aimeat 2.0.0 → 2.1.0

package/dist/src/generated/api-types.d.ts

@@ -447,6 +447,52 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/unfurl": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Link preview (unfurl) metadata for a URL
+         * @description Fetch a URL server-side (SSRF-safe via safeFetch) and return its OpenGraph/Twitter-card
+         *     metadata so a pasted link can render as a rich preview card. Generic — usable by any client
+         *     (message threads, notebook, workspace docs). The page fetch is size-capped and content-type
+         *     checked; results are cached (~1h). A non-HTML target returns a hostname-only preview.
+         */
+        get: operations["unfurlLink"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/unfurl/image": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Proxy a link-preview image same-origin
+         * @description Fetch a preview image (typically the `image` from GET /v1/unfurl) THROUGH the node and stream
+         *     it back. Same-origin so the SPA's `img-src 'self' data: blob:` CSP is satisfied, and the
+         *     viewer's IP never reaches the third-party site. SSRF-safe, content-type checked (image/*), and
+         *     size-capped.
+         */
+        get: operations["unfurlImage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/validate": {
         parameters: {
             query?: never;
@@ -664,7 +710,10 @@ export interface paths {
          *     **302-redirects** to the trusted apex consent page (`/v1/app-grant?req=...`) where the
          *     owner approves. `code_challenge_method` is `S256` (or `plain` for non-secure-context clients
          *     without crypto.subtle — real app origins are https/S256); `redirect_uri` must be on the
-         *     app origin (never the apex); `scope` must be drawn from the grantable scope set. With
+         *     app origin (never the apex), and when it lives on a **per-app subdomain** that subdomain
+         *     must map to exactly the requesting `app` (else `INVALID_REDIRECT_URI`) — a bound request
+         *     marks the pending request `origin_bound`, unlocking own-app auto-approve on the consent
+         *     page; `scope` must be drawn from the grantable scope set. With
          *     `response_mode=web_message` the consent page postMessages the code back to the app
          *     popup-opener (so the user stays in the app); the default `query` mode full-redirects.
          */
@@ -686,7 +735,10 @@ export interface paths {
         };
         /**
          * Read a pending app-grant request (for the consent page)
-         * @description Returns the requesting app and the exact scopes (with descriptions) for the consent UI to render. Unguessable id; no auth.
+         * @description Returns the requesting app and the exact scopes (with descriptions) for the consent UI to
+         *     render, plus `app_owner` (the app's owner name) and `origin_bound` (the redirect origin is
+         *     verified to be this very app's subdomain) — together these let the consent page auto-approve
+         *     the signed-in owner's OWN app, matching the silent-bridge policy. Unguessable id; no auth.
          */
         get: operations["appGrantRequest"];
         put?: never;
@@ -763,8 +815,11 @@ export interface paths {
          * @description Called by the app from its own origin (CORS `*`). With `grant_type=authorization_code`
          *     (+ PKCE `code_verifier`) the node creates the persistent grant and returns a short-lived
          *     **scoped** access JWT (role `app`, the granted scopes, an `app_grant` claim) + a rotating
-         *     refresh token — never the owner's session. With `grant_type=refresh_token` it rotates the
-         *     refresh token and re-mints the access JWT. A revoked grant yields `401`.
+         *     refresh token — never the owner's session. The code-exchange response also carries `app`
+         *     (owner/filename) and `own` (origin-bound request approved by the app's own owner) so the
+         *     SDK's login-pill metadata matches the silent bridge. With `grant_type=refresh_token` it
+         *     rotates the refresh token and re-mints the access JWT **with the stored grant's scopes**
+         *     (a refresh never widens scopes on its own). A revoked grant yields `401`.
          */
         post: operations["appGrantToken"];
         delete?: never;
@@ -1606,6 +1661,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/prompts/appdev-flow": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Research-first appdev flow prompt (paste-able)
+         * @description The paste-able flow prompt a user gives an MCP-connected coding agent (Claude Code, OpenHands, Cursor) so every AIMEAT app build follows research → frame → propose → build → finish instead of coding cold: load node:aimeat-app-builder, call aimeat_appdev_overview, frame the tier/packs/iam decision, propose, build, then finish with agent face + template proposal + pitfall report. The user can always skip. Public.
+         */
+        get: operations["getAppdevFlowPrompt"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/library-packs": {
         parameters: {
             query?: never;
@@ -1614,7 +1689,7 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Library-pack registry index
+         * Library-pack registry index (community entries may carry self-reported proofs[] + proven_models)
          * @description The data-driven registry of every client-side library an AIMEAT app can include — SDK wrappers (/v1/libs), node-bundled cortex libs (/v1/cortex/<n>/libs) and vendored third-party capability packs (/lib). Compact index (no ai_doc/changelog): id, kind, category, description, rendered include line(s), requires, version, license, apiSurface, demoTemplateId, tierHint, interviewTriggers, sizeEstimate, status, scope, and (node packs) the optional AI-acceleration fields modelTier ("any" | "frontier" | "needs-doc" — the model strength a pack is reliably-and-accelerated on), proofs[] (the per-model AEB proof ledger: {model, verdict, testSet, evidence, tokens?, date}) and apiCaveat (for frontier packs — the one breaking-API idiom a weak model gets wrong from memory). See tools/aeb/acceleration-tiers.md. Two sources merge: scope "node" (the curated registry — every AI-facing library list derives from it: build-app prompt, GET /v1/libs, bootstrap, llms.txt) and scope "community" (active + public user-installed cortex extensions that ship a lib component; always status "preview", no tier/proofs — unvetted by the node). Public (CORS *).
          */
         get: operations["listLibraryPacks"];
@@ -1703,6 +1778,136 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/appdev/overview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * AppDev research overview (the big picture before building)
+         * @description One compact research surface for building apps ON AIMEAT: the caller's existing apps, library packs (per-model proof summaries), T1/T2/T3 app-shell templates, loadable skills (node:aimeat-app-builder first), curated + learned pitfalls (model-faceted), and prior template proposals. Indexes only with drill-down pointers; ?sections= for a partial fetch, ?model= for indicative model marking/filtering. Authenticated (owner or agent session).
+         */
+        get: operations["getAppdevOverview"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/appdev/pitfalls/learned": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The caller's learned appdev pitfalls (profile UI management surface)
+         * @description Full-body learned pitfall entries in the caller's owner scope (own GHII + every same-owner agent), any visibility; with include_shared=1 also other owners' public-shared entries (source: shared, read-only). Curated registry entries are served separately at GET /v1/appdev/pitfalls.
+         */
+        get: operations["listLearnedAppdevPitfalls"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/appdev/pitfalls/learned/{category}/{slug}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Delete an own learned pitfall (entry + manifest ref) */
+        delete: operations["deleteLearnedAppdevPitfall"];
+        options?: never;
+        head?: never;
+        /** Toggle share (platform-wide visibility) and/or status on an own learned pitfall */
+        patch: operations["updateLearnedAppdevPitfall"];
+        trace?: never;
+    };
+    "/v1/appdev/templates": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** The caller's agent-proposed app templates (full manifests) */
+        get: operations["listAppdevTemplateProposals"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/appdev/templates/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** One template proposal + the source app's live state */
+        get: operations["getAppdevTemplateProposal"];
+        put?: never;
+        post?: never;
+        /** Delete a template proposal */
+        delete: operations["deleteAppdevTemplateProposal"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/appdev/pitfalls": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Curated appdev-pitfall registry index
+         * @description Platform-level "what bites app builders" knowledge for AI agents building apps ON AIMEAT (apps, extensions, cortexes — never node development). Paginated index with total and facet counts (per applies-to scope and severity), sorted critical → warn → info. Public (CORS *).
+         */
+        get: operations["listAppdevPitfalls"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/appdev/pitfalls/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** One curated appdev pitfall (full entry) */
+        get: operations["getAppdevPitfall"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/memory": {
         parameters: {
             query?: never;
@@ -2026,6 +2231,402 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/apps/cost": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Per-app EXCHANGE cost & contracts surface (EXCHANGE G3 / TARGET-045)
+         * @description Owner-scoped read that composes an app's priced EXCHANGE dependencies so the app-catalog can show, per app: its active contracts (metered entitlements), live consumption (spend + calls against each budget), an estimated per-call / remaining-budget cost, and the platform rake. Attribution is by the entitlement's `appId`; the caller only ever sees entitlements whose consumer is their own owner (strictly cross-owner). Generic — any app with priced dependencies uses it. LLM-usage attribution is out of scope for slice-1 (the usage ledger has no appId dimension yet); this composes the entitlement spend, which IS the per-app metered consumption record. Response `data`: `{ app_id, owner_ghii, active_contracts, total_contracts, totals: { morsels: { spent_units, calls, contracts }, money: {...} }, contracts: [{ entitlement_id, capability, provider, contract_ref, state, unit, currency, price_per_call, rake_percent, rake_per_call, escrow_party, budget: { cap_units, spent_units, remaining_units, calls }, estimated_calls_remaining }] }`.
+         */
+        get: operations["appCost"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/entitlements": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the caller-owner's EXCHANGE entitlements (EXCHANGE / TARGET-045)
+         * @description Every metered entitlement the caller's owner holds as consumer, with live spend + budget. Response `data`: `{ entitlements: [{ entitlement_id, provider, ext, action, unit, price_per_call, rake_percent, contract_ref, state, budget: { cap_units, spent_units, remaining_units, calls } }] }`.
+         */
+        get: operations["exchangeListEntitlements"];
+        put?: never;
+        /**
+         * Accept an EXCHANGE contract → mint a metered entitlement (EXCHANGE / TARGET-045)
+         * @description The WRITE side of the metered entitlement. The caller's owner accepts a negotiated contract to call a provider's extension action at a metered price. The per-call PRICE is read authoritatively from the provider (the ext action, or the app-tool's listing) — the request supplies only the BUDGET cap and the contract ref, so a consumer can neither undercut the provider nor be charged an unaccepted price. The entitlement's consumer is always the caller's own owner (strictly cross-owner). PREFERRED: pass `offering_id` (works for both ext-action and app-tool offerings; an app-tool contract is pinned to the offering's interface version). LEGACY: pass `ext` + `action` + `contract_ref` for a raw ext-action. Body: `{ offering_id?, ext?, action?, contract_ref?, cap_units?, plan_id?, app_id?, escrow_party? }`. Response `data`: `{ entitlement: {...} }`.
+         */
+        post: operations["exchangeAcceptContract"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/entitlements/off": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Pause or revoke one of your EXCHANGE entitlements (EXCHANGE / TARGET-045)
+         * @description The consumer's off-switch. `mode: pause` is reversible (re-accept to resume); `mode: revoke` is terminal. Only the entitlement's own consumer may. Body: `{ ext, action, mode }`.
+         */
+        post: operations["exchangeEntitlementOff"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/proposals": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List contract-change proposals you are party to (EXCHANGE / TARGET-045)
+         * @description Every renegotiation proposal the caller is party to (incoming + outgoing), newest first. Returns `{ proposals, count }`.
+         */
+        get: operations["exchangeListProposals"];
+        put?: never;
+        /**
+         * Propose new terms for a live contract — renegotiation (EXCHANGE / TARGET-045)
+         * @description Either party renegotiates instead of blindly revoking + re-accepting. A consumer renegotiates their own contract; a PROVIDER renegotiates a specific consumer's contract (pass `consumer_gaii`). Propose a new per-call price and/or a new budget cap + a note. A message is delivered to the counterparty (Profile > Messages); nothing changes until they accept. Mutual consent is the authority. Body: `{ ext, action, consumer_gaii?, new_price_per_call?, new_cap_units?, note? }`. Returns `{ proposal }`.
+         */
+        post: operations["exchangeProposeChange"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/proposals/{id}/accept": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Accept a proposed contract change — supersede (EXCHANGE / TARGET-045)
+         * @description The COUNTERPARTY accepts: the old contract is archived to history (with its final spend + period) and a fresh one takes effect at the agreed terms. Returns `{ proposal, entitlement }`.
+         */
+        post: operations["exchangeAcceptProposal"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/proposals/{id}/decline": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Decline a proposed contract change (EXCHANGE / TARGET-045)
+         * @description The counterparty declines; the contract is unchanged. Returns `{ proposal }`.
+         */
+        post: operations["exchangeDeclineProposal"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/proposals/{id}/withdraw": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Withdraw your own pending contract-change proposal (EXCHANGE / TARGET-045)
+         * @description The PROPOSER withdraws a pending proposal. Returns `{ proposal }`.
+         */
+        post: operations["exchangeWithdrawProposal"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/entitlements/history": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Your PAST (archived / superseded) contracts as consumer (EXCHANGE / TARGET-045)
+         * @description Contracts that were superseded by a renegotiation, with the old terms + final spend + archived_at. Returns `{ history, count }`.
+         */
+        get: operations["exchangeEntitlementHistory"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/provider/history": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Your PAST (archived / superseded) contracts as provider (EXCHANGE / TARGET-045)
+         * @description Superseded contracts you sold, with the old terms + final spend. Returns `{ history, count }`.
+         */
+        get: operations["exchangeProviderHistory"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/work": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List your AGENT-WORK items (EXCHANGE / TARGET-045 Gap 2)
+         * @description `?role=consumer` (default) or `?role=provider`. Returns `{ work, count, role }`.
+         */
+        get: operations["exchangeListWork"];
+        put?: never;
+        /**
+         * Start an AGENT-WORK task under a contract — async, settled on delivery (EXCHANGE / TARGET-045 Gap 2)
+         * @description The CONSUMER starts a task against an agent-work offering they hold an active contract for. Body: `{ offering_id, input, note? }`. Nothing is charged yet — the per-task price is metered when the provider DELIVERS. Requires a contract first (else 402 NO_CONTRACT). Returns `{ work }`.
+         */
+        post: operations["exchangeStartWork"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/work/{id}/deliver": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Deliver an agent-work task → settle on delivery (EXCHANGE / TARGET-045 Gap 2)
+         * @description The PROVIDER delivers a task and is paid: the consumer is charged the per-task price, the provider is credited its cut, the platform rake is routed, the budget decremented — all ON DELIVERY. Body: `{ output, note? }`. A 402/429 (budget/rate) leaves the work open + unpaid. Returns `{ work }`.
+         */
+        post: operations["exchangeDeliverWork"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/info": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * EXCHANGE marketplace economics — the platform rake + units (EXCHANGE / TARGET-045)
+         * @description Public. Returns `{ rake_percent, rake_note, units, morsel_note }` — the platform fee applied to each metered call (the provider keeps the rest), set by the node operator via AIMEAT_COMMERCE_FEE_PERCENT / AIMEAT_MARKETPLACE_TX_FEE_PERCENT.
+         */
+        get: operations["exchangeInfo"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/offerings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Browse listed EXCHANGE offerings (public) — by capability or free text (TARGET-045)
+         * @description Public browse of listed supply. `?ext=&action=` matches a capability exactly; `?q=` free-text over title/description/tags; omit both for all listings. `?stats=1` folds usage/reputation (`stats: { activeContracts, totalContracts, totalCalls, totalSettledUnits, consumers, listedAt, lastUsedAt }`) into each listing. Cheapest base price first. Returns `{ offerings, count }`.
+         */
+        get: operations["exchangeBrowseOfferings"];
+        put?: never;
+        /**
+         * List a supply OFFERING — an ext action or an app-tool you own (EXCHANGE marketplace / TARGET-045)
+         * @description Publish a public supply listing. Two kinds. DEFAULT `kind: ext-action` — a priced action of an extension you own; price + plans read AUTHORITATIVELY from the action (`commercial`); body `{ ext, action, title?, description?, provenance?, usage_terms, tags? }`. `kind: app-tool` — a method your APP sells cross-app (a getCompanyBrief-style tool from your `apps.{appId}.tools` manifest); price + plans read from the tool; the tool MUST be bound to a capability (`action_id`) and is snapshot into an immutable, pinned INTERFACE VERSION (a schema/binding change mints a new version; existing contracts stay pinned to theirs); body `{ kind: 'app-tool', app_id, tool, title?, description?, provenance?, usage_terms, tags? }`. LEGIBILITY GATE (both): a non-empty input AND output schema is required (else 400 SCHEMA_REQUIRED) and `usage_terms` is required (else 400 USAGE_TERMS_REQUIRED). `usage_terms` = `{ derivatives?, resale?, attribution?, note? }`. Returns `{ offering }`.
+         */
+        post: operations["exchangeListOffering"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/offerings/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One EXCHANGE offering's full detail — I/O schema, call recipe, usage stats (public) (TARGET-045)
+         * @description Everything a human or agent needs to judge fit and integrate: the offering, the capability's `input_schema`/`output_schema`, a `call_recipe` (the contract IS the access — you call `POST /v1/ext/{ext}/{action}` as yourself, no separate API key), and usage `stats` (reputation). Public. Returns `{ offering, capability, call_recipe, stats }`.
+         */
+        get: operations["exchangeOfferingDetail"];
+        put?: never;
+        post?: never;
+        /** Delist one of your EXCHANGE offerings (TARGET-045) */
+        delete: operations["exchangeDelistOffering"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/offerings/{id}/consumers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Provider data-lineage — who holds contracts against your offering (owner only) (TARGET-045)
+         * @description The provider's consumption log: for each contract minted against this offering, the consuming identity, calls served, value settled, state, and last use — "where is my data used, by whom?". Owner-only (a stranger gets 404). Returns `{ offeringId, consumers, count }`.
+         */
+        get: operations["exchangeOfferingConsumers"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/needs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Browse EXCHANGE needs — `?open=1` open only, `?mine=1` your own (TARGET-045) */
+        get: operations["exchangeBrowseNeeds"];
+        put?: never;
+        /**
+         * Post an open NEED (demand) providers can bid on (EXCHANGE marketplace / TARGET-045)
+         * @description Publish a demand on behalf of a specific app. `app_id` is REQUIRED (a need is always app-bound). Body: `{ description, app_id, ext?, action?, spec?, usage_intent?, budget_unit?, budget_cap?, autonomy? }`. `spec` = `{ requiredFields?, format?, sample?, notes? }` — the minimum shape a fulfilment must return, so a provider (or an AI assessing candidates) can judge fit. Returns `{ need, matches }` (offerings already satisfying it, so you can accept directly).
+         */
+        post: operations["exchangePostNeed"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/needs/{id}/close": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Close one of your EXCHANGE needs (TARGET-045) */
+        post: operations["exchangeCloseNeed"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/needs/{id}/bids": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List bids on a NEED (public) (TARGET-045) */
+        get: operations["exchangeListBids"];
+        put?: never;
+        /**
+         * Bid on an open NEED with an action your extension owns (EXCHANGE / TARGET-045)
+         * @description Body: `{ ext, action, offering_id?, plan_id?, note? }`. Returns `{ bid }`.
+         */
+        post: operations["exchangeBidOnNeed"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/needs/{id}/bids/{bidId}/accept": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Accept a bid on your NEED → mint the metered entitlement (EXCHANGE / TARGET-045)
+         * @description The requester accepts a bid; mints the durable entitlement (consumer = you, provider = bidder), with the bid's plan + authoritative price. Optional body `{ cap_units }` overrides the need's budget cap. Marks the bid accepted + the need matched. Returns `{ entitlement_id, ext, action, unit, pricing }`.
+         */
+        post: operations["exchangeAcceptBid"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/ledger/billing": {
         parameters: {
             query?: never;
@@ -6483,6 +7084,9 @@ export interface paths {
          * @description Register a new human owner via the web portal. Creates an owner record,
          *     GHII, and profile. No authentication required. If email is provided,
          *     a verification code is sent and the response includes a verificationId.
+         *     When the node's email gate is on (`AIMEAT_EMAIL_CONFIRMATION_REQUIRED`),
+         *     an email is REQUIRED (missing → `400 EMAIL_REQUIRED`); an email already
+         *     verified on another account → `409 EMAIL_TAKEN`.
          */
         post: operations["ghiiRegisterWeb"];
         delete?: never;
@@ -8036,7 +8640,14 @@ export interface paths {
          *     emit code — a caller wanting an extra button uses `link` (navigation carries no authority).
          */
         post: operations["createNotification"];
-        delete?: never;
+        /**
+         * Clear the caller's notifications (the bell's "Clear all")
+         * @description Delete the caller's in-app notifications — the header bell's "Clear all". Unlike
+         *     POST /v1/notifications/read (which only marks them read), this REMOVES the rows. Owner-scoped:
+         *     only the caller's own notifications are affected. Omit the body (or send `{}`) to clear ALL;
+         *     pass `{ ids: [...] }` to delete just those.
+         */
+        delete: operations["clearNotifications"];
         options?: never;
         head?: never;
         patch?: never;
@@ -15417,6 +16028,12 @@ export interface paths {
          *     username or a full `username@node-id` (the node part must match this node). The first
          *     real owner is auto-granted the `operator` role. Returns the owner keypair once —
          *     the private key is never retrievable again. A welcome morsel bonus is granted.
+         *
+         *     When an `email` is supplied it is recorded and a verification code is sent (confirm via
+         *     `POST /v1/ghii/verify-email`); a `verification_id` is returned. When the node runs with the
+         *     email gate on (`AIMEAT_EMAIL_CONFIRMATION_REQUIRED`), an email is REQUIRED — registering
+         *     without one → `400 EMAIL_REQUIRED` (OAuth sign-in satisfies the gate, its IdP email being
+         *     verified at that instant). An email already verified on another account → `409 EMAIL_TAKEN`.
          */
         post: operations["registerGhii"];
         /**
@@ -20285,6 +20902,97 @@ export interface operations {
             };
         };
     };
+    unfurlLink: {
+        parameters: {
+            query: {
+                /** @description The http(s) URL to unfurl. */
+                url: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Preview metadata */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            url?: string;
+                            resolvedUrl?: string;
+                            title?: string | null;
+                            description?: string | null;
+                            /** @description Absolute image URL; fetch it via /v1/unfurl/image (the SPA CSP forbids remote image hosts). */
+                            image?: string | null;
+                            siteName?: string | null;
+                        };
+                    };
+                };
+            };
+            /** @description Missing or non-http(s) url parameter */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The link could not be fetched (blocked by the SSRF guard, timeout, or network error) */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    unfurlImage: {
+        parameters: {
+            query: {
+                /** @description The http(s) image URL to proxy. */
+                url: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The image bytes */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "image/*": string;
+                };
+            };
+            /** @description Missing or non-http(s) url parameter */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The URL did not resolve to an image */
+            415: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The image could not be fetched (blocked, timeout, or network error) */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     validateRequest: {
         parameters: {
             query?: never;
@@ -20954,7 +21662,14 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Owner name */
+                    /**
+                     * @description The target account: either the account HANDLE (e.g. `alice`) or the account's
+                     *     VERIFIED email address (case-insensitive). A value containing `@` is resolved as an
+                     *     email to the owning account's handle. No account with that verified email → 404
+                     *     `NO_ACCOUNT`; malformed email → 400 `INVALID_EMAIL`; (should-never-happen) more than
+                     *     one match → 409 `AMBIGUOUS`. The value only SELECTS which account this request targets
+                     *     — it is not an authentication factor (the human still approves the device code).
+                     */
                     owner: string;
                     /** @description Agent name (3-32 chars, lowercase alphanumeric + hyphens) */
                     agent_name: string;
@@ -20997,6 +21712,20 @@ export interface operations {
                 };
             };
             400: components["responses"]["BadRequest"];
+            /** @description `owner` was an email with no matching verified account (NO_ACCOUNT) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `owner` email maps to more than one account (AMBIGUOUS — invariant violation) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Too many pending requests for this owner */
             429: {
                 headers: {
@@ -22130,6 +22859,27 @@ export interface operations {
             };
         };
     };
+    getAppdevFlowPrompt: {
+        parameters: {
+            query?: {
+                /** @description txt returns the prompt as text/plain instead of the JSON envelope */
+                format?: "txt";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The flow prompt (JSON envelope, or text/plain with format=txt) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     listLibraryPacks: {
         parameters: {
             query?: {
@@ -22248,6 +22998,240 @@ export interface operations {
             };
         };
     };
+    getAppdevOverview: {
+        parameters: {
+            query?: {
+                model?: string;
+                /** @description Comma-separated subset of apps,library_packs,app_templates,skills,pitfalls_curated,pitfalls_learned,template_proposals */
+                sections?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The overview sections (indexes + drill-down pointers) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    listLearnedAppdevPitfalls: {
+        parameters: {
+            query?: {
+                include_shared?: boolean;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description data.pitfalls (full bodies) + data.total */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    deleteLearnedAppdevPitfall: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                category: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description data.deleted = true */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such learned pitfall in the caller's scope */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    updateLearnedAppdevPitfall: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                category: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description true = public (platform-wide) */
+                    share?: boolean;
+                    /** @enum {string} */
+                    status?: "active" | "outdated";
+                };
+            };
+        };
+        responses: {
+            /** @description The updated entry (data.pitfall) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            /** @description No such learned pitfall in the caller's scope */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listAppdevTemplateProposals: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description data.templates + data.total */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    getAppdevTemplateProposal: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description data.template + data.source_app */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such template proposal */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    deleteAppdevTemplateProposal: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description data.deleted = true */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such template proposal */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    listAppdevPitfalls: {
+        parameters: {
+            query?: {
+                applies_to?: "app" | "auth" | "ext" | "cortex" | "iam" | "realtime" | "ai" | "mobile" | "publish";
+                severity?: "info" | "warn" | "critical";
+                limit?: number;
+                offset?: number;
+                include_outdated?: boolean;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Paginated pitfall index (data.pitfalls, data.total, data.facets) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    getAppdevPitfall: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The pitfall entry (data.pitfall) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No such pitfall */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     listMemory: {
         parameters: {
             query?: {
@@ -22837,6 +23821,531 @@ export interface operations {
             403: components["responses"]["AimeatError"];
         };
     };
+    appCost: {
+        parameters: {
+            query: {
+                /** @description App id ("owner/filename") whose sourcing cost & contracts to return. */
+                app_id: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeListEntitlements: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeAcceptContract: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Preferred — contract an offering by id (ext-action or app-tool). Pins the app-tool interface version. */
+                    offering_id?: string;
+                    /** @description Legacy path — raw ext-action; required with action + contract_ref when offering_id is omitted. */
+                    ext?: string;
+                    action?: string;
+                    contract_ref?: string;
+                    /** @description Spend cap in the price unit (morsels */
+                    cap_units?: number;
+                    /** @description Consuming app id ("owner/filename") for the per-app cost surface. */
+                    app_id?: string;
+                    /** @enum {string} */
+                    escrow_party?: "consumer" | "provider";
+                    /** @description Optional provider pricing plan (bundle / subscription); omit for per-call at the base price. */
+                    plan_id?: string;
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeEntitlementOff: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    ext: string;
+                    action: string;
+                    /**
+                     * @default pause
+                     * @enum {string}
+                     */
+                    mode?: "pause" | "revoke";
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeListProposals: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeProposeChange: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    ext: string;
+                    action: string;
+                    /** @description Provider-side: the consumer whose contract to renegotiate. Omit when you are the consumer. */
+                    consumer_gaii?: string;
+                    /** @description New per-call price in the contract's unit (morsels, or money micro-units). Omit to leave unchanged. */
+                    new_price_per_call?: number;
+                    /** @description New budget cap. Omit to leave unchanged. */
+                    new_cap_units?: number;
+                    note?: string;
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeAcceptProposal: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+            409: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeDeclineProposal: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeWithdrawProposal: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeEntitlementHistory: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeProviderHistory: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeListWork: {
+        parameters: {
+            query?: {
+                role?: "consumer" | "provider";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeStartWork: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    offering_id: string;
+                    input?: unknown;
+                    note?: string;
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            402: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeDeliverWork: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    output?: unknown;
+                    note?: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            402: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+            409: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeInfo: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeBrowseOfferings: {
+        parameters: {
+            query?: {
+                ext?: string;
+                action?: string;
+                q?: string;
+                stats?: "1";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeListOffering: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @default ext-action
+                     * @enum {string}
+                     */
+                    kind?: "ext-action" | "app-tool" | "agent-work";
+                    /** @description ext-action kind — the extension name. */
+                    ext?: string;
+                    /** @description ext-action kind — the action id. */
+                    action?: string;
+                    /** @description app-tool kind — the app filename whose manifest holds the tool. */
+                    app_id?: string;
+                    /** @description app-tool kind — the tool name in apps.{app_id}.tools. */
+                    tool?: string;
+                    /** @description agent-work kind — your agent that performs the task. */
+                    agent_name?: string;
+                    /** @description agent-work kind — the task type it performs. */
+                    task_type?: string;
+                    /** @description agent-work kind — what the consumer sends (required). */
+                    input_schema?: Record<string, never>;
+                    /** @description agent-work kind — what the agent delivers (required). */
+                    output_schema?: Record<string, never>;
+                    /** @description agent-work kind — per-task morsel price. */
+                    price_morsels?: number;
+                    /** @description agent-work kind — per-task money price { amount (micros), currency }. */
+                    price_money?: Record<string, never>;
+                    /** @description agent-work kind — optional bundle/subscription plans. */
+                    plans?: Record<string, never>[];
+                    title?: string;
+                    description?: string;
+                    provenance?: Record<string, never>;
+                    tags?: string[];
+                    usage_terms: {
+                        derivatives?: boolean;
+                        resale?: boolean;
+                        attribution?: boolean;
+                        note?: string;
+                    };
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeOfferingDetail: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeDelistOffering: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeOfferingConsumers: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeBrowseNeeds: {
+        parameters: {
+            query?: {
+                open?: string;
+                mine?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangePostNeed: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    description: string;
+                    /** @description REQUIRED — the requesting app (owner/filename). A need is always posted on behalf of the app that needs the data. */
+                    app_id: string;
+                    ext?: string;
+                    action?: string;
+                    /** @description The interface the app is waiting to call. */
+                    spec?: {
+                        requiredFields?: string[];
+                        format?: string;
+                        sample?: string;
+                        notes?: string;
+                        /** @description The shape the app will SEND on each call. */
+                        inputSchema?: Record<string, never>;
+                        /** @description The shape the app EXPECTS back (a provider builds a matching app-tool). */
+                        outputSchema?: Record<string, never>;
+                    };
+                    /** @description How the requester will USE the data — lets a provider judge before serving. */
+                    usage_intent?: string;
+                    /** @enum {string} */
+                    budget_unit?: "money" | "morsels";
+                    budget_cap?: number;
+                    /** @enum {string} */
+                    autonomy?: "supervised" | "auto";
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeCloseNeed: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeListBids: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    exchangeBidOnNeed: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    ext: string;
+                    action: string;
+                    offering_id?: string;
+                    plan_id?: string;
+                    note?: string;
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+            409: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeAcceptBid: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                bidId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
     ledgerBilling: {
         parameters: {
             query?: {
@@ -33272,6 +34781,32 @@ export interface operations {
             };
         };
     };
+    clearNotifications: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Notification ids to clear (omit to clear all) */
+                    ids?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Count cleared ({ cleared }) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            401: components["responses"]["Unauthorized"];
+        };
+    };
     markNotificationsRead: {
         parameters: {
             query?: never;
@@ -46729,6 +48264,11 @@ export interface operations {
                     locale?: string;
                     /** @description Optional; min 8 chars */
                     password?: string;
+                    /**
+                     * Format: email
+                     * @description Optional; REQUIRED when the email gate is on. Recorded + a verification code sent.
+                     */
+                    email?: string;
                 };
             };
         };
@@ -46755,6 +48295,10 @@ export interface operations {
                                 name?: string;
                                 roles?: string[];
                             };
+                            /** @description Present when an email was supplied; confirm it via POST /v1/ghii/verify-email */
+                            verification_id?: string | null;
+                            /** @description Whether a verification email was dispatched (email service must be enabled) */
+                            email_sent?: boolean;
                             private_key?: string;
                             public_key?: string;
                             has_password?: boolean;
@@ -46763,8 +48307,20 @@ export interface operations {
                     };
                 };
             };
-            400: components["responses"]["BadRequest"];
-            409: components["responses"]["Conflict"];
+            /** @description Invalid input, or EMAIL_REQUIRED when the node's email gate is on and no email was supplied */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description NAME_TAKEN, or EMAIL_TAKEN when the email is already verified on another account */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     deleteGhii: {