@widgetic/api-sdk 1.0.31 → 1.0.32

package/dist/esm/apis/PartnersApi.js

@@ -21,7 +21,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import * as runtime from '../runtime.js';
-import { AddPartnerCreditsRequestToJSON, ConfigureAutoReloadRequestToJSON, GetPartnerCreditBalance200ResponseFromJSON, GetPartnerDesignDefaults200ResponseFromJSON, ListPartnerPresets200ResponseFromJSON, MyPartnersFromJSON, PartnerAnalyticsByManagedUserFromJSON, PartnerAnalyticsSummaryFromJSON, PartnerAnalyticsTimelineFromJSON, PartnerAnalyticsTopWidgetsFromJSON, PartnerContractFromJSON, PartnerNotificationDeliveryFromJSON, PartnerNotificationDeliveryLogFromJSON, PartnerNotificationPageFromJSON, PartnerNotificationSettingsFromJSON, PartnerNotificationSettingsChangeFromJSON, PartnerPresetFromJSON, PartnerPresetRemovalFromJSON, PartnerStorageDestinationFromJSON, PartnerStorageRemovalFromJSON, PartnerStorageUsageFromJSON, SetPartnerDesignDefaultsRequestToJSON, SetPartnerPresetRequestToJSON, SetPartnerStorageDestinationRequestToJSON, UpdatePartnerNotificationSettingsRequestToJSON, } from '../models/index.js';
+import { AddPartnerCreditsRequestToJSON, ConfigureAutoReloadRequestToJSON, GetPartnerCreditBalance200ResponseFromJSON, GetPartnerDesignDefaults200ResponseFromJSON, ListPartnerPresets200ResponseFromJSON, MyPartnersFromJSON, PartnerAnalyticsByManagedUserFromJSON, PartnerAnalyticsSummaryFromJSON, PartnerAnalyticsTimelineFromJSON, PartnerAnalyticsTopWidgetsFromJSON, PartnerContractFromJSON, PartnerEntryContextSecretFromJSON, PartnerEntryContextSigningFromJSON, PartnerNotificationDeliveryFromJSON, PartnerNotificationDeliveryLogFromJSON, PartnerNotificationPageFromJSON, PartnerNotificationSettingsFromJSON, PartnerNotificationSettingsChangeFromJSON, PartnerNotificationTestEventRequestToJSON, PartnerNotificationTestEventResultFromJSON, PartnerPresetFromJSON, PartnerPresetRemovalFromJSON, PartnerStorageDestinationFromJSON, PartnerStorageRemovalFromJSON, PartnerStorageUsageFromJSON, SetPartnerDesignDefaultsRequestToJSON, SetPartnerPresetRequestToJSON, SetPartnerStorageDestinationRequestToJSON, UpdatePartnerEntryContextSigningRequestToJSON, UpdatePartnerNotificationSettingsRequestToJSON, } from '../models/index.js';
 /**
  *
  */
@@ -573,6 +573,43 @@ export class PartnersApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigningRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling getPartnerEntryContextSigning().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/entry-context-signing`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => PartnerEntryContextSigningFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigning(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.getPartnerEntryContextSigningRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Returns who gets the emails, which events you want by email and by webhook, the address of your webhook, and whether it has a secret to sign with. The secret itself is never returned: it is shown once, when it is made. `events` lists every kind of event there is, for a settings screen.  The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
      * Where your notifications go
@@ -930,6 +967,46 @@ export class PartnersApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecretRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling rotatePartnerEntryContextSecret().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/entry-context-signing/secret`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => PartnerEntryContextSecretFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecret(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.rotatePartnerEntryContextSecretRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Makes a new secret to sign your webhook with, and returns it in `webhookSecret`: **keep it now, it is shown once** and cannot be read again. Use it when the secret was lost, or may have leaked.  The secret you had keeps signing beside the new one for a day, so that your receiver can switch without a call being rejected: during that day each call carries two signatures (see `updatePartnerNotificationSettings` for how they are verified). Rotating again within the day ends the overlap with the first secret.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Make a new secret for your webhook
@@ -970,6 +1047,51 @@ export class PartnersApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEventRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling sendPartnerNotificationTestEvent().');
+            }
+            if (requestParameters['partnerNotificationTestEventRequest'] == null) {
+                throw new runtime.RequiredError('partnerNotificationTestEventRequest', 'Required parameter "partnerNotificationTestEventRequest" was null or undefined when calling sendPartnerNotificationTestEvent().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/notifications/test-event`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: PartnerNotificationTestEventRequestToJSON(requestParameters['partnerNotificationTestEventRequest']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => PartnerNotificationTestEventResultFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEvent(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.sendPartnerNotificationTestEventRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Send `{ \"design\": { ... } }` or `{ \"design\": null }` to remove. New compositions merge this layer over the widget base and under each managed user\'s default and the request body.
      * Set or clear partner-wide design defaults
@@ -1098,6 +1220,51 @@ export class PartnersApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigningRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['partnerId'] == null) {
+                throw new runtime.RequiredError('partnerId', 'Required parameter "partnerId" was null or undefined when calling updatePartnerEntryContextSigning().');
+            }
+            if (requestParameters['updatePartnerEntryContextSigningRequest'] == null) {
+                throw new runtime.RequiredError('updatePartnerEntryContextSigningRequest', 'Required parameter "updatePartnerEntryContextSigningRequest" was null or undefined when calling updatePartnerEntryContextSigning().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (requestParameters['idempotencyKey'] != null) {
+                headerParameters['Idempotency-Key'] = String(requestParameters['idempotencyKey']);
+            }
+            if (this.configuration && this.configuration.accessToken) {
+                const token = this.configuration.accessToken;
+                const tokenString = yield token("apiKeyAuth", []);
+                if (tokenString) {
+                    headerParameters["Authorization"] = `Bearer ${tokenString}`;
+                }
+            }
+            const response = yield this.request({
+                path: `/partners/{partnerId}/entry-context-signing`.replace(`{${"partnerId"}}`, encodeURIComponent(String(requestParameters['partnerId']))),
+                method: 'PUT',
+                headers: headerParameters,
+                query: queryParameters,
+                body: UpdatePartnerEntryContextSigningRequestToJSON(requestParameters['updatePartnerEntryContextSigningRequest']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => PartnerEntryContextSigningFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigning(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.updatePartnerEntryContextSigningRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Changes who gets the emails, which events you want by email and by webhook, and the address of your webhook. A key you leave out of the body is left as it was; send only what changes.  **Email.** `emailRecipients` is the list of addresses (at most five). While it is empty the emails about invoices go to the billing emails of your billing profile (your contact email when there are none), and the others to your contact email. The events about money and about the standing of your account are always emailed, whatever `emailEvents` says; it narrows the others.  **Webhook.** `webhookUrl` is where Widgetic sends a signed `POST` for each event, so that your own system can act on it (mark an invoice paid, warn your team that credits are low). The address must be `https` on the standard port, on a public site, and must not redirect. Setting an address when you have no secret yet makes one, and the answer carries it as `webhookSecret`: **keep it now, it is shown once**. `webhookEvents` narrows what is sent.  Each call has a JSON body, `{ \"id\": \"evt_...\", \"type\": \"invoice.paid\", \"createdAt\": \"...\", \"partnerId\": \"...\", \"data\": { ... } }` (`data` is the `data` of `PartnerNotification`), and these headers: `webhook-id` (the same as `id`, and the same on every retry), `webhook-timestamp` (seconds since 1970) and `webhook-signature` (`v1,` and a base64 HMAC-SHA256). It is the Standard Webhooks scheme, so any of its libraries verifies it. By hand: take your secret without the `whsec_` prefix, decode it from base64, and sign the text `<webhook-id>.<webhook-timestamp>.<the raw body>` with it; the header holds `v1,<base64 of the result>` (two signatures separated by a space while a rotated secret overlaps). Reject a `webhook-timestamp` that is more than five minutes old.  Answer with a 2xx status within ten seconds. Anything else is tried again, eight attempts in all over about two days (`listPartnerNotificationDeliveries` shows each). Delivery is at least once: if your answer was lost the same event arrives again with the same `id`, so drop what you have already handled by it.  Changing the settings needs an API key with full access: they decide where your notifications go. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Choose where your notifications go

package/dist/esm/apis/PublicEmbedApi.d.ts

@@ -10,24 +10,63 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { PublicCompositionEntryCreated, PublicCompositionEntryRequest } from '../models/index';
+import type { GetPublicCompositionEmbed200Response, PostPublicCompositionEmbedStatus200Response, PostPublicCompositionEmbedStatusRequest, PublicCompositionEntryCreated, PublicCompositionEntryRequest } from '../models/index';
 export interface CreatePublicCompositionEntryRequest {
     compositionId: string;
     table: string;
     publicCompositionEntryRequest: PublicCompositionEntryRequest;
 }
+export interface GetPublicCompositionEmbedRequest {
+    compositionId: string;
+}
+export interface GetPublicCompositionIframeRequest {
+    compositionId: string;
+}
+export interface PostPublicCompositionEmbedStatusOperationRequest {
+    postPublicCompositionEmbedStatusRequest: PostPublicCompositionEmbedStatusRequest;
+}
 /**
  *
  */
 export declare class PublicEmbedApi extends runtime.BaseAPI {
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntryRaw(requestParameters: CreatePublicCompositionEntryRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PublicCompositionEntryCreated>>;
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntry(requestParameters: CreatePublicCompositionEntryRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PublicCompositionEntryCreated>;
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbedRaw(requestParameters: GetPublicCompositionEmbedRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetPublicCompositionEmbed200Response>>;
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbed(requestParameters: GetPublicCompositionEmbedRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetPublicCompositionEmbed200Response>;
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframeRaw(requestParameters: GetPublicCompositionIframeRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<string>>;
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframe(requestParameters: GetPublicCompositionIframeRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<string>;
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatusRaw(requestParameters: PostPublicCompositionEmbedStatusOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PostPublicCompositionEmbedStatus200Response>>;
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatus(requestParameters: PostPublicCompositionEmbedStatusOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PostPublicCompositionEmbedStatus200Response>;
 }

package/dist/esm/apis/PublicEmbedApi.js

@@ -21,13 +21,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import * as runtime from '../runtime.js';
-import { PublicCompositionEntryCreatedFromJSON, PublicCompositionEntryRequestToJSON, } from '../models/index.js';
+import { GetPublicCompositionEmbed200ResponseFromJSON, PostPublicCompositionEmbedStatus200ResponseFromJSON, PostPublicCompositionEmbedStatusRequestToJSON, PublicCompositionEntryCreatedFromJSON, PublicCompositionEntryRequestToJSON, } from '../models/index.js';
 /**
  *
  */
 export class PublicEmbedApi extends runtime.BaseAPI {
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntryRaw(requestParameters, initOverrides) {
@@ -55,7 +55,7 @@ export class PublicEmbedApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntry(requestParameters, initOverrides) {
@@ -64,4 +64,101 @@ export class PublicEmbedApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbedRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['compositionId'] == null) {
+                throw new runtime.RequiredError('compositionId', 'Required parameter "compositionId" was null or undefined when calling getPublicCompositionEmbed().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            const response = yield this.request({
+                path: `/embed/compositions/{compositionId}`.replace(`{${"compositionId"}}`, encodeURIComponent(String(requestParameters['compositionId']))),
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => GetPublicCompositionEmbed200ResponseFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbed(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.getPublicCompositionEmbedRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframeRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['compositionId'] == null) {
+                throw new runtime.RequiredError('compositionId', 'Required parameter "compositionId" was null or undefined when calling getPublicCompositionIframe().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            const response = yield this.request({
+                path: `/embed/compositions/{compositionId}/frame`.replace(`{${"compositionId"}}`, encodeURIComponent(String(requestParameters['compositionId']))),
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            if (this.isJsonMime(response.headers.get('content-type'))) {
+                return new runtime.JSONApiResponse(response);
+            }
+            else {
+                return new runtime.TextApiResponse(response);
+            }
+        });
+    }
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframe(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.getPublicCompositionIframeRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatusRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['postPublicCompositionEmbedStatusRequest'] == null) {
+                throw new runtime.RequiredError('postPublicCompositionEmbedStatusRequest', 'Required parameter "postPublicCompositionEmbedStatusRequest" was null or undefined when calling postPublicCompositionEmbedStatus().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            const response = yield this.request({
+                path: `/embed/compositions/status`,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: PostPublicCompositionEmbedStatusRequestToJSON(requestParameters['postPublicCompositionEmbedStatusRequest']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => PostPublicCompositionEmbedStatus200ResponseFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatus(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.postPublicCompositionEmbedStatusRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
 }

package/dist/esm/apis/index.d.ts

@@ -3,7 +3,6 @@ export * from './AIProxyApi';
 export * from './AdminApi';
 export * from './AdminBillingApi';
 export * from './AgentApi';
-export * from './AgentRepositoryManagementApi';
 export * from './AnalyticsApi';
 export * from './AuthenticationApi';
 export * from './BatchApi';
@@ -18,7 +17,6 @@ export * from './DemoContentsApi';
 export * from './EmailApi';
 export * from './EmailProxyApi';
 export * from './EntitlementsApi';
-export * from './EnterpriseCustomizationsApi';
 export * from './FigmaProxyApi';
 export * from './FoldersApi';
 export * from './HealthApi';
@@ -45,12 +43,10 @@ export * from './SubscriptionPlansApi';
 export * from './SubscriptionsApi';
 export * from './TokensApi';
 export * from './TranslationsApi';
-export * from './UIComponentsApi';
 export * from './UploadsApi';
 export * from './UsageApi';
 export * from './UsersApi';
 export * from './WebhooksApi';
 export * from './WidgetBuilderApi';
 export * from './WidgetsApi';
-export * from './WorkflowsApi';
 export * from './WorkspacesApi';

package/dist/esm/apis/index.js

@@ -5,7 +5,6 @@ export * from './AIProxyApi.js';
 export * from './AdminApi.js';
 export * from './AdminBillingApi.js';
 export * from './AgentApi.js';
-export * from './AgentRepositoryManagementApi.js';
 export * from './AnalyticsApi.js';
 export * from './AuthenticationApi.js';
 export * from './BatchApi.js';
@@ -20,7 +19,6 @@ export * from './DemoContentsApi.js';
 export * from './EmailApi.js';
 export * from './EmailProxyApi.js';
 export * from './EntitlementsApi.js';
-export * from './EnterpriseCustomizationsApi.js';
 export * from './FigmaProxyApi.js';
 export * from './FoldersApi.js';
 export * from './HealthApi.js';
@@ -47,12 +45,10 @@ export * from './SubscriptionPlansApi.js';
 export * from './SubscriptionsApi.js';
 export * from './TokensApi.js';
 export * from './TranslationsApi.js';
-export * from './UIComponentsApi.js';
 export * from './UploadsApi.js';
 export * from './UsageApi.js';
 export * from './UsersApi.js';
 export * from './WebhooksApi.js';
 export * from './WidgetBuilderApi.js';
 export * from './WidgetsApi.js';
-export * from './WorkflowsApi.js';
 export * from './WorkspacesApi.js';

package/dist/esm/models/Composition.d.ts

@@ -99,6 +99,18 @@ export interface Composition {
      * @memberof Composition
      */
     managedUserId?: string | null;
+    /**
+     * Whether the widget the composition is made from is drawn straight into the page, without a frame
+     * (`true`), or inside a frame (`false`). `null` when the widget has no published version yet. It is a
+     * fact about the widget's published version, so every composition of one widget answers the same, and it
+     * changes when you publish another version. It cannot be set. Only `getCompositionById` returns it:
+     * the other calls that return a composition leave it out, and so does that one on the rare occasion the
+     * answer could not be worked out just then (ask again).
+     *
+     * @type {boolean}
+     * @memberof Composition
+     */
+    direct?: boolean | null;
 }
 /**
  * @export

package/dist/esm/models/Composition.js

@@ -63,6 +63,7 @@ export function CompositionFromJSONTyped(json, ignoreDiscriminator) {
         'databaseId': json['databaseId'] == null ? undefined : json['databaseId'],
         'projectId': json['projectId'] == null ? undefined : json['projectId'],
         'managedUserId': json['managedUserId'] == null ? undefined : json['managedUserId'],
+        'direct': json['direct'] == null ? undefined : json['direct'],
     };
 }
 export function CompositionToJSON(json) {
@@ -87,5 +88,6 @@ export function CompositionToJSONTyped(value, ignoreDiscriminator = false) {
         'databaseId': value['databaseId'],
         'projectId': value['projectId'],
         'managedUserId': value['managedUserId'],
+        'direct': value['direct'],
     };
 }

package/dist/esm/models/CompositionDataSource.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Widgetic API Gateway
+ * API documentation for the Widgetic API Gateway
+ *
+ * The version of the OpenAPI document: 1.0.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+/**
+ * The public JSON address a composition's widget reads when it loads and again every `refreshSeconds`. One
+ * per composition: binding another replaces it. It is sent as `refresh_seconds` (the request body keeps the
+ * snake case it always had) and answered as `refreshSeconds`, like every answer of the API.
+ *
+ * @export
+ * @interface CompositionDataSource
+ */
+export interface CompositionDataSource {
+    /**
+     * The https address as it was saved, after the checks (a public host, never loopback, link-local or a metadata address)
+     * @type {string}
+     * @memberof CompositionDataSource
+     */
+    url: string;
+    /**
+     * How often the widget reads the address again, in seconds
+     * @type {number}
+     * @memberof CompositionDataSource
+     */
+    refreshSeconds: number;
+}
+/**
+ * Check if a given object implements the CompositionDataSource interface.
+ */
+export declare function instanceOfCompositionDataSource(value: object): value is CompositionDataSource;
+export declare function CompositionDataSourceFromJSON(json: any): CompositionDataSource;
+export declare function CompositionDataSourceFromJSONTyped(json: any, ignoreDiscriminator: boolean): CompositionDataSource;
+export declare function CompositionDataSourceToJSON(json: any): CompositionDataSource;
+export declare function CompositionDataSourceToJSONTyped(value?: CompositionDataSource | null, ignoreDiscriminator?: boolean): any;