@widgetic/api-sdk 1.0.31 → 1.0.33

package/dist/esm/apis/PublicEmbedApi.d.ts

@@ -10,24 +10,63 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { PublicCompositionEntryCreated, PublicCompositionEntryRequest } from '../models/index';
+import type { GetPublicCompositionEmbed200Response, PostPublicCompositionEmbedStatus200Response, PostPublicCompositionEmbedStatusRequest, PublicCompositionEntryCreated, PublicCompositionEntryRequest } from '../models/index';
 export interface CreatePublicCompositionEntryRequest {
     compositionId: string;
     table: string;
     publicCompositionEntryRequest: PublicCompositionEntryRequest;
 }
+export interface GetPublicCompositionEmbedRequest {
+    compositionId: string;
+}
+export interface GetPublicCompositionIframeRequest {
+    compositionId: string;
+}
+export interface PostPublicCompositionEmbedStatusOperationRequest {
+    postPublicCompositionEmbedStatusRequest: PostPublicCompositionEmbedStatusRequest;
+}
 /**
  *
  */
 export declare class PublicEmbedApi extends runtime.BaseAPI {
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntryRaw(requestParameters: CreatePublicCompositionEntryRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PublicCompositionEntryCreated>>;
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntry(requestParameters: CreatePublicCompositionEntryRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PublicCompositionEntryCreated>;
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), for the widgets of that partner: a partner\'s list never has to name it. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbedRaw(requestParameters: GetPublicCompositionEmbedRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetPublicCompositionEmbed200Response>>;
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), for the widgets of that partner: a partner\'s list never has to name it. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbed(requestParameters: GetPublicCompositionEmbedRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetPublicCompositionEmbed200Response>;
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframeRaw(requestParameters: GetPublicCompositionIframeRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<string>>;
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframe(requestParameters: GetPublicCompositionIframeRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<string>;
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatusRaw(requestParameters: PostPublicCompositionEmbedStatusOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PostPublicCompositionEmbedStatus200Response>>;
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatus(requestParameters: PostPublicCompositionEmbedStatusOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PostPublicCompositionEmbedStatus200Response>;
 }

package/dist/esm/apis/PublicEmbedApi.js

@@ -21,13 +21,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import * as runtime from '../runtime.js';
-import { PublicCompositionEntryCreatedFromJSON, PublicCompositionEntryRequestToJSON, } from '../models/index.js';
+import { GetPublicCompositionEmbed200ResponseFromJSON, PostPublicCompositionEmbedStatus200ResponseFromJSON, PostPublicCompositionEmbedStatusRequestToJSON, PublicCompositionEntryCreatedFromJSON, PublicCompositionEntryRequestToJSON, } from '../models/index.js';
 /**
  *
  */
 export class PublicEmbedApi extends runtime.BaseAPI {
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntryRaw(requestParameters, initOverrides) {
@@ -55,7 +55,7 @@ export class PublicEmbedApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution but is not authenticated. Request bodies are limited to 16 KB before parsing.
+     * Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
      * Append a visitor entry through the gateway
      */
     createPublicCompositionEntry(requestParameters, initOverrides) {
@@ -64,4 +64,101 @@ export class PublicEmbedApi extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), for the widgets of that partner: a partner\'s list never has to name it. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbedRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['compositionId'] == null) {
+                throw new runtime.RequiredError('compositionId', 'Required parameter "compositionId" was null or undefined when calling getPublicCompositionEmbed().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            const response = yield this.request({
+                path: `/embed/compositions/{compositionId}`.replace(`{${"compositionId"}}`, encodeURIComponent(String(requestParameters['compositionId']))),
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => GetPublicCompositionEmbed200ResponseFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition\'s owner listed the websites it may appear on (the workspace\'s domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor\'s own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), for the widgets of that partner: a partner\'s list never has to name it. The list stops other websites from showing the embed in a visitor\'s browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header.
+     * Resolve a composition UUID to a published widget URL
+     */
+    getPublicCompositionEmbed(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.getPublicCompositionEmbedRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframeRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['compositionId'] == null) {
+                throw new runtime.RequiredError('compositionId', 'Required parameter "compositionId" was null or undefined when calling getPublicCompositionIframe().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            const response = yield this.request({
+                path: `/embed/compositions/{compositionId}/frame`.replace(`{${"compositionId"}}`, encodeURIComponent(String(requestParameters['compositionId']))),
+                method: 'GET',
+                headers: headerParameters,
+                query: queryParameters,
+            }, initOverrides);
+            if (this.isJsonMime(response.headers.get('content-type'))) {
+                return new runtime.JSONApiResponse(response);
+            }
+            else {
+                return new runtime.TextApiResponse(response);
+            }
+        });
+    }
+    /**
+     * Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition\'s owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic\'s own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+     * Embed a published composition with its saved values
+     */
+    getPublicCompositionIframe(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.getPublicCompositionIframeRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatusRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['postPublicCompositionEmbedStatusRequest'] == null) {
+                throw new runtime.RequiredError('postPublicCompositionEmbedStatusRequest', 'Required parameter "postPublicCompositionEmbedStatusRequest" was null or undefined when calling postPublicCompositionEmbedStatus().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            const response = yield this.request({
+                path: `/embed/compositions/status`,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: PostPublicCompositionEmbedStatusRequestToJSON(requestParameters['postPublicCompositionEmbedStatusRequest']),
+            }, initOverrides);
+            return new runtime.JSONApiResponse(response, (jsonValue) => PostPublicCompositionEmbedStatus200ResponseFromJSON(jsonValue));
+        });
+    }
+    /**
+     * Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller\'s website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+     * Batch-check whether compositions are currently served for embed
+     */
+    postPublicCompositionEmbedStatus(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.postPublicCompositionEmbedStatusRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
 }

package/dist/esm/apis/SubscriptionsApi.d.ts

@@ -120,12 +120,12 @@ export declare class SubscriptionsApi extends runtime.BaseAPI {
      */
     getSubscriptionsByUserId(requestParameters: GetSubscriptionsByUserIdRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<Subscription>>;
     /**
-     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Admin only.
+     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Extra storage is not a reason to refuse: the storage the subscription bills stays on it at the same price (only the seats are repriced), and the storage rows the leaving holder had are handed to the arriving one, so a team\'s packs become a person\'s and back. Admin only.
      * Move a subscription between the personal and organization surfaces
      */
     moveSubscriptionSurfaceRaw(requestParameters: MoveSubscriptionSurfaceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
     /**
-     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Admin only.
+     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Extra storage is not a reason to refuse: the storage the subscription bills stays on it at the same price (only the seats are repriced), and the storage rows the leaving holder had are handed to the arriving one, so a team\'s packs become a person\'s and back. Admin only.
      * Move a subscription between the personal and organization surfaces
      */
     moveSubscriptionSurface(requestParameters: MoveSubscriptionSurfaceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;

package/dist/esm/apis/SubscriptionsApi.js

@@ -271,7 +271,7 @@ export class SubscriptionsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Admin only.
+     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Extra storage is not a reason to refuse: the storage the subscription bills stays on it at the same price (only the seats are repriced), and the storage rows the leaving holder had are handed to the arriving one, so a team\'s packs become a person\'s and back. Admin only.
      * Move a subscription between the personal and organization surfaces
      */
     moveSubscriptionSurfaceRaw(requestParameters, initOverrides) {
@@ -306,7 +306,7 @@ export class SubscriptionsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Admin only.
+     * Rewrites the subscription onto the target surface: the scope columns and the plan are updated together, the Stripe subscription is repriced to the target plan first (so a refusal changes nothing), the source plan\'s entitlements and the allowance it granted are retired, and the target plan\'s are granted — for an organization target, to each of its billable members. Extra storage is not a reason to refuse: the storage the subscription bills stays on it at the same price (only the seats are repriced), and the storage rows the leaving holder had are handed to the arriving one, so a team\'s packs become a person\'s and back. Admin only.
      * Move a subscription between the personal and organization surfaces
      */
     moveSubscriptionSurface(requestParameters, initOverrides) {

package/dist/esm/apis/UploadsApi.d.ts

@@ -77,22 +77,22 @@ export declare class UploadsApi extends runtime.BaseAPI {
      */
     uploadsLimitsGet(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<UploadLimits>;
     /**
-     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the account\'s storage allowance, and a full allowance is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional. A partner\'s own uploads (with its API key) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
+     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team\'s shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store\'s session, always work in that team\'s shared storage. A personal API key or an SDK token always uses the account\'s own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  When the full storage is a Shopify store\'s team\'s, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person\'s own workspace, get the shorter message.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner\'s own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
      * Upload a file
      */
     uploadsPostRaw(requestParameters: UploadsPost0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Upload>>;
     /**
-     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the account\'s storage allowance, and a full allowance is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional. A partner\'s own uploads (with its API key) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
+     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team\'s shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store\'s session, always work in that team\'s shared storage. A personal API key or an SDK token always uses the account\'s own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  When the full storage is a Shopify store\'s team\'s, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person\'s own workspace, get the shorter message.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner\'s own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
      * Upload a file
      */
     uploadsPost(requestParameters: UploadsPost0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Upload>;
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  The upload is for the workspace the person was working in when it was declared: inside a team, the team\'s shared storage; inside their own workspace, their own allowance (a Shopify store\'s session always works in the store\'s team). Declaring it checks that the file fits that space right now (a team\'s space never borrows from the person\'s own, nor the other way round), and the workspace is kept with the upload. A person who has left the team by the time the file is stored gets it stored in their own space instead, never the team\'s.  This call stores the finished file: it counts against the storage of that workspace only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused, not yet activated or behind on a payment cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`, `PARTNER_PAYMENT_ARREARS`).  An account that administers a partner keeps the finished file in the partner\'s own storage destination (`setPartnerStorageDestination`), never in Widgetic\'s: the pieces wait in Widgetic\'s temporary storage and are removed when this call has written the file to the partner\'s bucket, and the file takes none of the allowance (declaring it checks no room for it either). A partner with no destination cannot start a resumable upload (the declaring `POST /uploads/tus` answers 409 with a line of text, before a byte is sent), and one that removed it since cannot complete one (`PARTNER_STORAGE_REQUIRED`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePostRaw(requestParameters: UploadsTusIdCompletePostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Upload>>;
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  The upload is for the workspace the person was working in when it was declared: inside a team, the team\'s shared storage; inside their own workspace, their own allowance (a Shopify store\'s session always works in the store\'s team). Declaring it checks that the file fits that space right now (a team\'s space never borrows from the person\'s own, nor the other way round), and the workspace is kept with the upload. A person who has left the team by the time the file is stored gets it stored in their own space instead, never the team\'s.  This call stores the finished file: it counts against the storage of that workspace only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused, not yet activated or behind on a payment cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`, `PARTNER_PAYMENT_ARREARS`).  An account that administers a partner keeps the finished file in the partner\'s own storage destination (`setPartnerStorageDestination`), never in Widgetic\'s: the pieces wait in Widgetic\'s temporary storage and are removed when this call has written the file to the partner\'s bucket, and the file takes none of the allowance (declaring it checks no room for it either). A partner with no destination cannot start a resumable upload (the declaring `POST /uploads/tus` answers 409 with a line of text, before a byte is sent), and one that removed it since cannot complete one (`PARTNER_STORAGE_REQUIRED`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePost(requestParameters: UploadsTusIdCompletePostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Upload>;

package/dist/esm/apis/UploadsApi.js

@@ -178,7 +178,7 @@ export class UploadsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the account\'s storage allowance, and a full allowance is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional. A partner\'s own uploads (with its API key) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
+     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team\'s shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store\'s session, always work in that team\'s shared storage. A personal API key or an SDK token always uses the account\'s own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  When the full storage is a Shopify store\'s team\'s, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person\'s own workspace, get the shorter message.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner\'s own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
      * Upload a file
      */
     uploadsPostRaw(requestParameters, initOverrides) {
@@ -236,7 +236,7 @@ export class UploadsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the account\'s storage allowance, and a full allowance is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional. A partner\'s own uploads (with its API key) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
+     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team\'s shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store\'s session, always work in that team\'s shared storage. A personal API key or an SDK token always uses the account\'s own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  When the full storage is a Shopify store\'s team\'s, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person\'s own workspace, get the shorter message.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner\'s own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
      * Upload a file
      */
     uploadsPost(requestParameters, initOverrides) {
@@ -246,7 +246,7 @@ export class UploadsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  The upload is for the workspace the person was working in when it was declared: inside a team, the team\'s shared storage; inside their own workspace, their own allowance (a Shopify store\'s session always works in the store\'s team). Declaring it checks that the file fits that space right now (a team\'s space never borrows from the person\'s own, nor the other way round), and the workspace is kept with the upload. A person who has left the team by the time the file is stored gets it stored in their own space instead, never the team\'s.  This call stores the finished file: it counts against the storage of that workspace only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused, not yet activated or behind on a payment cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`, `PARTNER_PAYMENT_ARREARS`).  An account that administers a partner keeps the finished file in the partner\'s own storage destination (`setPartnerStorageDestination`), never in Widgetic\'s: the pieces wait in Widgetic\'s temporary storage and are removed when this call has written the file to the partner\'s bucket, and the file takes none of the allowance (declaring it checks no room for it either). A partner with no destination cannot start a resumable upload (the declaring `POST /uploads/tus` answers 409 with a line of text, before a byte is sent), and one that removed it since cannot complete one (`PARTNER_STORAGE_REQUIRED`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePostRaw(requestParameters, initOverrides) {
@@ -266,7 +266,7 @@ export class UploadsApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  This call stores the finished file: it counts against the account\'s storage allowance only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused or not yet activated cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`).
+     * Resumable uploads carry a file of up to 250 MB (the limit `tus_max_bytes` of `uploadsLimitsGet`, the same for every account) in pieces that can be resumed after a dropped connection, or after the server was restarted: the pieces wait in shared storage, not on one server. They follow the [tus protocol](https://tus.io): `POST /uploads/tus` declares the file (`Upload-Length` and the `Upload-Metadata` keys `filename`, `filetype` and, optionally, `context_type`, `source`, `widget_id`, `conversation_id` and, to file the upload under one of a partner\'s managed users, `managed_user_id` or `managed_user_external_id`), `PATCH` sends the bytes, `HEAD` says how far a client got. They need a signed-in session; an API key uses `uploadsPost`.  A partner files an upload under one of its managed users with `managed_user_id` (Widgetic\'s id) or `managed_user_external_id` (the partner\'s own id for the user), never both: the same two fields, with the same spelling, as the form fields of `uploadsPost`. The managed user is looked up among the signed-in account\'s own when the upload is declared, so a wrong one is refused before any byte is sent (the declaring `POST /uploads/tus` answers 400, 404 or 409 with a line of text), and is looked up again here, when the file is stored. The stored file then carries the managed user (`managedUserId`), is found by the `managedUserId` filter of `uploadsGet`, and is counted for that user by `getPartnerStorageUsage`. Without either key the file is the account\'s own.  The upload is for the workspace the person was working in when it was declared: inside a team, the team\'s shared storage; inside their own workspace, their own allowance (a Shopify store\'s session always works in the store\'s team). Declaring it checks that the file fits that space right now (a team\'s space never borrows from the person\'s own, nor the other way round), and the workspace is kept with the upload. A person who has left the team by the time the file is stored gets it stored in their own space instead, never the team\'s.  This call stores the finished file: it counts against the storage of that workspace only now, not while the file is on its way, so an upload that is abandoned costs nothing. It is safe to call again after a lost answer: the file that was stored is returned, not stored twice. A file that could not be stored (storage down, allowance full) stays available for a day from when the upload began, so the call can be repeated without sending the file again. An unfinished upload is deleted after that day, and an account can hold only a few at once.  A partner account that is paused, not yet activated or behind on a payment cannot start a resumable upload (the declaring `POST /uploads/tus` answers 403) and cannot complete one (`PARTNER_SUSPENDED`, `PARTNER_INACTIVE`, `PARTNER_PAYMENT_ARREARS`).  An account that administers a partner keeps the finished file in the partner\'s own storage destination (`setPartnerStorageDestination`), never in Widgetic\'s: the pieces wait in Widgetic\'s temporary storage and are removed when this call has written the file to the partner\'s bucket, and the file takes none of the allowance (declaring it checks no room for it either). A partner with no destination cannot start a resumable upload (the declaring `POST /uploads/tus` answers 409 with a line of text, before a byte is sent), and one that removed it since cannot complete one (`PARTNER_STORAGE_REQUIRED`).
      * Finish a resumable upload — store the file and return it
      */
     uploadsTusIdCompletePost(requestParameters, initOverrides) {

package/dist/esm/apis/UsersApi.d.ts

@@ -57,22 +57,22 @@ export interface UsersSendFeedbackPostOperationRequest {
  */
 export declare class UsersApi extends runtime.BaseAPI {
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomainRaw(requestParameters: AddPersonalWorkspaceDomain0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PersonalWorkspaceDomainResult>>;
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomain(requestParameters: AddPersonalWorkspaceDomain0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PersonalWorkspaceDomainResult>;
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys, except a partner account, which has no limit: what a partner\'s keys do is paid for from its own credits, however many integrations it runs. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
      * Create an API key
      */
     createUserApiKeyRaw(requestParameters: CreateUserApiKey0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CreatedUserApiKey>>;
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys, except a partner account, which has no limit: what a partner\'s keys do is paid for from its own credits, however many integrations it runs. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
      * Create an API key
      */
     createUserApiKey(requestParameters: CreateUserApiKey0Request, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CreatedUserApiKey>;

package/dist/esm/apis/UsersApi.js

@@ -27,7 +27,7 @@ import { AddDomainRequestToJSON, CreateUserApiKeyRequestToJSON, CreatedUserApiKe
  */
 export class UsersApi extends runtime.BaseAPI {
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomainRaw(requestParameters, initOverrides) {
@@ -59,7 +59,7 @@ export class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomain(requestParameters, initOverrides) {
@@ -69,7 +69,7 @@ export class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys, except a partner account, which has no limit: what a partner\'s keys do is paid for from its own credits, however many integrations it runs. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
      * Create an API key
      */
     createUserApiKeyRaw(requestParameters, initOverrides) {
@@ -104,7 +104,7 @@ export class UsersApi extends runtime.BaseAPI {
         });
     }
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys, except a partner account, which has no limit: what a partner\'s keys do is paid for from its own credits, however many integrations it runs. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
      * Create an API key
      */
     createUserApiKey(requestParameters, initOverrides) {

package/dist/esm/apis/index.d.ts

@@ -3,7 +3,6 @@ export * from './AIProxyApi';
 export * from './AdminApi';
 export * from './AdminBillingApi';
 export * from './AgentApi';
-export * from './AgentRepositoryManagementApi';
 export * from './AnalyticsApi';
 export * from './AuthenticationApi';
 export * from './BatchApi';
@@ -18,7 +17,6 @@ export * from './DemoContentsApi';
 export * from './EmailApi';
 export * from './EmailProxyApi';
 export * from './EntitlementsApi';
-export * from './EnterpriseCustomizationsApi';
 export * from './FigmaProxyApi';
 export * from './FoldersApi';
 export * from './HealthApi';
@@ -45,12 +43,10 @@ export * from './SubscriptionPlansApi';
 export * from './SubscriptionsApi';
 export * from './TokensApi';
 export * from './TranslationsApi';
-export * from './UIComponentsApi';
 export * from './UploadsApi';
 export * from './UsageApi';
 export * from './UsersApi';
 export * from './WebhooksApi';
 export * from './WidgetBuilderApi';
 export * from './WidgetsApi';
-export * from './WorkflowsApi';
 export * from './WorkspacesApi';