aimeat 2.2.0 → 2.3.0

package/dist/src/generated/api-types.d.ts

@@ -738,7 +738,10 @@ export interface paths {
          * @description Returns the requesting app and the exact scopes (with descriptions) for the consent UI to
          *     render, plus `app_owner` (the app's owner name) and `origin_bound` (the redirect origin is
          *     verified to be this very app's subdomain) — together these let the consent page auto-approve
-         *     the signed-in owner's OWN app, matching the silent-bridge policy. Unguessable id; no auth.
+         *     the signed-in owner's OWN app, matching the silent-bridge policy. `app_icon` and
+         *     `app_description` come from the app manifest and are display-only: they give a first-time
+         *     visitor something to recognise the app BY, never part of the authorization decision.
+         *     Unguessable id; no auth.
          */
         get: operations["appGrantRequest"];
         put?: never;
@@ -763,8 +766,9 @@ export interface paths {
          * @description The owner, authenticated on the apex SPA, approves a pending request. The node mints a
          *     single-use authorization code and returns the app's `redirect_url` (carrying the code +
          *     state) for the browser to navigate back to the app. The optional `scopes` array grants a
-         *     SUBSET of the requested scopes (the "Advanced" picker) — values not in the request are
-         *     ignored; omit to grant everything requested.
+         *     SUBSET of the requested scopes (the consent page's per-scope checkboxes, revealed by "Show
+         *     the exact permissions") — values not in the request are ignored; omit to grant everything
+         *     requested.
          */
         post: operations["appGrantConsent"];
         delete?: never;
@@ -1661,6 +1665,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/prompts/build-extension": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Canonical "build an AIMEAT server extension" prompt
+         * @description The node-served, single-source-of-truth extension-building prompt — the SAME text the profile Extensions tab copies, so the tab, an agentic coder, the node:aimeat-extension-builder skill and llms.txt cannot drift apart. Covers the sandbox ctx surface (memory, fetch, files, caller, config, log, hash, now), the manifest and its input/output schemas, secret config fields, binary file I/O, the `commercial` block that prices an action and the `exchange` flag that lists it on the market, and how to install and activate the result. data.prompt is the complete copy-paste prompt; data.body is the platform core the tab wraps its own header around. Public.
+         */
+        get: operations["getBuildExtensionPrompt"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/prompts/appdev-flow": {
         parameters: {
             query?: never;
@@ -2260,7 +2284,7 @@ export interface paths {
         };
         /**
          * List the caller-owner's EXCHANGE entitlements (EXCHANGE / TARGET-045)
-         * @description Every metered entitlement the caller's owner holds as consumer, with live spend + budget. Response `data`: `{ entitlements: [{ entitlement_id, provider, ext, action, unit, price_per_call, rake_percent, contract_ref, state, budget: { cap_units, spent_units, remaining_units, calls } }] }`.
+         * @description Every metered entitlement the caller's owner holds as consumer, with live spend + budget. A right belongs to the HUMAN who pays for it, so one record covers the owner, their agents, their apps and their ecosystem apps alike; `callers` breaks the totals down by the principal that actually made each call. Response `data`: `{ entitlements: [{ entitlement_id, provider, ext, action, unit, price_per_call, rake_percent, contract_ref, state, budget: { cap_units, spent_units, remaining_units, calls }, callers: [{ gaii, calls, spent_units, carried_units, last_used_at }] }] }`.
          */
         get: operations["exchangeListEntitlements"];
         put?: never;
@@ -2295,6 +2319,90 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/app-grants/{grantId}/spend-cap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * How much of your money a connected app may spend
+         * @description The `contract:spend` scope answers WHETHER an app may buy on your behalf; this answers how much. A yes with no number is a blank cheque, and until an app could be named apart from its owner the question could not even be asked — an app grant presents the owner's own GHII, so at the money layer a call from an app was indistinguishable from the person's own. Body: `{ cap_morsels: number | null, reset?: boolean }`. GET /v1/app-grants carries the same three fields back (`can_spend`, `spend_cap_morsels`, `spent_morsels`) so Profile > Access can render the dial. `null` removes the ceiling (the scope alone); `0` stops the app spending without withdrawing anything else it was trusted with; `reset: true` puts the counter back to zero. Only morsel charges count against it — money is denominated in micro-units and summing the two into one ceiling would conflate different numbers. Owner-only.
+         */
+        patch: operations["appGrantSetSpendCap"];
+        trace?: never;
+    };
+    "/v1/exchange/entitlements/merge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Fold per-caller rights into the one right their owner holds (operator)
+         * @description Migration for rights minted before they were keyed to the owner. Only the human has a balance — `debitBalance` resolves every agent to its owner before touching a row — so a right keyed to the exact caller left one person holding several contracts for one product, all drawing on the one wallet. Once the key moved to the owner, those caller-keyed records stop resolving and their history would simply stop being found; this carries it across. Calls and spend are summed, each source becomes a row in the surviving record's caller breakdown, and every absorbed record is archived to contract history first. Surviving TERMS are the most recently created ones, because that is the last set the human agreed to; groups where an absorbed record priced differently are flagged `terms_changed`, because that changes what a call costs those callers. Rails are never merged (morsels and money micro-units are different numbers). Defaults to a DRY RUN — pass `{ "dry_run": false }` to apply. Operator-only.
+         */
+        post: operations["exchangeMergeEntitlements"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Everyone you are carrying, and what it has cost you
+         * @description Every grant the caller's owner has ISSUED, with the accumulated cost of each. `?app_id=` narrows to the grants one app's approvals created. Response `data`: `{ grants: [{ consumer_gaii, ext, action, capability, list_price_per_call, carried_units, cap_carried_units, reason, state, budget }], count, carried }`, where `carried` totals the cost per rail (morsels / EUR / USD).
+         */
+        get: operations["exchangeListGrants"];
+        put?: never;
+        /**
+         * Carry a consumer's access instead of billing them — issue an EXCHANGE grant
+         * @description The provider decides who may use their capability without paying for it: "only the members I approve may use this app; everyone else pays". A grant is an entitlement priced at zero over the provider's OWN listing, held in its own key space, so it never overwrites a contract the consumer bought and stepping aside returns them to it. It is read at the one settlement chokepoint every metered surface shares, so it holds on the app-tool endpoint, the raw extension route, the MCP twin and the commerce checkout alike. The consumer settles NOTHING in either half of the price — the pacing morsels burn from the PROVIDER's wallet, since a carried member paying the throttle is still a member paying. What the provider is giving away is counted (`carried_units` accumulates the list price per call) and can be bounded (`cap_carried_units`). Requires scope `exchange:grant`, so an app issuing these on an owner's approval must say so. Body: `{ consumer, offering_id, cap_carried_units?, note?, app_id?, reason? }`. Returns `{ grant }`.
+         */
+        post: operations["exchangeIssueGrant"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/exchange/grants/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Withdraw a grant — one, or every grant an app approval issued
+         * @description Immediate: the next call reads a non-active grant and falls back to whatever the consumer bought for themselves, which for most of them is nothing. Two forms — `{ consumer, offering_id }` for one, or `{ app_id, role?, consumer? }` for every grant issued under an approval being taken back, so an app demoting a member does not have to remember each listing. Provider-only; requires scope `exchange:grant`. Returns `{ revoked, grants }`.
+         */
+        post: operations["exchangeRevokeGrant"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/exchange/proposals": {
         parameters: {
             query?: never;
@@ -2419,6 +2527,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/exchange/earnings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * What you have EARNED and not yet been paid — the seller's accrued payables (EXCHANGE / TARGET-045)
+         * @description A money-priced metered call settles through the ACCRUAL rail: no per-call PSP charge and no custodial escrow — each call books the seller's net (price − platform rake) as a `pending` payable. This reads that book for the caller. Owner-scoped by the money identity (the same key the wallet uses), so an owner's agent or a granted app reads the OWNER's earnings and never another seller's; `wallet:read` gates non-owner principals. Returns `{ seller, currencies: { EUR: { pending, settled, total, entries } }, entries: [{ tracking_code, amount, currency, method, status, at, reference, buyer }], count, note }` — amounts in the currency's integer micro-units. READ-ONLY: it does not pay out, invoice, or move an entry from `pending` to `settled`.
+         */
+        get: operations["exchangeEarnings"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/exchange/work": {
         parameters: {
             query?: never;
@@ -3347,7 +3475,14 @@ export interface paths {
         /** List storage items */
         get: operations["listStorage"];
         put?: never;
-        /** Upload file */
+        /**
+         * Upload file
+         * @description Three request shapes. Prefer **presigned** for anything over ~1 KB: JSON with
+         *     `mode: "presigned"` stores no bytes and answers with an `upload_url` to `PUT` the raw file to
+         *     (see `PUT /v1/upload/{token}`). The inline JSON form base64-encodes the file into the request
+         *     body, which inflates it by 4/3 and must therefore fit inside the node's JSON body limit — a
+         *     ceiling separate from, and usually lower than, the storage quota.
+         */
         post: operations["uploadFile"];
         delete?: never;
         options?: never;
@@ -4588,7 +4723,7 @@ export interface paths {
         };
         /**
          * Which payout rails can pay you, and what each needs (owner) (TARGET-042)
-         * @description The seller's settlement rails reported apart, because they are different things: **Stripe** moves real currency (EUR/USD) to a connected account through a provider that holds the funds, while **x402** settles a stablecoin on-chain straight to an address you control, non-custodially, with the node holding no key. Returns `{ x402: { enabled, network, testnet, configured, address, currencies, assets, note }, stripe: { configured, provider, currencies, note } }`. `currencies` and `assets` are READ FROM THE NODE'S NETWORK REGISTRY, so they list only what this node can really settle: `assets` carries `{ currency, symbol, address, decimals }` per settleable currency (USD → USDC, EUR → EURC on the Base networks). ONE payout address receives every asset. A money sale over x402 with no address fails with SELLER_NO_X402_ADDRESS — this is the read that tells you before it happens.
+         * @description The seller's settlement rails reported apart, because they are different things: **Stripe** moves real currency (EUR/USD) onto YOUR OWN Stripe account using the secret key you brought (you are the merchant of record; the node holds neither key nor funds), **x402** settles a stablecoin on-chain straight to an address you control, and **invoice** captures nothing at all and books the obligation for you to bill offline. Returns `{ x402: { enabled, network, testnet, configured, address, currencies, assets, note }, stripe: { configured, provider, keyHint, currencies, note }, invoice: { available, currencies, note } }`. `currencies` and `assets` are READ FROM THE NODE'S NETWORK REGISTRY, so they list only what this node can really settle: `assets` carries `{ currency, symbol, address, decimals }` per settleable currency (USD → USDC, EUR → EURC on the Base networks). ONE payout address receives every asset. A money sale over x402 with no address fails with SELLER_NO_X402_ADDRESS — this is the read that tells you before it happens.
          */
         get: operations["commercePayoutStatus"];
         put?: never;
@@ -4623,6 +4758,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/commerce/payout/stripe": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set your own Stripe secret key for card settlement (owner)
+         * @description Stores the Stripe secret key that card sales of YOUR items settle on. There is no node-level or platform key: the charge runs on your account, you are the merchant of record, Stripe did your KYC, and this node holds neither the funds nor a claim on them. MERGED into your payment-settings record, so your x402 payout address is untouched. The secret is stored server-side and is NEVER returned by any endpoint; reads report only `keyHint` (last four characters). 400 INVALID_PSP unless `secret_key` is 8-200 characters. Responds `{ configured, provider, keyHint, note }`.
+         */
+        put: operations["commercePayoutStripeSet"];
+        post?: never;
+        /**
+         * Remove your Stripe credentials (owner)
+         * @description Clears only the Stripe credentials. Your x402 payout address is untouched and invoice settlement still works; card sales fail with PSP_NOT_CONFIGURED until credentials are set again.
+         */
+        delete: operations["commercePayoutStripeClear"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/commerce/checkout-sessions": {
         parameters: {
             query?: never;
@@ -4751,7 +4910,7 @@ export interface paths {
         };
         /**
          * WebMCP-shaped tool listing of an app (public)
-         * @description The app's PUBLIC apps.{appId}.tools manifest served as WebMCP tool descriptors (name, description, inputSchema — the fields document.modelContext.registerTool takes) plus the AIMEAT payment contract per tool: fulfillment 'call' | 'task', and for priced tools the morsel/micro-unit money price with a ready-made checkout line item. The page itself registers the same tools in-browser via /v1/libs/aimeat-webmcp.js. 404 when the app declares no public manifest (TARGET-034 phase C).
+         * @description The app's PUBLIC apps.{appId}.tools manifest served as WebMCP tool descriptors (name, description, inputSchema — the fields document.modelContext.registerTool takes) plus the AIMEAT payment contract per tool: fulfillment 'call' | 'task', and for priced tools the morsel/micro-unit money price with a ready-made checkout line item. The page itself registers the same tools in-browser via /v1/libs/aimeat-webmcp.js (TARGET-034 phase C). Also carries `app_surface`: the app's public agent-facing description — declared scopes, SKILL.md packs bound to the app, bundled crew-defs, and live EXCHANGE listings for its tools. A published app with no public tool manifest answers 200 with an empty `tools` array (and a manifest for an app this node does not host still lists its tools, without `app_surface`). 404 means neither exists, or the app is access-code gated, priced, or operator-hidden. A PRIVATE manifest reads exactly like an absent one.
          */
         get: operations["appWebmcpListing"];
         put?: never;
@@ -4793,7 +4952,7 @@ export interface paths {
         put?: never;
         /**
          * UCP checkout — create session
-         * @description Universal Commerce Protocol (2026-04-08) shaped checkout over the commerce core. Every response carries ucp.version + ucp.capabilities; the UCP-Agent header (platform profile URL) is fetched best-effort for capability negotiation. Item ids: "offer:<agentGaii>:<offerId>" or "org-offering:<owner>/<slug>:<agentGaii>:<offerId>".
+         * @description Universal Commerce Protocol (2026-04-08) shaped checkout over the commerce core. Every response carries ucp.version + ucp.capabilities; the UCP-Agent header (platform profile URL) is fetched best-effort for capability negotiation. Item ids: "offer:<agentGaii>:<offerId>" or "app-tool:<owner>/<appId>:<tool>".
          */
         post: operations["ucpCreateCheckoutSession"];
         delete?: never;
@@ -13119,11 +13278,8 @@ export interface paths {
         /**
          * Get merged agent directives
          * @description Returns the merged view of agent directives combining system defaults,
-         *     an optional edition-locked enterprise layer (company Secretary on the
-         *     Enterprise edition), owner defaults, and agent-specific overrides. Rules
-         *     are ordered by source priority: system, enterprise, owner, agent. The
-         *     enterprise layer is read-only (`locked:true`); `enterprise_locked` flags
-         *     its presence.
+         *     owner defaults, and agent-specific overrides, ordered by source priority:
+         *     system, owner, agent.
          */
         get: operations["getAgentDirectives"];
         /**
@@ -19220,14 +19376,10 @@ export interface components {
         };
         AgentDirectives: {
             purpose?: string;
-            /** @description True when an edition-locked enterprise directive layer is present (a company Secretary on the AIMEAT Enterprise edition). Such rules carry source 'enterprise' + locked:true and are read-only. */
-            enterprise_locked?: boolean;
             rules?: {
                 text?: string;
                 /** @enum {string} */
-                source?: "system" | "enterprise" | "owner" | "agent";
-                /** @description True for read-only enterprise-layer rules (cannot be edited via PUT). */
-                locked?: boolean;
+                source?: "system" | "owner" | "agent";
             }[];
             memoryAreas?: {
                 key?: string;
@@ -23049,6 +23201,33 @@ export interface operations {
             };
         };
     };
+    getBuildExtensionPrompt: {
+        parameters: {
+            query?: {
+                /** @description Language for the built extension's own user-facing text; the instructions stay English */
+                lang?: "en" | "fi";
+                /** @description The account the extension will be installed for, so namespaces read concretely (defaults to the caller when authenticated) */
+                owner?: string;
+                /** @description What the extension should do, embedded in the prompt header */
+                idea?: string;
+                /** @description txt returns the full prompt as text/plain instead of the JSON envelope */
+                format?: "txt";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The extension build prompt (JSON envelope with prompt + body, or text/plain with format=txt) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     getAppdevFlowPrompt: {
         parameters: {
             query?: {
@@ -24101,6 +24280,136 @@ export interface operations {
             404: components["responses"]["AimeatError"];
         };
     };
+    appGrantSetSpendCap: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                grantId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Ceiling in morsels across the life of the grant. null removes it. */
+                    cap_morsels?: number | null;
+                    /** @description Put the spent counter back to zero. */
+                    reset?: boolean;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeMergeEntitlements: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Report what would be merged without writing.
+                     * @default true
+                     */
+                    dry_run?: boolean;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeListGrants: {
+        parameters: {
+            query?: {
+                /** @description Only grants issued under this app's approvals. */
+                app_id?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeIssueGrant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The principal to carry — an owner name, their GHII, or one of their agents' GAII. Must resolve on this node; a name that no call would ever match is rejected rather than stored. */
+                    consumer: string;
+                    /** @description The provider's own listed offering. Someone else's is a 404. */
+                    offering_id: string;
+                    /** @description Ceiling on what the provider will carry, in the listing's unit. Omit for no ceiling. */
+                    cap_carried_units?: number;
+                    /** @description Free text the provider records with the approval. */
+                    note?: string;
+                    /** @description Consuming app id ("owner/filename") for the per-app cost surface. */
+                    app_id?: string;
+                    /** @description The app + role this grant stands for, so a demotion can withdraw exactly what the approval created. */
+                    reason?: {
+                        app_id?: string;
+                        role?: string;
+                    };
+                };
+            };
+        };
+        responses: {
+            201: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
+    exchangeRevokeGrant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    consumer?: string;
+                    /** @description Withdraw one grant; requires consumer. */
+                    offering_id?: string;
+                    /** @description Withdraw every grant this app's approvals issued. */
+                    app_id?: string;
+                    /** @description With app_id */
+                    role?: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+            404: components["responses"]["AimeatError"];
+        };
+    };
     exchangeListProposals: {
         parameters: {
             query?: never;
@@ -24215,6 +24524,27 @@ export interface operations {
             200: components["responses"]["AimeatSuccess"];
         };
     };
+    exchangeEarnings: {
+        parameters: {
+            query?: {
+                /** @description Only pending (owed) or settled (paid) entries. */
+                status?: "pending" | "settled";
+                /** @description Narrow to one currency (e.g. EUR). */
+                currency?: string;
+                /** @description Max payable records to read (default 200 */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+            403: components["responses"]["AimeatError"];
+        };
+    };
     exchangeListWork: {
         parameters: {
             query?: {
@@ -25462,6 +25792,17 @@ export interface operations {
                     };
                 };
             };
+            /**
+             * @description The payload was rejected. `error` carries the reason code from the shared manifest
+             *     validator for extension/cortex ZIPs (`INVALID_MANIFEST`, `MISSING_SCRIPT`,
+             *     `CODE_TOO_LARGE`, …) and `message` names the offending field.
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             /** @description Invalid token */
             401: {
                 headers: {
@@ -25469,7 +25810,20 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Token already used (single-use) */
+            /**
+             * @description The target already exists and belongs to another owner (extension uploads). The token
+             *     subject is what identifies the uploader; ownership is always checked.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description Token already used (single-use), or — for an extension upload without `update:true` in
+             *     the token meta — an extension of that name is already installed (`ALREADY_EXISTS`).
+             */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -25483,13 +25837,39 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description File exceeds size limit encoded in token */
+            /**
+             * @description `FILE_TOO_LARGE` — the body exceeds the per-file size limit encoded in the token, or
+             *     `QUOTA_EXCEEDED` — a storage upload would put the account over its total storage quota
+             *     (the same gate the inline `POST /v1/storage` applies; the token's limit caps one file,
+             *     the quota caps the account).
+             */
             413: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            /**
+             * @description Processing failed. The body carries a `reason` naming the failure. An extension upsert
+             *     whose storage write did not apply answers `UPDATE_FAILED` and states that the installed
+             *     version is unchanged — this endpoint never reports an unapplied write as success.
+             */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /**
+             * @description The manifest declares `type: secret` config but no encryption key is configured
+             *     (`ENCRYPTION_NOT_CONFIGURED`); set AIMEAT_ENCRYPTION_KEY.
+             */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     downloadViaToken: {
@@ -25564,6 +25944,24 @@ export interface operations {
         };
         requestBody: {
             content: {
+                "application/json": {
+                    key: string;
+                    /** @description Base64-encoded file bytes. Required unless `mode` is `presigned`. */
+                    data?: string;
+                    mime_type?: string;
+                    /**
+                     * @description Mint a one-shot upload URL instead of storing bytes now. The response carries `upload_url`, `upload_method`, `content_type`, `max_size_bytes` and `expires_in_seconds`.
+                     * @enum {string}
+                     */
+                    mode?: "presigned";
+                    /** @enum {string} */
+                    visibility?: "private" | "owner" | "group" | "workspace" | "members" | "public";
+                    /** @description Sharing group ID (required when visibility is 'group') */
+                    group_id?: string;
+                    /** @description One or more "{organismId}/{workspaceId}" (required when visibility is 'workspace'). */
+                    workspace_refs?: string[];
+                    federate?: boolean;
+                };
                 "multipart/form-data": {
                     /** Format: binary */
                     file?: string;
@@ -25576,8 +25974,22 @@ export interface operations {
             };
         };
         responses: {
+            /** @description Presigned mode — an upload URL was minted. No bytes were stored; `PUT` the file to `upload_url`. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
             201: components["responses"]["AimeatSuccess"];
-            /** @description Storage quota exceeded */
+            /** @description An anonymous principal targeted a key outside `anonymous/*`. Applies to both the inline and the presigned form: the namespace fence is on the write, not on the representation. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Storage quota exceeded, or the file exceeds the per-file size limit */
             413: {
                 headers: {
                     [name: string]: unknown;
@@ -27289,6 +27701,42 @@ export interface operations {
             401: components["responses"]["AimeatError"];
         };
     };
+    commercePayoutStripeSet: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Your Stripe secret key (sk_live_… or sk_test_…). */
+                    secret_key: string;
+                    /** @description Provider label, default 'stripe'. */
+                    provider?: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["AimeatError"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
+    commercePayoutStripeClear: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["AimeatError"];
+        };
+    };
     listCheckoutSessions: {
         parameters: {
             query?: {
@@ -27318,14 +27766,12 @@ export interface operations {
                          * @default offer
                          * @enum {string}
                          */
-                        kind?: "offer" | "org-offering" | "app-tool" | "ext-call";
+                        kind?: "offer" | "app-tool" | "ext-call";
                         /** @description Provider agent GAII (or bare name for own agent) */
                         agent?: string;
                         offer_id?: string;
                         /** @description app-tool: the tool name from apps.{appId}.tools; ext-call: the action id */
                         tool?: string;
-                        /** @description org-offering: "creatorOwner/slug" */
-                        org?: string;
                         /** @description app-tool: "ownerName/appId"; ext-call: the extension name */
                         app?: string;
                         /** @description app-tool: buyer input forwarded to the capability invoke at completion */
@@ -27520,7 +27966,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description WebMCP tool listing */
+            /** @description WebMCP tool listing + the app's public agent-facing surface */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -27529,7 +27975,7 @@ export interface operations {
                     "application/json": Record<string, never>;
                 };
             };
-            /** @description No public tool manifest */
+            /** @description No such public app (missing, access-code gated, priced, or operator-hidden) */
             404: {
                 headers: {
                     [name: string]: unknown;