hanzoai 2.2.10 → 2.2.11

package/dist/api/s3-api.js

@@ -97,66 +97,6 @@ const S3ApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
-        /**
-         * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-         * @summary Deletes one bucket from the shared object store and removes its metadata row.
-         * @param {string} name Name is the resource\'s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        deleteS3ByName: async (name, options = {}) => {
-            // verify required parameter 'name' is not null or undefined
-            (0, common_1.assertParamExists)('deleteS3ByName', 'name', name);
-            const localVarPath = `/v1/s3/{name}`
-                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication bearer required
-            // http bearer authentication required
-            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-         * @summary Lists the caller org\'s object-storage buckets.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getS3: async (options = {}) => {
-            const localVarPath = `/v1/s3`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication bearer required
-            // http bearer authentication required
-            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
         /**
          * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
          * @summary List your org\'s buckets
@@ -253,38 +193,6 @@ const S3ApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
-        /**
-         * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-         * @summary Returns one bucket\'s metadata.
-         * @param {string} name Name is the resource\'s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getS3ByName: async (name, options = {}) => {
-            // verify required parameter 'name' is not null or undefined
-            (0, common_1.assertParamExists)('getS3ByName', 'name', name);
-            const localVarPath = `/v1/s3/{name}`
-                .replace(`{${"name"}}`, encodeURIComponent(String(name)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication bearer required
-            // http bearer authentication required
-            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
         /**
          * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
          * @summary Whether object storage is usable here
@@ -313,37 +221,6 @@ const S3ApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
-        /**
-         * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-         * @summary Provision an object storage bucket for your org
-         * @param {ProvisionRequest} [provisionRequest]
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        postS3: async (provisionRequest, options = {}) => {
-            const localVarPath = `/v1/s3`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication bearer required
-            // http bearer authentication required
-            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            localVarHeaderParameter['Content-Type'] = 'application/json';
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(provisionRequest, localVarRequestOptions, configuration);
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
         /**
          * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
          * @summary Create a bucket in your org
@@ -441,31 +318,6 @@ const S3ApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.deleteS3BucketsByBucketObjectsByWildcard1']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
-        /**
-         * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-         * @summary Deletes one bucket from the shared object store and removes its metadata row.
-         * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async deleteS3ByName(name, options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.deleteS3ByName(name, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.deleteS3ByName']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-        /**
-         * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-         * @summary Lists the caller org\'s object-storage buckets.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async getS3(options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.getS3(options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.getS3']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
         /**
          * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
          * @summary List your org\'s buckets
@@ -505,19 +357,6 @@ const S3ApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.getS3BucketsByBucketObjectsByWildcard1']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
-        /**
-         * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-         * @summary Returns one bucket\'s metadata.
-         * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async getS3ByName(name, options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.getS3ByName(name, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.getS3ByName']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
         /**
          * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
          * @summary Whether object storage is usable here
@@ -530,19 +369,6 @@ const S3ApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.getS3Health']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
-        /**
-         * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-         * @summary Provision an object storage bucket for your org
-         * @param {ProvisionRequest} [provisionRequest]
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async postS3(provisionRequest, options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.postS3(provisionRequest, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = base_1.operationServerMap['S3Api.postS3']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
         /**
          * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
          * @summary Create a bucket in your org
@@ -598,25 +424,6 @@ const S3ApiFactory = function (configuration, basePath, axios) {
         deleteS3BucketsByBucketObjectsByWildcard1(requestParameters, options) {
             return localVarFp.deleteS3BucketsByBucketObjectsByWildcard1(requestParameters.bucket, requestParameters.wildcard1, options).then((request) => request(axios, basePath));
         },
-        /**
-         * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-         * @summary Deletes one bucket from the shared object store and removes its metadata row.
-         * @param {S3ApiDeleteS3ByNameRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        deleteS3ByName(requestParameters, options) {
-            return localVarFp.deleteS3ByName(requestParameters.name, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-         * @summary Lists the caller org\'s object-storage buckets.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getS3(options) {
-            return localVarFp.getS3(options).then((request) => request(axios, basePath));
-        },
         /**
          * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
          * @summary List your org\'s buckets
@@ -646,16 +453,6 @@ const S3ApiFactory = function (configuration, basePath, axios) {
         getS3BucketsByBucketObjectsByWildcard1(requestParameters, options) {
             return localVarFp.getS3BucketsByBucketObjectsByWildcard1(requestParameters.bucket, requestParameters.wildcard1, options).then((request) => request(axios, basePath));
         },
-        /**
-         * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-         * @summary Returns one bucket\'s metadata.
-         * @param {S3ApiGetS3ByNameRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getS3ByName(requestParameters, options) {
-            return localVarFp.getS3ByName(requestParameters.name, options).then((request) => request(axios, basePath));
-        },
         /**
          * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
          * @summary Whether object storage is usable here
@@ -665,16 +462,6 @@ const S3ApiFactory = function (configuration, basePath, axios) {
         getS3Health(options) {
             return localVarFp.getS3Health(options).then((request) => request(axios, basePath));
         },
-        /**
-         * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-         * @summary Provision an object storage bucket for your org
-         * @param {S3ApiPostS3Request} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        postS3(requestParameters = {}, options) {
-            return localVarFp.postS3(requestParameters.provisionRequest, options).then((request) => request(axios, basePath));
-        },
         /**
          * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
          * @summary Create a bucket in your org
@@ -726,27 +513,6 @@ class S3Api extends base_1.BaseAPI {
     deleteS3BucketsByBucketObjectsByWildcard1(requestParameters, options) {
         return (0, exports.S3ApiFp)(this.configuration).deleteS3BucketsByBucketObjectsByWildcard1(requestParameters.bucket, requestParameters.wildcard1, options).then((request) => request(this.axios, this.basePath));
     }
-    /**
-     * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one bucket from the shared object store and removes its metadata row.
-     * @param {S3ApiDeleteS3ByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    deleteS3ByName(requestParameters, options) {
-        return (0, exports.S3ApiFp)(this.configuration).deleteS3ByName(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-     * @summary Lists the caller org\'s object-storage buckets.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    getS3(options) {
-        return (0, exports.S3ApiFp)(this.configuration).getS3(options).then((request) => request(this.axios, this.basePath));
-    }
     /**
      * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary List your org\'s buckets
@@ -779,17 +545,6 @@ class S3Api extends base_1.BaseAPI {
     getS3BucketsByBucketObjectsByWildcard1(requestParameters, options) {
         return (0, exports.S3ApiFp)(this.configuration).getS3BucketsByBucketObjectsByWildcard1(requestParameters.bucket, requestParameters.wildcard1, options).then((request) => request(this.axios, this.basePath));
     }
-    /**
-     * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-     * @summary Returns one bucket\'s metadata.
-     * @param {S3ApiGetS3ByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    getS3ByName(requestParameters, options) {
-        return (0, exports.S3ApiFp)(this.configuration).getS3ByName(requestParameters.name, options).then((request) => request(this.axios, this.basePath));
-    }
     /**
      * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
      * @summary Whether object storage is usable here
@@ -800,17 +555,6 @@ class S3Api extends base_1.BaseAPI {
     getS3Health(options) {
         return (0, exports.S3ApiFp)(this.configuration).getS3Health(options).then((request) => request(this.axios, this.basePath));
     }
-    /**
-     * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision an object storage bucket for your org
-     * @param {S3ApiPostS3Request} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    postS3(requestParameters = {}, options) {
-        return (0, exports.S3ApiFp)(this.configuration).postS3(requestParameters.provisionRequest, options).then((request) => request(this.axios, this.basePath));
-    }
     /**
      * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary Create a bucket in your org

package/dist/api/search-api.d.ts

@@ -13,10 +13,8 @@ import type { Configuration } from '../configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import globalAxios from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
-import type { ProvisionRequest } from '../models';
-import type { ProvisionResult } from '../models';
-import type { ProvisionedResource } from '../models';
-import type { ProvisionedSummary } from '../models';
+import type { Request } from '../models';
+import type { Response } from '../models';
 import type { SearchIndexList } from '../models';
 import type { SearchStats } from '../models';
 /**
@@ -24,29 +22,6 @@ import type { SearchStats } from '../models';
  * @export
  */
 export declare const SearchApiAxiosParamCreator: (configuration?: Configuration) => {
-    /**
-     * Deletes one search index from the shared backend and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one search index from the shared backend and removes its metadata row.
-     * @param {string} name Name is the resource\'s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    deleteSearchByName: (name: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Lists the caller org\'s search indexes. An index is a logical resource inside an already-live shared backend, so every one of them is reached through the public gateway rather than at an instance of its own.
-     * @summary Lists the caller org\'s search indexes.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getSearch: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Returns one search index\'s metadata. It carries the index\'s status and the gateway address it is reached at, and no username: the backend authenticates with a shared, out-of-band key rather than a per-index credential.
-     * @summary Returns one search index\'s metadata.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getSearchByName: (name: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Lists the search indexes with their document counts and timestamps.  It reads the in-cluster Meilisearch service and reshapes its /stats and /indexes replies into the rows the console\'s Search panel renders. The read is degrade-friendly by design: an unreachable Meilisearch answers 200 with an EMPTY list, so the panel shows an honest empty state instead of an error. createdAt falls back to now and lastIndexedAt to null when the index list is unavailable.
      * @summary Lists the search indexes with their document counts and timestamps.
@@ -64,42 +39,19 @@ export declare const SearchApiAxiosParamCreator: (configuration?: Configuration)
      */
     getSearchStats: (authorization?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Creates a search index inside the already-running shared search backend and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision a search index for your org
-     * @param {ProvisionRequest} [provisionRequest]
+     * Is the typed op behind POST /v1/search. It does exactly two things the in-process entry point must not do: resolve the tenant from the validated principal, and refuse when there is none. Everything else is ForOrg.
+     * @summary Hybrid search over the org\'s own corpora
+     * @param {Request} request
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    postSearch: (provisionRequest?: ProvisionRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    search: (request: Request, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
 };
 /**
  * SearchApi - functional programming interface
  * @export
  */
 export declare const SearchApiFp: (configuration?: Configuration) => {
-    /**
-     * Deletes one search index from the shared backend and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one search index from the shared backend and removes its metadata row.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    deleteSearchByName(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
-    /**
-     * Lists the caller org\'s search indexes. An index is a logical resource inside an already-live shared backend, so every one of them is reached through the public gateway rather than at an instance of its own.
-     * @summary Lists the caller org\'s search indexes.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getSearch(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<ProvisionedSummary>>>;
-    /**
-     * Returns one search index\'s metadata. It carries the index\'s status and the gateway address it is reached at, and no username: the backend authenticates with a shared, out-of-band key rather than a per-index credential.
-     * @summary Returns one search index\'s metadata.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getSearchByName(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ProvisionedResource>>;
     /**
      * Lists the search indexes with their document counts and timestamps.  It reads the in-cluster Meilisearch service and reshapes its /stats and /indexes replies into the rows the console\'s Search panel renders. The read is degrade-friendly by design: an unreachable Meilisearch answers 200 with an EMPTY list, so the panel shows an honest empty state instead of an error. createdAt falls back to now and lastIndexedAt to null when the index list is unavailable.
      * @summary Lists the search indexes with their document counts and timestamps.
@@ -117,42 +69,19 @@ export declare const SearchApiFp: (configuration?: Configuration) => {
      */
     getSearchStats(authorization?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<SearchStats>>;
     /**
-     * Creates a search index inside the already-running shared search backend and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision a search index for your org
-     * @param {ProvisionRequest} [provisionRequest]
+     * Is the typed op behind POST /v1/search. It does exactly two things the in-process entry point must not do: resolve the tenant from the validated principal, and refuse when there is none. Everything else is ForOrg.
+     * @summary Hybrid search over the org\'s own corpora
+     * @param {Request} request
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    postSearch(provisionRequest?: ProvisionRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ProvisionResult>>;
+    search(request: Request, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Response>>;
 };
 /**
  * SearchApi - factory interface
  * @export
  */
 export declare const SearchApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
-    /**
-     * Deletes one search index from the shared backend and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one search index from the shared backend and removes its metadata row.
-     * @param {SearchApiDeleteSearchByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    deleteSearchByName(requestParameters: SearchApiDeleteSearchByNameRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
-    /**
-     * Lists the caller org\'s search indexes. An index is a logical resource inside an already-live shared backend, so every one of them is reached through the public gateway rather than at an instance of its own.
-     * @summary Lists the caller org\'s search indexes.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getSearch(options?: RawAxiosRequestConfig): AxiosPromise<Array<ProvisionedSummary>>;
-    /**
-     * Returns one search index\'s metadata. It carries the index\'s status and the gateway address it is reached at, and no username: the backend authenticates with a shared, out-of-band key rather than a per-index credential.
-     * @summary Returns one search index\'s metadata.
-     * @param {SearchApiGetSearchByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getSearchByName(requestParameters: SearchApiGetSearchByNameRequest, options?: RawAxiosRequestConfig): AxiosPromise<ProvisionedResource>;
     /**
      * Lists the search indexes with their document counts and timestamps.  It reads the in-cluster Meilisearch service and reshapes its /stats and /indexes replies into the rows the console\'s Search panel renders. The read is degrade-friendly by design: an unreachable Meilisearch answers 200 with an EMPTY list, so the panel shows an honest empty state instead of an error. createdAt falls back to now and lastIndexedAt to null when the index list is unavailable.
      * @summary Lists the search indexes with their document counts and timestamps.
@@ -170,40 +99,14 @@ export declare const SearchApiFactory: (configuration?: Configuration, basePath?
      */
     getSearchStats(requestParameters?: SearchApiGetSearchStatsRequest, options?: RawAxiosRequestConfig): AxiosPromise<SearchStats>;
     /**
-     * Creates a search index inside the already-running shared search backend and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision a search index for your org
-     * @param {SearchApiPostSearchRequest} requestParameters Request parameters.
+     * Is the typed op behind POST /v1/search. It does exactly two things the in-process entry point must not do: resolve the tenant from the validated principal, and refuse when there is none. Everything else is ForOrg.
+     * @summary Hybrid search over the org\'s own corpora
+     * @param {SearchApiSearchRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    postSearch(requestParameters?: SearchApiPostSearchRequest, options?: RawAxiosRequestConfig): AxiosPromise<ProvisionResult>;
+    search(requestParameters: SearchApiSearchRequest, options?: RawAxiosRequestConfig): AxiosPromise<Response>;
 };
-/**
- * Request parameters for deleteSearchByName operation in SearchApi.
- * @export
- * @interface SearchApiDeleteSearchByNameRequest
- */
-export interface SearchApiDeleteSearchByNameRequest {
-    /**
-     * Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @type {string}
-     * @memberof SearchApiDeleteSearchByName
-     */
-    readonly name: string;
-}
-/**
- * Request parameters for getSearchByName operation in SearchApi.
- * @export
- * @interface SearchApiGetSearchByNameRequest
- */
-export interface SearchApiGetSearchByNameRequest {
-    /**
-     * Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @type {string}
-     * @memberof SearchApiGetSearchByName
-     */
-    readonly name: string;
-}
 /**
  * Request parameters for getSearchIndexes operation in SearchApi.
  * @export
@@ -231,17 +134,17 @@ export interface SearchApiGetSearchStatsRequest {
     readonly authorization?: string;
 }
 /**
- * Request parameters for postSearch operation in SearchApi.
+ * Request parameters for search operation in SearchApi.
  * @export
- * @interface SearchApiPostSearchRequest
+ * @interface SearchApiSearchRequest
  */
-export interface SearchApiPostSearchRequest {
+export interface SearchApiSearchRequest {
     /**
      *
-     * @type {ProvisionRequest}
-     * @memberof SearchApiPostSearch
+     * @type {Request}
+     * @memberof SearchApiSearch
      */
-    readonly provisionRequest?: ProvisionRequest;
+    readonly request: Request;
 }
 /**
  * SearchApi - object-oriented interface
@@ -250,32 +153,6 @@ export interface SearchApiPostSearchRequest {
  * @extends {BaseAPI}
  */
 export declare class SearchApi extends BaseAPI {
-    /**
-     * Deletes one search index from the shared backend and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one search index from the shared backend and removes its metadata row.
-     * @param {SearchApiDeleteSearchByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof SearchApi
-     */
-    deleteSearchByName(requestParameters: SearchApiDeleteSearchByNameRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
-    /**
-     * Lists the caller org\'s search indexes. An index is a logical resource inside an already-live shared backend, so every one of them is reached through the public gateway rather than at an instance of its own.
-     * @summary Lists the caller org\'s search indexes.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof SearchApi
-     */
-    getSearch(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ProvisionedSummary[], any, {}>>;
-    /**
-     * Returns one search index\'s metadata. It carries the index\'s status and the gateway address it is reached at, and no username: the backend authenticates with a shared, out-of-band key rather than a per-index credential.
-     * @summary Returns one search index\'s metadata.
-     * @param {SearchApiGetSearchByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof SearchApi
-     */
-    getSearchByName(requestParameters: SearchApiGetSearchByNameRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ProvisionedResource, any, {}>>;
     /**
      * Lists the search indexes with their document counts and timestamps.  It reads the in-cluster Meilisearch service and reshapes its /stats and /indexes replies into the rows the console\'s Search panel renders. The read is degrade-friendly by design: an unreachable Meilisearch answers 200 with an EMPTY list, so the panel shows an honest empty state instead of an error. createdAt falls back to now and lastIndexedAt to null when the index list is unavailable.
      * @summary Lists the search indexes with their document counts and timestamps.
@@ -295,12 +172,12 @@ export declare class SearchApi extends BaseAPI {
      */
     getSearchStats(requestParameters?: SearchApiGetSearchStatsRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<SearchStats, any, {}>>;
     /**
-     * Creates a search index inside the already-running shared search backend and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision a search index for your org
-     * @param {SearchApiPostSearchRequest} requestParameters Request parameters.
+     * Is the typed op behind POST /v1/search. It does exactly two things the in-process entry point must not do: resolve the tenant from the validated principal, and refuse when there is none. Everything else is ForOrg.
+     * @summary Hybrid search over the org\'s own corpora
+     * @param {SearchApiSearchRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof SearchApi
      */
-    postSearch(requestParameters?: SearchApiPostSearchRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ProvisionResult, any, {}>>;
+    search(requestParameters: SearchApiSearchRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<Response, any, {}>>;
 }