@widgetic/api-sdk 1.0.31 → 1.0.32

package/dist/apis/PartnerApi.js

@@ -514,6 +514,7 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
+     * Removes the binding. Asking again, or asking for a composition that had none, is not an error: the composition has no data source afterwards, and that is all `removed: true` says.
      * Remove the composition data source binding
      */
     deleteCompositionDataSourceRaw(requestParameters, initOverrides) {
@@ -539,15 +540,17 @@ class PartnerApi extends runtime.BaseAPI {
                 headers: headerParameters,
                 query: queryParameters,
             }, initOverrides);
-            return new runtime.VoidApiResponse(response);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.DeleteCompositionDataSource200ResponseFromJSON)(jsonValue));
         });
     }
     /**
+     * Removes the binding. Asking again, or asking for a composition that had none, is not an error: the composition has no data source afterwards, and that is all `removed: true` says.
      * Remove the composition data source binding
      */
     deleteCompositionDataSource(requestParameters, initOverrides) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.deleteCompositionDataSourceRaw(requestParameters, initOverrides);
+            const response = yield this.deleteCompositionDataSourceRaw(requestParameters, initOverrides);
+            return yield response.value();
         });
     }
     /**
@@ -965,7 +968,7 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Retrieves a specific composition by its ID.
+     * Retrieves a specific composition by its ID.  The answer carries `direct`, which says whether the widget the composition is made from is drawn straight into your page (`true`) or inside a frame (`false`), or `null` while the widget has no published version. Read it before you go live: a widget drawn without a frame writes its entries from your own page, so the public entry route accepts them only from a website on the composition\'s allowed list, and refuses them while that list is empty (the public JSON of the composition stays open to every website). A widget in a frame writes from Widgetic\'s own frame and is accepted whatever the list says.
      * Get Composition
      */
     getCompositionByIdRaw(requestParameters, initOverrides) {
@@ -992,7 +995,7 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Retrieves a specific composition by its ID.
+     * Retrieves a specific composition by its ID.  The answer carries `direct`, which says whether the widget the composition is made from is drawn straight into your page (`true`) or inside a frame (`false`), or `null` while the widget has no published version. Read it before you go live: a widget drawn without a frame writes its entries from your own page, so the public entry route accepts them only from a website on the composition\'s allowed list, and refuses them while that list is empty (the public JSON of the composition stays open to every website). A widget in a frame writes from Widgetic\'s own frame and is accepted whatever the list says.
      * Get Composition
      */
     getCompositionById(requestParameters, initOverrides) {
@@ -1076,6 +1079,7 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
+     * The data source that is bound to the composition: `url` and `refreshSeconds`. The answer\'s `data` is `null` when none is bound, and also when what is stored does not pass the rule for a public https address (a binding written by another path, such as the general embed-settings update, is never shown to a page unless it passes the same checks as this route).
      * Read the composition data source binding
      */
     getCompositionDataSourceRaw(requestParameters, initOverrides) {
@@ -1098,15 +1102,17 @@ class PartnerApi extends runtime.BaseAPI {
                 headers: headerParameters,
                 query: queryParameters,
             }, initOverrides);
-            return new runtime.VoidApiResponse(response);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CompositionDataSourceFromJSON)(jsonValue));
         });
     }
     /**
+     * The data source that is bound to the composition: `url` and `refreshSeconds`. The answer\'s `data` is `null` when none is bound, and also when what is stored does not pass the rule for a public https address (a binding written by another path, such as the general embed-settings update, is never shown to a page unless it passes the same checks as this route).
      * Read the composition data source binding
      */
     getCompositionDataSource(requestParameters, initOverrides) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.getCompositionDataSourceRaw(requestParameters, initOverrides);
+            const response = yield this.getCompositionDataSourceRaw(requestParameters, initOverrides);
+            return yield response.value();
         });
     }
     /**
@@ -1599,6 +1605,43 @@ class PartnerApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigningRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling getPartnerEntryContextSigning().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/entry-context-signing`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.PartnerEntryContextSigningFromJSON)(jsonValue));
+        });
+    }
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigning(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.getPartnerEntryContextSigningRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Returns who gets the emails, which events you want by email and by webhook, the address of your webhook, and whether it has a secret to sign with. The secret itself is never returned: it is shown once, when it is made. `events` lists every kind of event there is, for a settings screen.  The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
      * Where your notifications go
@@ -2256,7 +2299,7 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups, 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
+     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists. - **`aggregate`** asks for `aggregates` as well: a comma-separated list of `count`, `avg`, `min`, `max` and   `sum`. `avg`, `min`, `max` and `sum` need `column`, a numeric column of the table. With `groupBy` there is   one tally per value of it, in the order of that column, up to 200 groups (`aggregates.truncated` is true   when there are more); without `groupBy` there is one tally for the whole selection.  **`aggregates` counts a selection; the rest of the answer does not.** `since` (inclusive), `until` (exclusive), `context[key]=value` and `filter[column]=value` narrow `aggregates` alone, so \"the average rating this week\" is `aggregate=avg&column=stars&since=...`. `totalRows`, `tallies` and `rows` always describe the whole table. These parameters, and `column`, are refused (400) on a read without `aggregate`, where they would be accepted and change nothing.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups (200 in `aggregates`), 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`; to page through entries with their time, context and filters, use `listCompositionEntryItems`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
      * Read the Entries of a Composition\'s Table
      */
     readCompositionEntriesRaw(requestParameters, initOverrides) {
@@ -2310,7 +2353,7 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups, 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
+     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists. - **`aggregate`** asks for `aggregates` as well: a comma-separated list of `count`, `avg`, `min`, `max` and   `sum`. `avg`, `min`, `max` and `sum` need `column`, a numeric column of the table. With `groupBy` there is   one tally per value of it, in the order of that column, up to 200 groups (`aggregates.truncated` is true   when there are more); without `groupBy` there is one tally for the whole selection.  **`aggregates` counts a selection; the rest of the answer does not.** `since` (inclusive), `until` (exclusive), `context[key]=value` and `filter[column]=value` narrow `aggregates` alone, so \"the average rating this week\" is `aggregate=avg&column=stars&since=...`. `totalRows`, `tallies` and `rows` always describe the whole table. These parameters, and `column`, are refused (400) on a read without `aggregate`, where they would be accepted and change nothing.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups (200 in `aggregates`), 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`; to page through entries with their time, context and filters, use `listCompositionEntryItems`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
      * Read the Entries of a Composition\'s Table
      */
     readCompositionEntries(requestParameters, initOverrides) {
@@ -2439,6 +2482,46 @@ class PartnerApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecretRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling rotatePartnerEntryContextSecret().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/entry-context-signing/secret`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.PartnerEntryContextSecretFromJSON)(jsonValue));
+        });
+    }
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecret(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.rotatePartnerEntryContextSecretRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Makes a new secret to sign your webhook with, and returns it in `webhookSecret`: **keep it now, it is shown once** and cannot be read again. Use it when the secret was lost, or may have leaked.  The secret you had keeps signing beside the new one for a day, so that your receiver can switch without a call being rejected: during that day each call carries two signatures (see `updatePartnerNotificationSettings` for how they are verified). Rotating again within the day ends the overlap with the first secret.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Make a new secret for your webhook
@@ -2480,7 +2563,52 @@ class PartnerApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses).
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEventRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling sendPartnerNotificationTestEvent().');
+            }
+            if (requestParameters['partnerNotificationTestEventRequest'] == null) {
+                throw new runtime.RequiredError('partnerNotificationTestEventRequest', 'Required parameter "partnerNotificationTestEventRequest" was null or undefined when calling sendPartnerNotificationTestEvent().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/notifications/test-event`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: (0, index_1.PartnerNotificationTestEventRequestToJSON)(requestParameters['partnerNotificationTestEventRequest']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.PartnerNotificationTestEventResultFromJSON)(jsonValue));
+        });
+    }
+    /**
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEvent(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.sendPartnerNotificationTestEventRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses). A composition has one binding: saving another replaces it. The answer is the binding as it was saved (`url`, `refreshSeconds`).
      * Bind a public JSON data source for embed refresh
      */
     setCompositionDataSourceRaw(requestParameters, initOverrides) {
@@ -2511,16 +2639,17 @@ class PartnerApi extends runtime.BaseAPI {
                 query: queryParameters,
                 body: (0, index_1.SetCompositionDataSourceRequestToJSON)(requestParameters['setCompositionDataSourceRequest']),
             }, initOverrides);
-            return new runtime.VoidApiResponse(response);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.CompositionDataSourceFromJSON)(jsonValue));
         });
     }
     /**
-     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses).
+     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses). A composition has one binding: saving another replaces it. The answer is the binding as it was saved (`url`, `refreshSeconds`).
      * Bind a public JSON data source for embed refresh
      */
     setCompositionDataSource(requestParameters, initOverrides) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.setCompositionDataSourceRaw(requestParameters, initOverrides);
+            const response = yield this.setCompositionDataSourceRaw(requestParameters, initOverrides);
+            return yield response.value();
         });
     }
     /**
@@ -2871,6 +3000,51 @@ class PartnerApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigningRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling updatePartnerEntryContextSigning().');
+            }
+            if (requestParameters['updatePartnerEntryContextSigningRequest'] == null) {
+                throw new runtime.RequiredError('updatePartnerEntryContextSigningRequest', 'Required parameter "updatePartnerEntryContextSigningRequest" was null or undefined when calling updatePartnerEntryContextSigning().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/entry-context-signing`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'PUT',
+                headers: headerParameters,
+                query: queryParameters,
+                body: (0, index_1.UpdatePartnerEntryContextSigningRequestToJSON)(requestParameters['updatePartnerEntryContextSigningRequest']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.PartnerEntryContextSigningFromJSON)(jsonValue));
+        });
+    }
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigning(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.updatePartnerEntryContextSigningRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Changes who gets the emails, which events you want by email and by webhook, and the address of your webhook. A key you leave out of the body is left as it was; send only what changes.  **Email.** `emailRecipients` is the list of addresses (at most five). While it is empty the emails about invoices go to the billing emails of your billing profile (your contact email when there are none), and the others to your contact email. The events about money and about the standing of your account are always emailed, whatever `emailEvents` says; it narrows the others.  **Webhook.** `webhookUrl` is where Widgetic sends a signed `POST` for each event, so that your own system can act on it (mark an invoice paid, warn your team that credits are low). The address must be `https` on the standard port, on a public site, and must not redirect. Setting an address when you have no secret yet makes one, and the answer carries it as `webhookSecret`: **keep it now, it is shown once**. `webhookEvents` narrows what is sent.  Each call has a JSON body, `{ \"id\": \"evt_...\", \"type\": \"invoice.paid\", \"createdAt\": \"...\", \"partnerId\": \"...\", \"data\": { ... } }` (`data` is the `data` of `PartnerNotification`), and these headers: `webhook-id` (the same as `id`, and the same on every retry), `webhook-timestamp` (seconds since 1970) and `webhook-signature` (`v1,` and a base64 HMAC-SHA256). It is the Standard Webhooks scheme, so any of its libraries verifies it. By hand: take your secret without the `whsec_` prefix, decode it from base64, and sign the text `<webhook-id>.<webhook-timestamp>.<the raw body>` with it; the header holds `v1,<base64 of the result>` (two signatures separated by a space while a rotated secret overlaps). Reject a `webhook-timestamp` that is more than five minutes old.  Answer with a 2xx status within ten seconds. Anything else is tried again, eight attempts in all over about two days (`listPartnerNotificationDeliveries` shows each). Delivery is at least once: if your answer was lost the same event arrives again with the same `id`, so drop what you have already handled by it.  Changing the settings needs an API key with full access: they decide where your notifications go. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Choose where your notifications go

package/dist/apis/PartnersApi.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { AddPartnerCreditsRequest, ConfigureAutoReloadRequest, GetPartnerCreditBalance200Response, GetPartnerDesignDefaults200Response, ListPartnerPresets200Response, MyPartners, PartnerAnalyticsByManagedUser, PartnerAnalyticsSummary, PartnerAnalyticsTimeline, PartnerAnalyticsTopWidgets, PartnerContract, PartnerNotificationDelivery, PartnerNotificationDeliveryLog, PartnerNotificationPage, PartnerNotificationSettings, PartnerNotificationSettingsChange, PartnerPreset, PartnerPresetRemoval, PartnerStorageDestination, PartnerStorageRemoval, PartnerStorageUsage, SetPartnerDesignDefaultsRequest, SetPartnerPresetRequest, SetPartnerStorageDestinationRequest, UpdatePartnerNotificationSettingsRequest } from '../models/index';
+import type { AddPartnerCreditsRequest, ConfigureAutoReloadRequest, GetPartnerCreditBalance200Response, GetPartnerDesignDefaults200Response, ListPartnerPresets200Response, MyPartners, PartnerAnalyticsByManagedUser, PartnerAnalyticsSummary, PartnerAnalyticsTimeline, PartnerAnalyticsTopWidgets, PartnerContract, PartnerEntryContextSecret, PartnerEntryContextSigning, PartnerNotificationDelivery, PartnerNotificationDeliveryLog, PartnerNotificationPage, PartnerNotificationSettings, PartnerNotificationSettingsChange, PartnerNotificationTestEventRequest, PartnerNotificationTestEventResult, PartnerPreset, PartnerPresetRemoval, PartnerStorageDestination, PartnerStorageRemoval, PartnerStorageUsage, SetPartnerDesignDefaultsRequest, SetPartnerPresetRequest, SetPartnerStorageDestinationRequest, UpdatePartnerEntryContextSigningRequest, UpdatePartnerNotificationSettingsRequest } from '../models/index';
 export interface AddPartnerCreditsOperationRequest {
     partnerId: string;
     addPartnerCreditsRequest: AddPartnerCreditsRequest;
@@ -71,6 +71,9 @@ export interface GetPartnerCreditTransactionsRequest {
 export interface GetPartnerDesignDefaults0Request {
     partnerId: string;
 }
+export interface GetPartnerEntryContextSigning0Request {
+    partnerId: string;
+}
 export interface GetPartnerNotificationSettings0Request {
     partnerId: string;
 }
@@ -106,10 +109,19 @@ export interface ReplayPartnerNotificationDelivery0Request {
     deliveryId: string;
     idempotencyKey?: string;
 }
+export interface RotatePartnerEntryContextSecret0Request {
+    partnerId: string;
+    idempotencyKey?: string;
+}
 export interface RotatePartnerWebhookSecret0Request {
     partnerId: string;
     idempotencyKey?: string;
 }
+export interface SendPartnerNotificationTestEvent0Request {
+    partnerId: string;
+    partnerNotificationTestEventRequest: PartnerNotificationTestEventRequest;
+    idempotencyKey?: string;
+}
 export interface SetPartnerDesignDefaults0Request {
     partnerId: string;
     setPartnerDesignDefaultsRequest: SetPartnerDesignDefaultsRequest;
@@ -123,6 +135,11 @@ export interface SetPartnerStorageDestination0Request {
     partnerId: string;
     setPartnerStorageDestinationRequest: SetPartnerStorageDestinationRequest;
 }
+export interface UpdatePartnerEntryContextSigning0Request {
+    partnerId: string;
+    updatePartnerEntryContextSigningRequest: UpdatePartnerEntryContextSigningRequest;
+    idempotencyKey?: string;
+}
 export interface UpdatePartnerNotificationSettings0Request {
     partnerId: string;
     updatePartnerNotificationSettingsRequest: UpdatePartnerNotificationSettingsRequest;
@@ -263,6 +280,16 @@ export declare class PartnersApi extends runtime.BaseAPI {
      * Read partner-wide design defaults
      */
     getPartnerDesignDefaults(requestParameters: GetPartnerDesignDefaults0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetPartnerDesignDefaults200Response>;
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigningRaw(requestParameters: GetPartnerEntryContextSigning0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerEntryContextSigning>>;
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigning(requestParameters: GetPartnerEntryContextSigning0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerEntryContextSigning>;
     /**
      * Returns who gets the emails, which events you want by email and by webhook, the address of your webhook, and whether it has a secret to sign with. The secret itself is never returned: it is shown once, when it is made. `events` lists every kind of event there is, for a settings screen.  The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
      * Where your notifications go
@@ -353,6 +380,16 @@ export declare class PartnersApi extends runtime.BaseAPI {
      * Send a webhook delivery again
      */
     replayPartnerNotificationDelivery(requestParameters: ReplayPartnerNotificationDelivery0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerNotificationDelivery>;
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecretRaw(requestParameters: RotatePartnerEntryContextSecret0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerEntryContextSecret>>;
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecret(requestParameters: RotatePartnerEntryContextSecret0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerEntryContextSecret>;
     /**
      * Makes a new secret to sign your webhook with, and returns it in `webhookSecret`: **keep it now, it is shown once** and cannot be read again. Use it when the secret was lost, or may have leaked.  The secret you had keeps signing beside the new one for a day, so that your receiver can switch without a call being rejected: during that day each call carries two signatures (see `updatePartnerNotificationSettings` for how they are verified). Rotating again within the day ends the overlap with the first secret.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Make a new secret for your webhook
@@ -363,6 +400,16 @@ export declare class PartnersApi extends runtime.BaseAPI {
      * Make a new secret for your webhook
      */
     rotatePartnerWebhookSecret(requestParameters: RotatePartnerWebhookSecret0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerNotificationSettingsChange>;
+    /**
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEventRaw(requestParameters: SendPartnerNotificationTestEvent0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerNotificationTestEventResult>>;
+    /**
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEvent(requestParameters: SendPartnerNotificationTestEvent0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerNotificationTestEventResult>;
     /**
      * Send `{ \"design\": { ... } }` or `{ \"design\": null }` to remove. New compositions merge this layer over the widget base and under each managed user\'s default and the request body.
      * Set or clear partner-wide design defaults
@@ -393,6 +440,16 @@ export declare class PartnersApi extends runtime.BaseAPI {
      * Set where a partner\'s uploaded files are stored
      */
     setPartnerStorageDestination(requestParameters: SetPartnerStorageDestination0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerStorageDestination>;
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigningRaw(requestParameters: UpdatePartnerEntryContextSigning0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerEntryContextSigning>>;
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigning(requestParameters: UpdatePartnerEntryContextSigning0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerEntryContextSigning>;
     /**
      * Changes who gets the emails, which events you want by email and by webhook, and the address of your webhook. A key you leave out of the body is left as it was; send only what changes.  **Email.** `emailRecipients` is the list of addresses (at most five). While it is empty the emails about invoices go to the billing emails of your billing profile (your contact email when there are none), and the others to your contact email. The events about money and about the standing of your account are always emailed, whatever `emailEvents` says; it narrows the others.  **Webhook.** `webhookUrl` is where Widgetic sends a signed `POST` for each event, so that your own system can act on it (mark an invoice paid, warn your team that credits are low). The address must be `https` on the standard port, on a public site, and must not redirect. Setting an address when you have no secret yet makes one, and the answer carries it as `webhookSecret`: **keep it now, it is shown once**. `webhookEvents` narrows what is sent.  Each call has a JSON body, `{ \"id\": \"evt_...\", \"type\": \"invoice.paid\", \"createdAt\": \"...\", \"partnerId\": \"...\", \"data\": { ... } }` (`data` is the `data` of `PartnerNotification`), and these headers: `webhook-id` (the same as `id`, and the same on every retry), `webhook-timestamp` (seconds since 1970) and `webhook-signature` (`v1,` and a base64 HMAC-SHA256). It is the Standard Webhooks scheme, so any of its libraries verifies it. By hand: take your secret without the `whsec_` prefix, decode it from base64, and sign the text `<webhook-id>.<webhook-timestamp>.<the raw body>` with it; the header holds `v1,<base64 of the result>` (two signatures separated by a space while a rotated secret overlaps). Reject a `webhook-timestamp` that is more than five minutes old.  Answer with a 2xx status within ten seconds. Anything else is tried again, eight attempts in all over about two days (`listPartnerNotificationDeliveries` shows each). Delivery is at least once: if your answer was lost the same event arrives again with the same `id`, so drop what you have already handled by it.  Changing the settings needs an API key with full access: they decide where your notifications go. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Choose where your notifications go