secret is a single shared identity; this event records that staff acted on the domain but cannot name the individual.<br> OperationId: `DomainControllerCreateInviteLink`
+     * Creates a staff-recovery invite link scoped to the target domain. The `token` and `inviteUrl` fields are returned ONCE and are not stored on the server — distribute securely. Hardened for recovery use: expiry is forced to 24 hours and maxUses is forced to 1, regardless of request body values. Every id in roleIds must name a role in this domain; omit roleIds to grant no extra roles (plain member). Only an Owner may grant the domain’s `root` role. From a Staff session the link is attributed to the domain’s `Takaro staff` service account and the event meta names the individual staff member by subject id. With the shared admin secret attribution stays limited to \"some staff member\".<br> OperationId: `DomainControllerCreateInviteLink`
      * @summary Create staff-recovery invite link for a domain
      * @param {string} id
      * @param {InviteLinkCreateInputDTO} [inviteLinkCreateInputDTO] InviteLinkCreateInputDTO
@@ -2902,6 +3066,19 @@ export class DomainApi extends BaseAPI {
             .domainControllerGetToken(tokenInputDTO, options)
             .then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Lists the roles of the target domain, projected to id, name and system — enough to pick roles for an invite link or a Domain Key, and nothing about what a role grants. Roles that carry the root permission are listed; only an Owner may hand one out.<br> OperationId: `DomainControllerListRoles`
+     * @summary List a domain\'s roles
+     * @param {string} id
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof DomainApi
+     */
+    domainControllerListRoles(id, options) {
+        return DomainApiFp(this.configuration)
+            .domainControllerListRoles(id, options)
+            .then((request) => request(this.axios, this.basePath));
+    }
     /**
      * <br> OperationId: `DomainControllerRemove`
      * @summary Remove
@@ -2943,7 +3120,7 @@ export class DomainApi extends BaseAPI {
             .then((request) => request(this.axios, this.basePath));
     }
     /**
-     * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: `POST /domain/search` deliberately does not expose `planId`. Never returns a subscription-backed domain.<br> OperationId: `DomainControllerSearchDistributorBacked`
+     * The domains attributed to a distributor, with the Plan their limits come from. This is the billing reconciler’s read: it never returns a subscription-backed domain, which is what makes it a reconciler sweep rather than a domain listing.<br> OperationId: `DomainControllerSearchDistributorBacked`
      * @summary Search distributor-backed domains
      * @param {DistributorBackedDomainSearchInputDTO} [distributorBackedDomainSearchInputDTO] DistributorBackedDomainSearchInputDTO
      * @param {*} [options] Override http request option.
@@ -3410,4 +3587,504 @@ export class MetaApi extends BaseAPI {
             .then((request) => request(this.axios, this.basePath));
     }
 }
+/**
+ * PlatformStatsApi - axios parameter creator
+ * @export
+ */
+export const PlatformStatsApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * Domains by state, by ADR 0024 backing, per Distributor, and created per ISO week. Weekly buckets start Monday 00:00 UTC and the window ends with the current, partial week. Cheap aggregates only: there is no game-server and no player count here.<br> OperationId: `PlatformStatsControllerDomains`
+         * @summary Platform-wide Domain statistics
+         * @param {number} [weeks]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        platformStatsControllerDomains: async (weeks, options = {}) => {
+            const localVarPath = `/staff/stats/domains`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication staffSession required
+            // authentication adminAuth required
+            await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
+            if (weeks !== undefined) {
+                localVarQueryParameter['weeks'] = weeks;
+            }
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    };
+};
+/**
+ * PlatformStatsApi - functional programming interface
+ * @export
+ */
+export const PlatformStatsApiFp = function (configuration) {
+    const localVarAxiosParamCreator = PlatformStatsApiAxiosParamCreator(configuration);
+    return {
+        /**
+         * Domains by state, by ADR 0024 backing, per Distributor, and created per ISO week. Weekly buckets start Monday 00:00 UTC and the window ends with the current, partial week. Cheap aggregates only: there is no game-server and no player count here.<br> OperationId: `PlatformStatsControllerDomains`
+         * @summary Platform-wide Domain statistics
+         * @param {number} [weeks]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async platformStatsControllerDomains(weeks, options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.platformStatsControllerDomains(weeks, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['PlatformStatsApi.platformStatsControllerDomains']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    };
+};
+/**
+ * PlatformStatsApi - factory interface
+ * @export
+ */
+export const PlatformStatsApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = PlatformStatsApiFp(configuration);
+    return {
+        /**
+         * Domains by state, by ADR 0024 backing, per Distributor, and created per ISO week. Weekly buckets start Monday 00:00 UTC and the window ends with the current, partial week. Cheap aggregates only: there is no game-server and no player count here.<br> OperationId: `PlatformStatsControllerDomains`
+         * @summary Platform-wide Domain statistics
+         * @param {number} [weeks]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        platformStatsControllerDomains(weeks, options) {
+            return localVarFp.platformStatsControllerDomains(weeks, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+/**
+ * PlatformStatsApi - object-oriented interface
+ * @export
+ * @class PlatformStatsApi
+ * @extends {BaseAPI}
+ */
+export class PlatformStatsApi extends BaseAPI {
+    /**
+     * Domains by state, by ADR 0024 backing, per Distributor, and created per ISO week. Weekly buckets start Monday 00:00 UTC and the window ends with the current, partial week. Cheap aggregates only: there is no game-server and no player count here.<br> OperationId: `PlatformStatsControllerDomains`
+     * @summary Platform-wide Domain statistics
+     * @param {number} [weeks]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof PlatformStatsApi
+     */
+    platformStatsControllerDomains(weeks, options) {
+        return PlatformStatsApiFp(this.configuration)
+            .platformStatsControllerDomains(weeks, options)
+            .then((request) => request(this.axios, this.basePath));
+    }
+}
+/**
+ * StaffAuthApi - axios parameter creator
+ * @export
+ */
+export const StaffAuthApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * <br> OperationId: `StaffAuthControllerCallback`
+         * @summary Callback
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffAuthControllerCallback: async (options = {}) => {
+            const localVarPath = `/auth/callback`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * <br> OperationId: `StaffAuthControllerLogin`
+         * @summary Login
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffAuthControllerLogin: async (options = {}) => {
+            const localVarPath = `/auth/login`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * <br> OperationId: `StaffAuthControllerLogout`
+         * @summary Logout
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffAuthControllerLogout: async (options = {}) => {
+            const localVarPath = `/auth/logout`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    };
+};
+/**
+ * StaffAuthApi - functional programming interface
+ * @export
+ */
+export const StaffAuthApiFp = function (configuration) {
+    const localVarAxiosParamCreator = StaffAuthApiAxiosParamCreator(configuration);
+    return {
+        /**
+         * <br> OperationId: `StaffAuthControllerCallback`
+         * @summary Callback
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async staffAuthControllerCallback(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.staffAuthControllerCallback(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['StaffAuthApi.staffAuthControllerCallback']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * <br> OperationId: `StaffAuthControllerLogin`
+         * @summary Login
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async staffAuthControllerLogin(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.staffAuthControllerLogin(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['StaffAuthApi.staffAuthControllerLogin']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * <br> OperationId: `StaffAuthControllerLogout`
+         * @summary Logout
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async staffAuthControllerLogout(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.staffAuthControllerLogout(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['StaffAuthApi.staffAuthControllerLogout']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    };
+};
+/**
+ * StaffAuthApi - factory interface
+ * @export
+ */
+export const StaffAuthApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = StaffAuthApiFp(configuration);
+    return {
+        /**
+         * <br> OperationId: `StaffAuthControllerCallback`
+         * @summary Callback
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffAuthControllerCallback(options) {
+            return localVarFp.staffAuthControllerCallback(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * <br> OperationId: `StaffAuthControllerLogin`
+         * @summary Login
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffAuthControllerLogin(options) {
+            return localVarFp.staffAuthControllerLogin(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * <br> OperationId: `StaffAuthControllerLogout`
+         * @summary Logout
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffAuthControllerLogout(options) {
+            return localVarFp.staffAuthControllerLogout(options).then((request) => request(axios, basePath));
+        },
+    };
+};
+/**
+ * StaffAuthApi - object-oriented interface
+ * @export
+ * @class StaffAuthApi
+ * @extends {BaseAPI}
+ */
+export class StaffAuthApi extends BaseAPI {
+    /**
+     * <br> OperationId: `StaffAuthControllerCallback`
+     * @summary Callback
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StaffAuthApi
+     */
+    staffAuthControllerCallback(options) {
+        return StaffAuthApiFp(this.configuration)
+            .staffAuthControllerCallback(options)
+            .then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * <br> OperationId: `StaffAuthControllerLogin`
+     * @summary Login
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StaffAuthApi
+     */
+    staffAuthControllerLogin(options) {
+        return StaffAuthApiFp(this.configuration)
+            .staffAuthControllerLogin(options)
+            .then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * <br> OperationId: `StaffAuthControllerLogout`
+     * @summary Logout
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StaffAuthApi
+     */
+    staffAuthControllerLogout(options) {
+        return StaffAuthApiFp(this.configuration)
+            .staffAuthControllerLogout(options)
+            .then((request) => request(this.axios, this.basePath));
+    }
+}
+/**
+ * StaffMeApi - axios parameter creator
+ * @export
+ */
+export const StaffMeApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * The signed-in Takaro Staff member and their tier (ADR 0026). Deliberately nothing else: no domains, no permissions, and never a token.<br> OperationId: `StaffMeControllerMe`
+         * @summary Who this Staff session belongs to
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffMeControllerMe: async (options = {}) => {
+            const localVarPath = `/staff/me`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication staffSession required
+            // authentication adminAuth required
+            await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    };
+};
+/**
+ * StaffMeApi - functional programming interface
+ * @export
+ */
+export const StaffMeApiFp = function (configuration) {
+    const localVarAxiosParamCreator = StaffMeApiAxiosParamCreator(configuration);
+    return {
+        /**
+         * The signed-in Takaro Staff member and their tier (ADR 0026). Deliberately nothing else: no domains, no permissions, and never a token.<br> OperationId: `StaffMeControllerMe`
+         * @summary Who this Staff session belongs to
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async staffMeControllerMe(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.staffMeControllerMe(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['StaffMeApi.staffMeControllerMe']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    };
+};
+/**
+ * StaffMeApi - factory interface
+ * @export
+ */
+export const StaffMeApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = StaffMeApiFp(configuration);
+    return {
+        /**
+         * The signed-in Takaro Staff member and their tier (ADR 0026). Deliberately nothing else: no domains, no permissions, and never a token.<br> OperationId: `StaffMeControllerMe`
+         * @summary Who this Staff session belongs to
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffMeControllerMe(options) {
+            return localVarFp.staffMeControllerMe(options).then((request) => request(axios, basePath));
+        },
+    };
+};
+/**
+ * StaffMeApi - object-oriented interface
+ * @export
+ * @class StaffMeApi
+ * @extends {BaseAPI}
+ */
+export class StaffMeApi extends BaseAPI {
+    /**
+     * The signed-in Takaro Staff member and their tier (ADR 0026). Deliberately nothing else: no domains, no permissions, and never a token.<br> OperationId: `StaffMeControllerMe`
+     * @summary Who this Staff session belongs to
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StaffMeApi
+     */
+    staffMeControllerMe(options) {
+        return StaffMeApiFp(this.configuration)
+            .staffMeControllerMe(options)
+            .then((request) => request(this.axios, this.basePath));
+    }
+}
+/**
+ * StaffPlanApi - axios parameter creator
+ * @export
+ */
+export const StaffPlanApiAxiosParamCreator = function (configuration) {
+    return {
+        /**
+         * Every Plan the billing provider knows about, unfiltered by storefront lookup keys — the ids here are exactly what a Distributor’s allowedPlans accepts. A Viewer sees no prices; Operator and Owner do.<br> OperationId: `StaffPlanControllerList`
+         * @summary The Plan catalogue
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffPlanControllerList: async (options = {}) => {
+            const localVarPath = `/staff/plans`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication staffSession required
+            // authentication adminAuth required
+            await setApiKeyToObject(localVarHeaderParameter, 'x-takaro-admin-token', configuration);
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    };
+};
+/**
+ * StaffPlanApi - functional programming interface
+ * @export
+ */
+export const StaffPlanApiFp = function (configuration) {
+    const localVarAxiosParamCreator = StaffPlanApiAxiosParamCreator(configuration);
+    return {
+        /**
+         * Every Plan the billing provider knows about, unfiltered by storefront lookup keys — the ids here are exactly what a Distributor’s allowedPlans accepts. A Viewer sees no prices; Operator and Owner do.<br> OperationId: `StaffPlanControllerList`
+         * @summary The Plan catalogue
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async staffPlanControllerList(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.staffPlanControllerList(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['StaffPlanApi.staffPlanControllerList']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    };
+};
+/**
+ * StaffPlanApi - factory interface
+ * @export
+ */
+export const StaffPlanApiFactory = function (configuration, basePath, axios) {
+    const localVarFp = StaffPlanApiFp(configuration);
+    return {
+        /**
+         * Every Plan the billing provider knows about, unfiltered by storefront lookup keys — the ids here are exactly what a Distributor’s allowedPlans accepts. A Viewer sees no prices; Operator and Owner do.<br> OperationId: `StaffPlanControllerList`
+         * @summary The Plan catalogue
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        staffPlanControllerList(options) {
+            return localVarFp.staffPlanControllerList(options).then((request) => request(axios, basePath));
+        },
+    };
+};
+/**
+ * StaffPlanApi - object-oriented interface
+ * @export
+ * @class StaffPlanApi
+ * @extends {BaseAPI}
+ */
+export class StaffPlanApi extends BaseAPI {
+    /**
+     * Every Plan the billing provider knows about, unfiltered by storefront lookup keys — the ids here are exactly what a Distributor’s allowedPlans accepts. A Viewer sees no prices; Operator and Owner do.<br> OperationId: `StaffPlanControllerList`
+     * @summary The Plan catalogue
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof StaffPlanApi
+     */
+    staffPlanControllerList(options) {
+        return StaffPlanApiFp(this.configuration)
+            .staffPlanControllerList(options)
+            .then((request) => request(this.axios, this.basePath));
+    }
+}
 //# sourceMappingURL=api.js.map