@widgetic/api-sdk 1.0.31 → 1.0.33

package/dist/apis/PartnerApi.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { AccountCreditBalance, AddDomainRequest, CompositionEntriesDescription, CompositionEntriesReading, CompositionEntryDeleteSuccess, CompositionEntryItemsPageSuccess, CopyPartnerPresetRequest, CreateCompositionContentItemRequest, CreateCompositionFromPresetRequest, CreateCompositionFromWidget201Response, CreateCompositionFromWidgetRequest, CreateUserApiKeyRequest, CreateWidget201Response, CreatedUserApiKey, DeleteCompositionContentItem200Response, DeletePersonalWorkspaceDomain200Response, DeleteUserApiKey200Response, DuplicateComposition202Response, DuplicateCompositionRequest, GetAllCompositions200Response, GetAllManagedUsers200Response, GetCompositionContentSchema200Response, GetCompositionDesignSchema200Response, GetCompositionEmbedSchema200Response, GetInvoicesByPartnerId200Response, GetManagedUserLimits200Response, GetManagedUserStorageUsage200Response, GetManagedUsersByManagerId200Response, GetPartnerDesignDefaults200Response, GetPersonalWorkspaceDomains200Response, GetUserApiKeyUsageLogs200Response, GetUserApiKeys200Response, GetUserCreditTransactions200Response, GetWidgets200Response, ListPartnerPresets200Response, ManagedUser, ManagedUserEntriesPageSuccess, NewComposition, NewManagedUser, NewWidget, OperationsIdGet200Response, PartnerContract, PartnerNotificationDelivery, PartnerNotificationDeliveryLog, PartnerNotificationPage, PartnerNotificationSettings, PartnerNotificationSettingsChange, PartnerPreset, PartnerPresetCopy, PartnerPresetRemoval, PartnerStorageDestination, PartnerStorageRemoval, PersonalWorkspaceDomainResult, SetCompositionDataSourceRequest, SetDynamicContent200Response, SetDynamicContentRequest, SetManagedUserLimitsRequest, SetPartnerDesignDefaultsRequest, SetPartnerPresetRequest, SetPartnerStorageDestinationRequest, UpdateComposition, UpdateDomainRequest, UpdateManagedUser, UpdatePartnerNotificationSettingsRequest, UpdateUserApiKeyRequest, Upload, UploadLimits, UploadsGet200Response, UploadsIdDelete200Response, UserApiKey, ValidateToken200Response } from '../models/index';
+import type { AccountCreditBalance, AddDomainRequest, CompositionDataSource, CompositionEntriesDescription, CompositionEntriesReading, CompositionEntryDeleteSuccess, CompositionEntryItemsPageSuccess, CopyPartnerPresetRequest, CreateCompositionContentItemRequest, CreateCompositionFromPresetRequest, CreateCompositionFromWidget201Response, CreateCompositionFromWidgetRequest, CreateUserApiKeyRequest, CreateWidget201Response, CreatedUserApiKey, DeleteCompositionContentItem200Response, DeleteCompositionDataSource200Response, DeletePersonalWorkspaceDomain200Response, DeleteUserApiKey200Response, DuplicateComposition202Response, DuplicateCompositionRequest, GetAllCompositions200Response, GetAllManagedUsers200Response, GetCompositionContentSchema200Response, GetCompositionDesignSchema200Response, GetCompositionEmbedSchema200Response, GetInvoicesByPartnerId200Response, GetManagedUserLimits200Response, GetManagedUserStorageUsage200Response, GetManagedUsersByManagerId200Response, GetPartnerCreditTransactions200Response, GetPartnerDesignDefaults200Response, GetPersonalWorkspaceDomains200Response, GetUserApiKeyUsageLogs200Response, GetUserApiKeys200Response, GetWidgets200Response, ListPartnerPresets200Response, ManagedUser, ManagedUserEntriesPageSuccess, NewComposition, NewManagedUser, NewWidget, OperationsIdGet200Response, PartnerContract, PartnerEntryContextSecret, PartnerEntryContextSigning, PartnerExtraCreditsInvoice, PartnerNotificationDelivery, PartnerNotificationDeliveryLog, PartnerNotificationPage, PartnerNotificationSettings, PartnerNotificationSettingsChange, PartnerNotificationTestEventRequest, PartnerNotificationTestEventResult, PartnerPreset, PartnerPresetCopy, PartnerPresetRemoval, PartnerStorageDestination, PartnerStorageRemoval, PersonalWorkspaceDomainResult, RequestExtraCredits, SetCompositionDataSourceRequest, SetDynamicContent200Response, SetDynamicContentRequest, SetManagedUserLimitsRequest, SetPartnerDesignDefaultsRequest, SetPartnerPresetRequest, SetPartnerStorageDestinationRequest, UpdateComposition, UpdateDomainRequest, UpdateManagedUser, UpdatePartnerEntryContextSigningRequest, UpdatePartnerNotificationSettingsRequest, UpdateUserApiKeyRequest, Upload, UploadLimits, UploadsGet200Response, UploadsIdDelete200Response, UserApiKey, ValidateToken200Response } from '../models/index';
 export interface AddPersonalWorkspaceDomainRequest {
     id: string;
     addDomainRequest: AddDomainRequest;
@@ -47,6 +47,11 @@ export interface CreateManagedUserRequest {
     newManagedUser: NewManagedUser;
     idempotencyKey?: string;
 }
+export interface CreatePartnerExtraCreditsInvoiceRequest {
+    partnerId: string;
+    requestExtraCredits: RequestExtraCredits;
+    idempotencyKey?: string;
+}
 export interface CreateUserApiKeyOperationRequest {
     id: string;
     createUserApiKeyRequest: CreateUserApiKeyRequest;
@@ -185,9 +190,21 @@ export interface GetPartnerBillingOverviewRequest {
 export interface GetPartnerContractRequest {
     partnerId: string;
 }
+export interface GetPartnerCreditBalanceRequest {
+    partnerId: string;
+}
+export interface GetPartnerCreditTransactionsRequest {
+    partnerId: string;
+    limit?: number;
+    offset?: number;
+    type?: string;
+}
 export interface GetPartnerDesignDefaultsRequest {
     partnerId: string;
 }
+export interface GetPartnerEntryContextSigningRequest {
+    partnerId: string;
+}
 export interface GetPartnerNotificationSettingsRequest {
     partnerId: string;
 }
@@ -305,10 +322,19 @@ export interface ReplayPartnerNotificationDeliveryRequest {
     deliveryId: string;
     idempotencyKey?: string;
 }
+export interface RotatePartnerEntryContextSecretRequest {
+    partnerId: string;
+    idempotencyKey?: string;
+}
 export interface RotatePartnerWebhookSecretRequest {
     partnerId: string;
     idempotencyKey?: string;
 }
+export interface SendPartnerNotificationTestEventRequest {
+    partnerId: string;
+    partnerNotificationTestEventRequest: PartnerNotificationTestEventRequest;
+    idempotencyKey?: string;
+}
 export interface SetCompositionDataSourceOperationRequest {
     id: string;
     setCompositionDataSourceRequest: SetCompositionDataSourceRequest;
@@ -341,7 +367,7 @@ export interface SetPartnerStorageDestinationOperationRequest {
     partnerId: string;
     setPartnerStorageDestinationRequest: SetPartnerStorageDestinationRequest;
 }
-export interface UpdateCompositionOperationRequest {
+export interface UpdateCompositionRequest {
     id: string;
     updateComposition: UpdateComposition;
     idempotencyKey?: string;
@@ -351,6 +377,11 @@ export interface UpdateManagedUserRequest {
     updateManagedUser: UpdateManagedUser;
     idempotencyKey?: string;
 }
+export interface UpdatePartnerEntryContextSigningOperationRequest {
+    partnerId: string;
+    updatePartnerEntryContextSigningRequest: UpdatePartnerEntryContextSigningRequest;
+    idempotencyKey?: string;
+}
 export interface UpdatePartnerNotificationSettingsOperationRequest {
     partnerId: string;
     updatePartnerNotificationSettingsRequest: UpdatePartnerNotificationSettingsRequest;
@@ -392,12 +423,12 @@ export interface VerifyPartnerStorageDestinationRequest {
  */
 export declare class PartnerApi extends runtime.BaseAPI {
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomainRaw(requestParameters: AddPersonalWorkspaceDomainRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PersonalWorkspaceDomainResult>>;
     /**
-     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
+     * Adds a website to an account\'s own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic\'s own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor\'s browser. It is not access control: anyone who knows a widget\'s id can still fetch its published content with a plain request that names no website. An account can list at most 50 websites. Use `*.example.com` for a website and all of its subdomains instead of listing each one.
      * Allow a website to show your widgets
      */
     addPersonalWorkspaceDomain(requestParameters: AddPersonalWorkspaceDomainRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PersonalWorkspaceDomainResult>;
@@ -462,12 +493,22 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     createManagedUser(requestParameters: CreateManagedUserRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ManagedUser>;
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Asks Widgetic for an invoice for extra credits, on top of the credits of the contract. Name the dollars; the invoice is for the most whole credits they buy at the **list price** of a credit (the price a contract may lower belongs to the contract), so it is never for more than you asked: 12.34 buys 123 credits and the invoice says 12.30. The smallest purchase is 10 dollars and one request buys at most 100000 (ask Widgetic for an invoice for more).  Pay the invoice with the link in the answer. When it is paid the credits are added **once, for good**, to the account of the person who administers the partner, which is the account everything the partner builds is charged to (`getPartnerCreditBalance` shows it). Extra credits **do not expire**, unlike the credits of a contract period, which end with it. Nothing is added before the invoice is paid, and an unpaid invoice for extra credits never stops the partner: only an unpaid invoice of the contract does (`payment_arrears`).  Allowed whatever the partner\'s standing: a partner that has run out of credits, or is stopped for an unpaid contract invoice, can still buy. No contract is needed.  An `Idempotency-Key` is required, and it is what makes a retry safe: the same key with the same body returns the invoice already issued, the same key with a different body is refused with 422, and a duplicate that arrives while the first is still running is refused with 409. Use one key per purchase you mean to make, and a new key for the next one. At most 10 requests an hour.  Who may ask: the person who administers the partner, or a Widgetic administrator. A key limited to scopes needs `billing:write`.
+     * Buy extra credits for a partner
+     */
+    createPartnerExtraCreditsInvoiceRaw(requestParameters: CreatePartnerExtraCreditsInvoiceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerExtraCreditsInvoice>>;
+    /**
+     * Asks Widgetic for an invoice for extra credits, on top of the credits of the contract. Name the dollars; the invoice is for the most whole credits they buy at the **list price** of a credit (the price a contract may lower belongs to the contract), so it is never for more than you asked: 12.34 buys 123 credits and the invoice says 12.30. The smallest purchase is 10 dollars and one request buys at most 100000 (ask Widgetic for an invoice for more).  Pay the invoice with the link in the answer. When it is paid the credits are added **once, for good**, to the account of the person who administers the partner, which is the account everything the partner builds is charged to (`getPartnerCreditBalance` shows it). Extra credits **do not expire**, unlike the credits of a contract period, which end with it. Nothing is added before the invoice is paid, and an unpaid invoice for extra credits never stops the partner: only an unpaid invoice of the contract does (`payment_arrears`).  Allowed whatever the partner\'s standing: a partner that has run out of credits, or is stopped for an unpaid contract invoice, can still buy. No contract is needed.  An `Idempotency-Key` is required, and it is what makes a retry safe: the same key with the same body returns the invoice already issued, the same key with a different body is refused with 422, and a duplicate that arrives while the first is still running is refused with 409. Use one key per purchase you mean to make, and a new key for the next one. At most 10 requests an hour.  Who may ask: the person who administers the partner, or a Widgetic administrator. A key limited to scopes needs `billing:write`.
+     * Buy extra credits for a partner
+     */
+    createPartnerExtraCreditsInvoice(requestParameters: CreatePartnerExtraCreditsInvoiceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerExtraCreditsInvoice>;
+    /**
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys, except a partner account, which has no limit: what a partner\'s keys do is paid for from its own credits, however many integrations it runs. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
      * Create an API key
      */
     createUserApiKeyRaw(requestParameters: CreateUserApiKeyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CreatedUserApiKey>>;
     /**
-     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys. An account on a plan without API access cannot make one.
+     * Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner\'s backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. An account can hold at most 25 keys, except a partner account, which has no limit: what a partner\'s keys do is paid for from its own credits, however many integrations it runs. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
      * Create an API key
      */
     createUserApiKey(requestParameters: CreateUserApiKeyOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CreatedUserApiKey>;
@@ -500,13 +541,15 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     deleteCompositionContentItem(requestParameters: DeleteCompositionContentItemRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DeleteCompositionContentItem200Response>;
     /**
+     * Removes the binding. Asking again, or asking for a composition that had none, is not an error: the composition has no data source afterwards, and that is all `removed: true` says.
      * Remove the composition data source binding
      */
-    deleteCompositionDataSourceRaw(requestParameters: DeleteCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    deleteCompositionDataSourceRaw(requestParameters: DeleteCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<DeleteCompositionDataSource200Response>>;
     /**
+     * Removes the binding. Asking again, or asking for a composition that had none, is not an error: the composition has no data source afterwards, and that is all `removed: true` says.
      * Remove the composition data source binding
      */
-    deleteCompositionDataSource(requestParameters: DeleteCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    deleteCompositionDataSource(requestParameters: DeleteCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DeleteCompositionDataSource200Response>;
     /**
      * Delete by comma-separated ids (1–100) or by context filters (not both). Rate limit 30 requests per minute.
      * Delete composition entry items by id or host context
@@ -598,12 +641,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     getAllManagedUsers(requestParameters?: GetAllManagedUsersRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetAllManagedUsers200Response>;
     /**
-     * Retrieves a specific composition by its ID.
+     * Retrieves a specific composition by its ID.  The answer carries `direct`, which says whether the widget the composition is made from is drawn straight into your page (`true`) or inside a frame (`false`), or `null` while the widget has no published version. Read it before you go live: a widget drawn without a frame writes its entries from your own page, so the public entry route accepts them only from a website on the composition\'s allowed list, and refuses them while that list is empty (the public JSON of the composition stays open to every website). A widget in a frame writes from Widgetic\'s own frame and is accepted whatever the list says.
      * Get Composition
      */
     getCompositionByIdRaw(requestParameters: GetCompositionByIdRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CreateCompositionFromWidget201Response>>;
     /**
-     * Retrieves a specific composition by its ID.
+     * Retrieves a specific composition by its ID.  The answer carries `direct`, which says whether the widget the composition is made from is drawn straight into your page (`true`) or inside a frame (`false`), or `null` while the widget has no published version. Read it before you go live: a widget drawn without a frame writes its entries from your own page, so the public entry route accepts them only from a website on the composition\'s allowed list, and refuses them while that list is empty (the public JSON of the composition stays open to every website). A widget in a frame writes from Widgetic\'s own frame and is accepted whatever the list says.
      * Get Composition
      */
     getCompositionById(requestParameters: GetCompositionByIdRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CreateCompositionFromWidget201Response>;
@@ -628,13 +671,15 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     getCompositionContentSchema(requestParameters: GetCompositionContentSchemaRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetCompositionContentSchema200Response>;
     /**
+     * The data source that is bound to the composition: `url` and `refreshSeconds`. The answer\'s `data` is `null` when none is bound, and also when what is stored does not pass the rule for a public https address (a binding written by another path, such as the general embed-settings update, is never shown to a page unless it passes the same checks as this route).
      * Read the composition data source binding
      */
-    getCompositionDataSourceRaw(requestParameters: GetCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    getCompositionDataSourceRaw(requestParameters: GetCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CompositionDataSource>>;
     /**
+     * The data source that is bound to the composition: `url` and `refreshSeconds`. The answer\'s `data` is `null` when none is bound, and also when what is stored does not pass the rule for a public https address (a binding written by another path, such as the general embed-settings update, is never shown to a page unless it passes the same checks as this route).
      * Read the composition data source binding
      */
-    getCompositionDataSource(requestParameters: GetCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    getCompositionDataSource(requestParameters: GetCompositionDataSourceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CompositionDataSource>;
     /**
      * Retrieves only the design field from a composition.
      * Get Composition Design
@@ -730,12 +775,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     getManagedUsersByManagerId(requestParameters: GetManagedUsersByManagerIdRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetManagedUsersByManagerId200Response>;
     /**
-     * Retrieves operational credits, the partner\'s contract terms (`partnerCustomization`, the same fields as `getPartnerContract`) and billing integration status. Internal negotiation notes are not part of it.
+     * Retrieves the older partner wallet\'s figures (`operationalCredits`), the partner\'s contract terms (`partnerCustomization`, the same fields as `getPartnerContract`) and billing integration status. Internal negotiation notes are not part of it. `operationalCredits` is **not** what the partner spends: that is the balance of its administrator\'s account, read with `getPartnerCreditBalance` (and its ledger with `getPartnerCreditTransactions`). The wallet it shows was kept before credits followed the account, and nothing adds to it any more.
      * Get comprehensive partner billing overview
      */
     getPartnerBillingOverviewRaw(requestParameters: GetPartnerBillingOverviewRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
     /**
-     * Retrieves operational credits, the partner\'s contract terms (`partnerCustomization`, the same fields as `getPartnerContract`) and billing integration status. Internal negotiation notes are not part of it.
+     * Retrieves the older partner wallet\'s figures (`operationalCredits`), the partner\'s contract terms (`partnerCustomization`, the same fields as `getPartnerContract`) and billing integration status. Internal negotiation notes are not part of it. `operationalCredits` is **not** what the partner spends: that is the balance of its administrator\'s account, read with `getPartnerCreditBalance` (and its ledger with `getPartnerCreditTransactions`). The wallet it shows was kept before credits followed the account, and nothing adds to it any more.
      * Get comprehensive partner billing overview
      */
     getPartnerBillingOverview(requestParameters: GetPartnerBillingOverviewRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
@@ -749,6 +794,26 @@ export declare class PartnerApi extends runtime.BaseAPI {
      * Get a partner\'s contract
      */
     getPartnerContract(requestParameters: GetPartnerContractRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerContract>;
+    /**
+     * Returns the credits the partner has: the balance of the account of the person who administers it, and how much of that is reserved by operations that are still running. That is the account its customers\' editor sessions and its own API calls spend from, and the one a paid invoice that carries credits adds to, so it is the same balance `getUserCreditBalance` reads for that person.  The partner wallet that was kept before credits followed the account is not read here: nothing adds to it or spends from it any more. A partner with no administrator reads a balance of 0.  Access: the person who administers the partner, or a Widgetic administrator.
+     * Get partner credit balance
+     */
+    getPartnerCreditBalanceRaw(requestParameters: GetPartnerCreditBalanceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AccountCreditBalance>>;
+    /**
+     * Returns the credits the partner has: the balance of the account of the person who administers it, and how much of that is reserved by operations that are still running. That is the account its customers\' editor sessions and its own API calls spend from, and the one a paid invoice that carries credits adds to, so it is the same balance `getUserCreditBalance` reads for that person.  The partner wallet that was kept before credits followed the account is not read here: nothing adds to it or spends from it any more. A partner with no administrator reads a balance of 0.  Access: the person who administers the partner, or a Widgetic administrator.
+     * Get partner credit balance
+     */
+    getPartnerCreditBalance(requestParameters: GetPartnerCreditBalanceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AccountCreditBalance>;
+    /**
+     * Lists what happened to the partner\'s credits, newest first: the entries of the credit ledger of the account of the person who administers it. Every operation that spends credits is a `debit` entry, and the credits an invoice carried arrive as `credit` entries when the invoice is paid, so this is also how the partner\'s usage is read. It is the same ledger `getUserCreditTransactions` reads for that person.  The partner wallet that was kept before credits followed the account is not read here. A partner with no administrator has an empty ledger.  The page is always bounded: `limit` defaults to 20 and is capped at 100, `offset` defaults to 0.  Access: the person who administers the partner, or a Widgetic administrator.
+     * Get partner credit transaction history
+     */
+    getPartnerCreditTransactionsRaw(requestParameters: GetPartnerCreditTransactionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetPartnerCreditTransactions200Response>>;
+    /**
+     * Lists what happened to the partner\'s credits, newest first: the entries of the credit ledger of the account of the person who administers it. Every operation that spends credits is a `debit` entry, and the credits an invoice carried arrive as `credit` entries when the invoice is paid, so this is also how the partner\'s usage is read. It is the same ledger `getUserCreditTransactions` reads for that person.  The partner wallet that was kept before credits followed the account is not read here. A partner with no administrator has an empty ledger.  The page is always bounded: `limit` defaults to 20 and is capped at 100, `offset` defaults to 0.  Access: the person who administers the partner, or a Widgetic administrator.
+     * Get partner credit transaction history
+     */
+    getPartnerCreditTransactions(requestParameters: GetPartnerCreditTransactionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetPartnerCreditTransactions200Response>;
     /**
      * Read partner-wide design defaults
      */
@@ -757,6 +822,16 @@ export declare class PartnerApi extends runtime.BaseAPI {
      * Read partner-wide design defaults
      */
     getPartnerDesignDefaults(requestParameters: GetPartnerDesignDefaultsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetPartnerDesignDefaults200Response>;
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigningRaw(requestParameters: GetPartnerEntryContextSigningRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerEntryContextSigning>>;
+    /**
+     * Says whether you have a secret to sign the `context` of your embeds with, when it was made, whether the secret it replaced is still accepted, and whether an entry without a valid signature is refused (`required`). The secret itself is never part of the answer: it is shown once, when it is made (`rotatePartnerEntryContextSecret`, which also explains what signing is for and how to sign).  Signing covers the entries written through the gateway into the compositions of your managed users and into those of your own account. The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
+     * See how the context of your embeds is signed
+     */
+    getPartnerEntryContextSigning(requestParameters: GetPartnerEntryContextSigningRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerEntryContextSigning>;
     /**
      * Returns who gets the emails, which events you want by email and by webhook, the address of your webhook, and whether it has a secret to sign with. The secret itself is never returned: it is shown once, when it is made. `events` lists every kind of event there is, for a settings screen.  The caller must be the person who administers the partner (an API key of that account works, with the `partner:read` scope), or a Widgetic administrator.
      * Where your notifications go
@@ -808,25 +883,25 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     getUserApiKeys(requestParameters: GetUserApiKeysRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetUserApiKeys200Response>;
     /**
-     * Returns the credits an account holds: the balance, and how much of it is reserved by operations that are still running.  An account reads its own balance; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. An account that has never held credits reads a balance of 0.
+     * Returns the credits an account holds: the balance, and how much of it is reserved by operations that are still running.  An account reads its own balance; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. An account that has never held credits reads a balance of 0. `getPartnerCreditBalance` reads this same balance by partner id.
      * Get an account\'s credit balance
      */
     getUserCreditBalanceRaw(requestParameters: GetUserCreditBalanceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AccountCreditBalance>>;
     /**
-     * Returns the credits an account holds: the balance, and how much of it is reserved by operations that are still running.  An account reads its own balance; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. An account that has never held credits reads a balance of 0.
+     * Returns the credits an account holds: the balance, and how much of it is reserved by operations that are still running.  An account reads its own balance; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. An account that has never held credits reads a balance of 0. `getPartnerCreditBalance` reads this same balance by partner id.
      * Get an account\'s credit balance
      */
     getUserCreditBalance(requestParameters: GetUserCreditBalanceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AccountCreditBalance>;
     /**
-     * Lists the entries of an account\'s credit ledger, newest first. This is also how an account\'s usage is read: every operation that spends credits is a `debit` entry, so summing the `debit` entries over a period gives the credits consumed in it, and the other types give what was added.  An account reads its own ledger; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. A partner\'s wallet is a separate ledger, read with `getPartnerCreditTransactions`.  The page is always bounded: `limit` defaults to 100 and is capped at 500, `offset` defaults to 0.
+     * Lists the entries of an account\'s credit ledger, newest first. This is also how an account\'s usage is read: every operation that spends credits is a `debit` entry, so summing the `debit` entries over a period gives the credits consumed in it, and the other types give what was added.  An account reads its own ledger; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. `getPartnerCreditTransactions` reads this same ledger by partner id.  The page is always bounded: `limit` defaults to 100 and is capped at 500, `offset` defaults to 0.
      * List an account\'s credit ledger
      */
-    getUserCreditTransactionsRaw(requestParameters: GetUserCreditTransactionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetUserCreditTransactions200Response>>;
+    getUserCreditTransactionsRaw(requestParameters: GetUserCreditTransactionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GetPartnerCreditTransactions200Response>>;
     /**
-     * Lists the entries of an account\'s credit ledger, newest first. This is also how an account\'s usage is read: every operation that spends credits is a `debit` entry, so summing the `debit` entries over a period gives the credits consumed in it, and the other types give what was added.  An account reads its own ledger; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. A partner\'s wallet is a separate ledger, read with `getPartnerCreditTransactions`.  The page is always bounded: `limit` defaults to 100 and is capped at 500, `offset` defaults to 0.
+     * Lists the entries of an account\'s credit ledger, newest first. This is also how an account\'s usage is read: every operation that spends credits is a `debit` entry, so summing the `debit` entries over a period gives the credits consumed in it, and the other types give what was added.  An account reads its own ledger; with a partner\'s API key, that is the account of the person who administers the partner. Widgetic administrators can read any account\'s. `getPartnerCreditTransactions` reads this same ledger by partner id.  The page is always bounded: `limit` defaults to 100 and is capped at 500, `offset` defaults to 0.
      * List an account\'s credit ledger
      */
-    getUserCreditTransactions(requestParameters: GetUserCreditTransactionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetUserCreditTransactions200Response>;
+    getUserCreditTransactions(requestParameters: GetUserCreditTransactionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GetPartnerCreditTransactions200Response>;
     /**
      * Lists the widgets your account owns, newest first. A widget is the reusable piece a composition is made from; this is your own library, not a catalogue of Widgetic\'s widgets.  Pass `page` (counting from 1) and `size` (1 to 100, 20 when left out) to read the list one page at a time. `meta` then carries `total`, `hasNextPage` and `hasPreviousPage`, so a client can walk the list to its end. A page past the end is an empty list. Without `page` and `size` the call returns the whole list in one response, which only suits an account with a few widgets.  Pass `canvasId` to list only the widgets on one of your canvases. That list is always returned whole, whatever `page` and `size` say.  Pass `managedUserId` (Widgetic\'s id for one of your managed users) or `managedUserExternalId` (your own identifier for the user) to list only the widgets made for that managed user. The widgets of your other managed users, and your own, are left out. It combines with `page`, `size` and `canvasId`. A managed user that is not yours, or does not exist, is answered with 404 and `MANAGED_USER_NOT_FOUND`.
      * List Widgets
@@ -848,12 +923,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     listCompositionEntryItems(requestParameters: ListCompositionEntryItemsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CompositionEntryItemsPageSuccess>;
     /**
-     * Merges eligible tables (time and id columns) across the managed user\'s compositions in global time order, then compositionId, table, and id (byte order). Only tables with both a time and an id column take part. Rate limit 120 requests per minute.
+     * Merges eligible tables (time and id columns) across the managed user\'s compositions in global time order, then compositionId, table, and id (byte order). Only tables with both a time and an id column take part. Rate limit 30 requests per minute.
      * List entries across a managed user\'s compositions
      */
     listManagedUserEntriesRaw(requestParameters: ListManagedUserEntriesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ManagedUserEntriesPageSuccess>>;
     /**
-     * Merges eligible tables (time and id columns) across the managed user\'s compositions in global time order, then compositionId, table, and id (byte order). Only tables with both a time and an id column take part. Rate limit 120 requests per minute.
+     * Merges eligible tables (time and id columns) across the managed user\'s compositions in global time order, then compositionId, table, and id (byte order). Only tables with both a time and an id column take part. Rate limit 30 requests per minute.
      * List entries across a managed user\'s compositions
      */
     listManagedUserEntries(requestParameters: ListManagedUserEntriesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ManagedUserEntriesPageSuccess>;
@@ -906,12 +981,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     patchCompositionContentItem(requestParameters: PatchCompositionContentItemRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
     /**
-     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups, 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
+     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists. - **`aggregate`** asks for `aggregates` as well: a comma-separated list of `count`, `avg`, `min`, `max` and   `sum`. `avg`, `min`, `max` and `sum` need `column`, a numeric column of the table. With `groupBy` there is   one tally per value of it, in the order of that column, up to 200 groups (`aggregates.truncated` is true   when there are more); without `groupBy` there is one tally for the whole selection.  **`aggregates` counts a selection; the rest of the answer does not.** `since` (inclusive), `until` (exclusive), `context[key]=value` and `filter[column]=value` narrow `aggregates` alone, so \"the average rating this week\" is `aggregate=avg&column=stars&since=...`. `totalRows`, `tallies` and `rows` always describe the whole table. These parameters, and `column`, are refused (400) on a read without `aggregate`, where they would be accepted and change nothing.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups (200 in `aggregates`), 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`; to page through entries with their time, context and filters, use `listCompositionEntryItems`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
      * Read the Entries of a Composition\'s Table
      */
     readCompositionEntriesRaw(requestParameters: ReadCompositionEntriesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CompositionEntriesReading>>;
     /**
-     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups, 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
+     * Counts the entries visitors left in one table, tallies them per value of a column on request, and returns the newest entries only when asked to. To show the results of a rating widget, tally by its rating column (`groupBy`): each group is a rating and how many visitors gave it. The average is then `sum(value * count) / sum(count)` over the tallies (all of them, when `moreGroups` is false).  - **`totalRows`** is how many entries the table holds in all. - **`groupBy`** names a column (as `describeCompositionEntries` lists it). `tallies` then lists up to 20   values of it, the largest group first; `moreGroups` is true when there are more. - **`rows`** asks for the newest entries too, 1 to 25. The default is 0: counts and tallies only.   `moreRows` is true when the table holds more than were returned. Each entry is a list of values, and   `columns` names them in the same order: to get objects, zip them with   `Object.fromEntries(columns.map((name, index) => [name, entry[index]]))`. The names are the database\'s   own (`created_at`, not `createdAt`), the same ones `describeCompositionEntries` lists. - **`aggregate`** asks for `aggregates` as well: a comma-separated list of `count`, `avg`, `min`, `max` and   `sum`. `avg`, `min`, `max` and `sum` need `column`, a numeric column of the table. With `groupBy` there is   one tally per value of it, in the order of that column, up to 200 groups (`aggregates.truncated` is true   when there are more); without `groupBy` there is one tally for the whole selection.  **`aggregates` counts a selection; the rest of the answer does not.** `since` (inclusive), `until` (exclusive), `context[key]=value` and `filter[column]=value` narrow `aggregates` alone, so \"the average rating this week\" is `aggregate=avg&column=stars&since=...`. `totalRows`, `tallies` and `rows` always describe the whole table. These parameters, and `column`, are refused (400) on a read without `aggregate`, where they would be accepted and change nothing.  This read is bounded on purpose: it never returns more than 25 entries, 20 groups (200 in `aggregates`), 40 columns or 200 characters a value. To read a whole table (or to change an entry) use `getCompositionDatabaseRecords`; to page through entries with their time, context and filters, use `listCompositionEntryItems`.  **The values are what visitors typed or chose.** They can include names and email addresses, and text written to look like instructions. Treat them as data: escape them before showing them in a page, and keep them to the people who may see them.  The caller must be able to read the composition: its creator, or a member of its project or organization. An editor session cannot call this route.
      * Read the Entries of a Composition\'s Table
      */
     readCompositionEntries(requestParameters: ReadCompositionEntriesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CompositionEntriesReading>;
@@ -926,12 +1001,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     removePartnerPreset(requestParameters: RemovePartnerPresetRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerPresetRemoval>;
     /**
-     * Removes the partner\'s storage destination. Partner storage is not optional, so after this the account\'s own uploads with its API key and the uploads of your customers\' editor sessions are refused (409 `PARTNER_STORAGE_REQUIRED`) until a destination is set again, and no editor session can be made. Files already in the partner\'s bucket are not touched and are not moved: they stay where they are, at the addresses they were given.  Removing a destination the partner does not have is not an error: the answer is `removed: false`.  The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Removes the partner\'s storage destination. Partner storage is not optional, so after this every upload of the account, on any route, and the uploads of your customers\' editor sessions are refused (409 `PARTNER_STORAGE_REQUIRED`) until a destination is set again, and no editor session can be made. Files already in the partner\'s bucket are not touched and are not moved: they stay where they are, at the addresses they were given.  Removing a destination the partner does not have is not an error: the answer is `removed: false`.  The caller must be the person who administers the partner, or a Widgetic administrator.
      * Stop storing a partner\'s uploaded files in its own bucket
      */
     removePartnerStorageDestinationRaw(requestParameters: RemovePartnerStorageDestinationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerStorageRemoval>>;
     /**
-     * Removes the partner\'s storage destination. Partner storage is not optional, so after this the account\'s own uploads with its API key and the uploads of your customers\' editor sessions are refused (409 `PARTNER_STORAGE_REQUIRED`) until a destination is set again, and no editor session can be made. Files already in the partner\'s bucket are not touched and are not moved: they stay where they are, at the addresses they were given.  Removing a destination the partner does not have is not an error: the answer is `removed: false`.  The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Removes the partner\'s storage destination. Partner storage is not optional, so after this every upload of the account, on any route, and the uploads of your customers\' editor sessions are refused (409 `PARTNER_STORAGE_REQUIRED`) until a destination is set again, and no editor session can be made. Files already in the partner\'s bucket are not touched and are not moved: they stay where they are, at the addresses they were given.  Removing a destination the partner does not have is not an error: the answer is `removed: false`.  The caller must be the person who administers the partner, or a Widgetic administrator.
      * Stop storing a partner\'s uploaded files in its own bucket
      */
     removePartnerStorageDestination(requestParameters: RemovePartnerStorageDestinationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerStorageRemoval>;
@@ -945,6 +1020,16 @@ export declare class PartnerApi extends runtime.BaseAPI {
      * Send a webhook delivery again
      */
     replayPartnerNotificationDelivery(requestParameters: ReplayPartnerNotificationDeliveryRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerNotificationDelivery>;
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecretRaw(requestParameters: RotatePartnerEntryContextSecretRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerEntryContextSecret>>;
+    /**
+     * Makes a secret to sign the `context` of your embeds with, and returns it in `secret`: **keep it now, it is shown once** and cannot be read again. Keep it on your server only: whoever holds it can write contexts your compositions accept. Call this again to make a new secret; the one it replaces is still accepted for a day, so that your server can switch without an entry being refused (making another within that day ends the overlap with the first).  **What signing is for.** `<widgetic composition-id=\"...\" context=\'{\"customerId\":\"c_42\"}\'>` hands attribution to a widget, which sends it with every entry it saves. The page is yours but the browser is the visitor\'s: anybody can change that attribute and file an entry under another customer\'s id. When your server signs the context, the gateway refuses an entry whose context was changed, and the entries you keep hold attribution your server wrote.  **How to sign** (on your server, for each page you render):  1. Take the context to give the widget. It may hold text and whole numbers only (within ±2^53, written without    a fraction or an exponent). 2. Choose when the signature stops being good: `widgetic_exp`, in seconds since 1970 (UTC), no more than    seven days from now. A minute of difference between clocks is forgiven. 3. Write the text to sign, with no spaces except those inside values:    `widgetic-context.v1.<compositionId>.<widgetic_exp>.<json>`. `<compositionId>` is the id of the composition    in lower case. `<json>` is the context as JSON with the keys in character-code order (so `Z` comes before    `a`, and `10` before `9`), no spaces, strings escaped as JSON escapes them, and the two keys of the    signature left out. 4. Sign that text: HMAC-SHA256 with the 32 bytes the secret stands for (the base64 text after `ctxsec_`), and    write the result as base64url without padding. 5. Give the widget the context with two keys added: `widgetic_exp` and `widgetic_sig` (the signature). The whole    attribute, the two keys included, stays within the limits of any context: at most 20 keys, 2048 bytes of    JSON, strings up to 500 characters. The two keys take two of the 20 keys and 87 bytes of the 2048.  A test vector, to check your code against before you rely on it. Secret `ctxsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=` (the bytes 0 to 31), composition `7c9e6679-7425-40de-944b-e07fc1f90ae7`, `widgetic_exp` 1792000000 and context `{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` sign the text `widgetic-context.v1.7c9e6679-7425-40de-944b-e07fc1f90ae7.1792000000.{\"customerId\":\"c_42\",\"plan\":\"pro\",\"seats\":3}` and give the signature `j6g7151F54tl9C8oEY9levaYSppHME4fAPZ7WPwL8C8`. (The secret is the example\'s, not a real one.)  **What the gateway does with an entry.** When you have a secret, an entry whose context carries a signature is checked: a signature that does not match is refused with 403 `CONTEXT_SIGNATURE_INVALID`, and one that is past `widgetic_exp` with 403 `CONTEXT_SIGNATURE_EXPIRED`. When you also require signatures (`updatePartnerEntryContextSigning`) an entry whose context carries none is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`. The two keys are taken out before the entry is stored or announced: your entries and your `entry.created` events hold the context you wrote. A change you make reaches every part of the gateway within a minute.  **What it does not do.** A signed context that has been seen (a page\'s source is public) can be sent again by anyone until `widgetic_exp`; when you must not accept the same context twice, put a value that is new for each page view in it (a `submissionId` you made up) and keep the ones you have seen. The signature covers the entries that reach Widgetic\'s gateway: a widget that writes straight into its own database does not pass through it.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Make a secret to sign the context of your embeds
+     */
+    rotatePartnerEntryContextSecret(requestParameters: RotatePartnerEntryContextSecretRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerEntryContextSecret>;
     /**
      * Makes a new secret to sign your webhook with, and returns it in `webhookSecret`: **keep it now, it is shown once** and cannot be read again. Use it when the secret was lost, or may have leaked.  The secret you had keeps signing beside the new one for a day, so that your receiver can switch without a call being rejected: during that day each call carries two signatures (see `updatePartnerNotificationSettings` for how they are verified). Rotating again within the day ends the overlap with the first secret.  Retry this call with the same `Idempotency-Key` if its answer was lost: the answer, secret included, is then given again, and no second secret is made.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Make a new secret for your webhook
@@ -956,15 +1041,25 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     rotatePartnerWebhookSecret(requestParameters: RotatePartnerWebhookSecretRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerNotificationSettingsChange>;
     /**
-     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses).
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEventRaw(requestParameters: SendPartnerNotificationTestEventRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerNotificationTestEventResult>>;
+    /**
+     * Sends ONE signed call, right now, to the webhook address you saved under notification settings, with a sample of what an event of the type you name carries, and answers how it went: whether your receiver answered with a 2xx status, which status, how long it took, and why not when it did not arrive. Use it to write and try your receiver (above all the signature check) before a real event happens.  The call is made like every other: it is signed with your current secret (and the previous one while a rotation overlaps), it carries the headers `webhook-id`, `webhook-timestamp`, `webhook-signature` and `x-widgetic-event` (the event type), and its body is `{ \"id\", \"type\", \"createdAt\", \"partnerId\", \"data\" }`. Three things differ. `id` starts with `evt_test_` and is new every time, so a receiver that remembers ids can tell a test from an event and drop it. `data` holds made-up values of the shape a real event of that type carries (`PartnerNotification` describes each), never anything about your account. And the call is made once: it is not tried again, nothing is stored, and it appears neither in the delivery log nor in the notification list.  It is sent whatever `webhookEvents` says: a test is not filtered by what you subscribed to. The answer is 200 whether or not your receiver took the call (read `delivered`); a call that gets no answer within ten seconds is given up and reported as a `timeout`.  A webhook address and a signing secret must be saved first (`updatePartnerNotificationSettings`); until then the answer is 409. This needs an API key with full access, and `Idempotency-Key` is required: a retry with the same key gets the first answer back and no second call is made. The caller must be the person who administers the partner, or a Widgetic administrator. Five tests a minute.
+     * Send a test event to your webhook
+     */
+    sendPartnerNotificationTestEvent(requestParameters: SendPartnerNotificationTestEventRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerNotificationTestEventResult>;
+    /**
+     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses). A composition has one binding: saving another replaces it. The answer is the binding as it was saved (`url`, `refreshSeconds`).
      * Bind a public JSON data source for embed refresh
      */
-    setCompositionDataSourceRaw(requestParameters: SetCompositionDataSourceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    setCompositionDataSourceRaw(requestParameters: SetCompositionDataSourceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CompositionDataSource>>;
     /**
-     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses).
+     * Stores an https URL the widget runtime may read on load and every `refresh_seconds`. The URL must name a public host (no loopback, link-local or metadata addresses). A composition has one binding: saving another replaces it. The answer is the binding as it was saved (`url`, `refreshSeconds`).
      * Bind a public JSON data source for embed refresh
      */
-    setCompositionDataSource(requestParameters: SetCompositionDataSourceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    setCompositionDataSource(requestParameters: SetCompositionDataSourceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CompositionDataSource>;
     /**
      * Updates the content of a composition dynamically with optional schema validation.  An editor session (see `createManagedUserEditorSession`) can send only `content`, `validate` and `partial`, and only for a composition made for its managed user. A body that names `version`, `source` or any other field is refused with `403` and `EDITOR_SESSION_FIELD_NOT_ALLOWED`.
      * Set Dynamic Content
@@ -1016,12 +1111,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     setPartnerPreset(requestParameters: SetPartnerPresetOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerPreset>;
     /**
-     * Points the partner at a bucket of its own on an S3-compatible service (Amazon S3, Backblaze B2, Cloudflare R2, Wasabi, MinIO and the like). From then on, a file uploaded with `uploadsPost` by the account that administers the partner is stored in that bucket instead of with Widgetic. It takes none of the account\'s storage allowance, and its `url` is served from `public_base_url`.  Only uploads sent with an API key, an SDK token or an editor session use the destination. Uploads from the Widgetic website, resumable uploads and the media library keep using Widgetic\'s storage.  A destination is required. Partner storage is not optional: your customers\' files, and your own uploads with your API key, are kept in this destination and nowhere else. An editor session (`createManagedUserEditorSession`) of any surface cannot be made until a destination is set (409 `PARTNER_STORAGE_REQUIRED`), a destination removed later stops the uploads of the sessions already made (the same 409), and your own upload with no destination is refused in the same way instead of being stored with Widgetic. A partner cannot be activated until it has a destination that works.  The destination is checked before it is saved. Widgetic writes a small test file under `<key_prefix>widgetic-check/`, reads it back from `<public_base_url>/<its key>`, and deletes it. If any step fails nothing is saved and the answer is 422 `STORAGE_DESTINATION_UNVERIFIED`: `details.step` says where (`endpoint`, `write` or `public_read`), `details.reason` says why, and `param` names the field most likely to be wrong.  What the bucket needs: - an access key that may put objects into it (it may also delete objects, which lets the test file be   cleaned up, but that is not required); - its files publicly readable at `public_base_url`, either because the bucket is public or through a CDN.  The secret access key is stored encrypted and is never returned or logged; a response shows only the last four characters of the access key id (`accessKeyHint`). Saving replaces the whole destination, so send every field again, including the secret. Files already stored stay where they are, and keep working for as long as that bucket stays publicly readable.  Once a destination is set, an upload is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 `STORAGE_DESTINATION_UNAVAILABLE`, and when the bucket rejects the file with 502 `STORAGE_DESTINATION_WRITE_FAILED`.  The caller must be the person who administers the partner (an API key of that account works); anyone else is refused with 403 whether or not the partner exists. Widgetic administrators can set any partner\'s.
+     * Points the partner at a bucket of its own on an S3-compatible service (Amazon S3, Backblaze B2, Cloudflare R2, Wasabi, MinIO and the like). From then on, every file the account that administers the partner stores is kept in that bucket instead of with Widgetic, whichever way it arrives: a file sent with `uploadsPost` (with an API key, an SDK token, an editor session or from the Widgetic website), a resumable upload, the media library, and the files the agent tools and the MCP server save. It takes none of the account\'s storage allowance, and its `url` is served from `public_base_url`. The chunks of a resumable upload wait in Widgetic\'s temporary staging area until it is completed and are removed then: the finished file is stored in your bucket and nowhere else.  A destination is required. Partner storage is not optional: your customers\' files, and your own however they arrive, are kept in this destination and nowhere else. An editor session (`createManagedUserEditorSession`) of any surface cannot be made until a destination is set (409 `PARTNER_STORAGE_REQUIRED`), a destination removed later stops the uploads of the sessions already made (the same 409), and your own upload with no destination (on any route, including a resumable upload, which is refused when it is started) is refused in the same way instead of being stored with Widgetic. A partner cannot be activated until it has a destination that works.  The destination is checked before it is saved. Widgetic writes a small test file under `<key_prefix>widgetic-check/`, reads it back from `<public_base_url>/<its key>`, and deletes it. If any step fails nothing is saved and the answer is 422 `STORAGE_DESTINATION_UNVERIFIED`: `details.step` says where (`endpoint`, `write` or `public_read`), `details.reason` says why, and `param` names the field most likely to be wrong.  What the bucket needs: - an access key that may put objects into it (it may also delete objects, which lets the test file be   cleaned up, but that is not required); - its files publicly readable at `public_base_url`, either because the bucket is public or through a CDN.  The secret access key is stored encrypted and is never returned or logged; a response shows only the last four characters of the access key id (`accessKeyHint`). Saving replaces the whole destination, so send every field again, including the secret. Files already stored stay where they are, and keep working for as long as that bucket stays publicly readable.  Once a destination is set, an upload is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 `STORAGE_DESTINATION_UNAVAILABLE`, and when the bucket rejects the file with 502 `STORAGE_DESTINATION_WRITE_FAILED`.  The caller must be the person who administers the partner (an API key of that account works); anyone else is refused with 403 whether or not the partner exists. Widgetic administrators can set any partner\'s.
      * Set where a partner\'s uploaded files are stored
      */
     setPartnerStorageDestinationRaw(requestParameters: SetPartnerStorageDestinationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerStorageDestination>>;
     /**
-     * Points the partner at a bucket of its own on an S3-compatible service (Amazon S3, Backblaze B2, Cloudflare R2, Wasabi, MinIO and the like). From then on, a file uploaded with `uploadsPost` by the account that administers the partner is stored in that bucket instead of with Widgetic. It takes none of the account\'s storage allowance, and its `url` is served from `public_base_url`.  Only uploads sent with an API key, an SDK token or an editor session use the destination. Uploads from the Widgetic website, resumable uploads and the media library keep using Widgetic\'s storage.  A destination is required. Partner storage is not optional: your customers\' files, and your own uploads with your API key, are kept in this destination and nowhere else. An editor session (`createManagedUserEditorSession`) of any surface cannot be made until a destination is set (409 `PARTNER_STORAGE_REQUIRED`), a destination removed later stops the uploads of the sessions already made (the same 409), and your own upload with no destination is refused in the same way instead of being stored with Widgetic. A partner cannot be activated until it has a destination that works.  The destination is checked before it is saved. Widgetic writes a small test file under `<key_prefix>widgetic-check/`, reads it back from `<public_base_url>/<its key>`, and deletes it. If any step fails nothing is saved and the answer is 422 `STORAGE_DESTINATION_UNVERIFIED`: `details.step` says where (`endpoint`, `write` or `public_read`), `details.reason` says why, and `param` names the field most likely to be wrong.  What the bucket needs: - an access key that may put objects into it (it may also delete objects, which lets the test file be   cleaned up, but that is not required); - its files publicly readable at `public_base_url`, either because the bucket is public or through a CDN.  The secret access key is stored encrypted and is never returned or logged; a response shows only the last four characters of the access key id (`accessKeyHint`). Saving replaces the whole destination, so send every field again, including the secret. Files already stored stay where they are, and keep working for as long as that bucket stays publicly readable.  Once a destination is set, an upload is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 `STORAGE_DESTINATION_UNAVAILABLE`, and when the bucket rejects the file with 502 `STORAGE_DESTINATION_WRITE_FAILED`.  The caller must be the person who administers the partner (an API key of that account works); anyone else is refused with 403 whether or not the partner exists. Widgetic administrators can set any partner\'s.
+     * Points the partner at a bucket of its own on an S3-compatible service (Amazon S3, Backblaze B2, Cloudflare R2, Wasabi, MinIO and the like). From then on, every file the account that administers the partner stores is kept in that bucket instead of with Widgetic, whichever way it arrives: a file sent with `uploadsPost` (with an API key, an SDK token, an editor session or from the Widgetic website), a resumable upload, the media library, and the files the agent tools and the MCP server save. It takes none of the account\'s storage allowance, and its `url` is served from `public_base_url`. The chunks of a resumable upload wait in Widgetic\'s temporary staging area until it is completed and are removed then: the finished file is stored in your bucket and nowhere else.  A destination is required. Partner storage is not optional: your customers\' files, and your own however they arrive, are kept in this destination and nowhere else. An editor session (`createManagedUserEditorSession`) of any surface cannot be made until a destination is set (409 `PARTNER_STORAGE_REQUIRED`), a destination removed later stops the uploads of the sessions already made (the same 409), and your own upload with no destination (on any route, including a resumable upload, which is refused when it is started) is refused in the same way instead of being stored with Widgetic. A partner cannot be activated until it has a destination that works.  The destination is checked before it is saved. Widgetic writes a small test file under `<key_prefix>widgetic-check/`, reads it back from `<public_base_url>/<its key>`, and deletes it. If any step fails nothing is saved and the answer is 422 `STORAGE_DESTINATION_UNVERIFIED`: `details.step` says where (`endpoint`, `write` or `public_read`), `details.reason` says why, and `param` names the field most likely to be wrong.  What the bucket needs: - an access key that may put objects into it (it may also delete objects, which lets the test file be   cleaned up, but that is not required); - its files publicly readable at `public_base_url`, either because the bucket is public or through a CDN.  The secret access key is stored encrypted and is never returned or logged; a response shows only the last four characters of the access key id (`accessKeyHint`). Saving replaces the whole destination, so send every field again, including the secret. Files already stored stay where they are, and keep working for as long as that bucket stays publicly readable.  Once a destination is set, an upload is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 `STORAGE_DESTINATION_UNAVAILABLE`, and when the bucket rejects the file with 502 `STORAGE_DESTINATION_WRITE_FAILED`.  The caller must be the person who administers the partner (an API key of that account works); anyone else is refused with 403 whether or not the partner exists. Widgetic administrators can set any partner\'s.
      * Set where a partner\'s uploaded files are stored
      */
     setPartnerStorageDestination(requestParameters: SetPartnerStorageDestinationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerStorageDestination>;
@@ -1029,12 +1124,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      * Updates a specific composition.  The `Idempotency-Key` header is required (`400` without it). Send the same key when you retry.  An editor session (see `createManagedUserEditorSession`) can send only `name`, `content`, `design` and `embedSettings`, and only for a composition made for its managed user. A body that names any other field is refused with `403` and `EDITOR_SESSION_FIELD_NOT_ALLOWED`.
      * Update Composition
      */
-    updateCompositionRaw(requestParameters: UpdateCompositionOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CreateCompositionFromWidget201Response>>;
+    updateCompositionRaw(requestParameters: UpdateCompositionRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<CreateCompositionFromWidget201Response>>;
     /**
      * Updates a specific composition.  The `Idempotency-Key` header is required (`400` without it). Send the same key when you retry.  An editor session (see `createManagedUserEditorSession`) can send only `name`, `content`, `design` and `embedSettings`, and only for a composition made for its managed user. A body that names any other field is refused with `403` and `EDITOR_SESSION_FIELD_NOT_ALLOWED`.
      * Update Composition
      */
-    updateComposition(requestParameters: UpdateCompositionOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CreateCompositionFromWidget201Response>;
+    updateComposition(requestParameters: UpdateCompositionRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<CreateCompositionFromWidget201Response>;
     /**
      * Updates an existing managed user. Only `external_id`, `metadata` and `is_active` can change, and `metadata` is replaced as a whole, so send all of it. `is_active: false` switches the managed user off: what it already has stays, and nothing new can be filed under it until you send `is_active: true`. Switching it off also ends all of its editor sessions, and they do not come back when you switch it on again.  The `Idempotency-Key` header is required (`400` without it).
      * Update Managed User
@@ -1045,6 +1140,16 @@ export declare class PartnerApi extends runtime.BaseAPI {
      * Update Managed User
      */
     updateManagedUser(requestParameters: UpdateManagedUserRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ManagedUser>;
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigningRaw(requestParameters: UpdatePartnerEntryContextSigningOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PartnerEntryContextSigning>>;
+    /**
+     * Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator.
+     * Require a signed context, or stop requiring it
+     */
+    updatePartnerEntryContextSigning(requestParameters: UpdatePartnerEntryContextSigningOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PartnerEntryContextSigning>;
     /**
      * Changes who gets the emails, which events you want by email and by webhook, and the address of your webhook. A key you leave out of the body is left as it was; send only what changes.  **Email.** `emailRecipients` is the list of addresses (at most five). While it is empty the emails about invoices go to the billing emails of your billing profile (your contact email when there are none), and the others to your contact email. The events about money and about the standing of your account are always emailed, whatever `emailEvents` says; it narrows the others.  **Webhook.** `webhookUrl` is where Widgetic sends a signed `POST` for each event, so that your own system can act on it (mark an invoice paid, warn your team that credits are low). The address must be `https` on the standard port, on a public site, and must not redirect. Setting an address when you have no secret yet makes one, and the answer carries it as `webhookSecret`: **keep it now, it is shown once**. `webhookEvents` narrows what is sent.  Each call has a JSON body, `{ \"id\": \"evt_...\", \"type\": \"invoice.paid\", \"createdAt\": \"...\", \"partnerId\": \"...\", \"data\": { ... } }` (`data` is the `data` of `PartnerNotification`), and these headers: `webhook-id` (the same as `id`, and the same on every retry), `webhook-timestamp` (seconds since 1970) and `webhook-signature` (`v1,` and a base64 HMAC-SHA256). It is the Standard Webhooks scheme, so any of its libraries verifies it. By hand: take your secret without the `whsec_` prefix, decode it from base64, and sign the text `<webhook-id>.<webhook-timestamp>.<the raw body>` with it; the header holds `v1,<base64 of the result>` (two signatures separated by a space while a rotated secret overlaps). Reject a `webhook-timestamp` that is more than five minutes old.  Answer with a 2xx status within ten seconds. Anything else is tried again, eight attempts in all over about two days (`listPartnerNotificationDeliveries` shows each). Delivery is at least once: if your answer was lost the same event arrives again with the same `id`, so drop what you have already handled by it.  Changing the settings needs an API key with full access: they decide where your notifications go. The caller must be the person who administers the partner, or a Widgetic administrator.
      * Choose where your notifications go
@@ -1116,12 +1221,12 @@ export declare class PartnerApi extends runtime.BaseAPI {
      */
     uploadsLimitsGet(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<UploadLimits>;
     /**
-     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the account\'s storage allowance, and a full allowance is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional. A partner\'s own uploads (with its API key) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
+     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team\'s shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store\'s session, always work in that team\'s shared storage. A personal API key or an SDK token always uses the account\'s own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  When the full storage is a Shopify store\'s team\'s, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person\'s own workspace, get the shorter message.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner\'s own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
      * Upload a file
      */
     uploadsPostRaw(requestParameters: UploadsPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Upload>>;
     /**
-     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the account\'s storage allowance, and a full allowance is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional. A partner\'s own uploads (with its API key) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
+     * Stores one file for the account and returns its public address. This is how a user\'s own images, video and PDFs reach a widget\'s content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team\'s shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store\'s session, always work in that team\'s shared storage. A personal API key or an SDK token always uses the account\'s own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  When the full storage is a Shopify store\'s team\'s, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person\'s own workspace, get the shorter message.  To upload the file for one of your managed users, send `managed_user_id` (Widgetic\'s id for the user) or `managed_user_external_id` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user\'s files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session\'s own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `context_type`, `source`, `widget_id` and `conversation_id` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner\'s business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner\'s own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner\'s public address, and its `storage_key` is the key in the partner\'s bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner\'s storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner\'s own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers\' editor sessions are kept in the partner\'s own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session\'s browser is only told that the feature is not available right now.
      * Upload a file
      */
     uploadsPost(requestParameters: UploadsPostRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Upload>;