hanzoai 2.2.10 → 8.5.89

package/dist/api/integrations-api.d.ts

@@ -35,6 +35,7 @@ import type { GithubPagesView } from '../models';
 import type { GithubReposOut } from '../models';
 import type { GithubSearchOut } from '../models';
 import type { GithubSearchReq } from '../models';
+import type { GitlabProjectsOut } from '../models';
 import type { ListOut } from '../models';
 import type { ProviderView } from '../models';
 import type { VerifyOut } from '../models';
@@ -117,6 +118,13 @@ export declare const IntegrationsApiAxiosParamCreator: (configuration?: Configur
      * @throws {RequiredError}
      */
     getIntegrationsGithubReposByRepoPages: (repo: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIntegrationsGitlabProjects: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
      * @summary Install the Hanzo app into a Slack workspace
@@ -417,6 +425,13 @@ export declare const IntegrationsApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getIntegrationsGithubReposByRepoPages(repo: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GithubPagesView>>;
+    /**
+     * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIntegrationsGitlabProjects(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GitlabProjectsOut>>;
     /**
      * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
      * @summary Install the Hanzo app into a Slack workspace
@@ -719,6 +734,13 @@ export declare const IntegrationsApiFactory: (configuration?: Configuration, bas
      * @throws {RequiredError}
      */
     getIntegrationsGithubReposByRepoPages(requestParameters: IntegrationsApiGetIntegrationsGithubReposByRepoPagesRequest, options?: RawAxiosRequestConfig): AxiosPromise<GithubPagesView>;
+    /**
+     * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getIntegrationsGitlabProjects(options?: RawAxiosRequestConfig): AxiosPromise<GitlabProjectsOut>;
     /**
      * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
      * @summary Install the Hanzo app into a Slack workspace
@@ -1256,6 +1278,14 @@ export declare class IntegrationsApi extends BaseAPI {
      * @memberof IntegrationsApi
      */
     getIntegrationsGithubReposByRepoPages(requestParameters: IntegrationsApiGetIntegrationsGithubReposByRepoPagesRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<GithubPagesView, any, {}>>;
+    /**
+     * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IntegrationsApi
+     */
+    getIntegrationsGitlabProjects(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<GitlabProjectsOut, any, {}>>;
     /**
      * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
      * @summary Install the Hanzo app into a Slack workspace

package/dist/api/integrations-api.js

@@ -325,6 +325,34 @@ const IntegrationsApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+         * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIntegrationsGitlabProjects: async (options = {}) => {
+            const localVarPath = `/v1/integrations/gitlab/projects`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
          * @summary Install the Hanzo app into a Slack workspace
@@ -1338,6 +1366,18 @@ const IntegrationsApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['IntegrationsApi.getIntegrationsGithubReposByRepoPages']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+         * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getIntegrationsGitlabProjects(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getIntegrationsGitlabProjects(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['IntegrationsApi.getIntegrationsGitlabProjects']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
          * @summary Install the Hanzo app into a Slack workspace
@@ -1805,6 +1845,15 @@ const IntegrationsApiFactory = function (configuration, basePath, axios) {
         getIntegrationsGithubReposByRepoPages(requestParameters, options) {
             return localVarFp.getIntegrationsGithubReposByRepoPages(requestParameters.repo, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+         * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getIntegrationsGitlabProjects(options) {
+            return localVarFp.getIntegrationsGitlabProjects(options).then((request) => request(axios, basePath));
+        },
         /**
          * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
          * @summary Install the Hanzo app into a Slack workspace
@@ -2192,6 +2241,16 @@ class IntegrationsApi extends base_1.BaseAPI {
     getIntegrationsGithubReposByRepoPages(requestParameters, options) {
         return (0, exports.IntegrationsApiFp)(this.configuration).getIntegrationsGithubReposByRepoPages(requestParameters.repo, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @summary Lists the projects the org\'s GitLab connection can reach — membership projects, most recently active first.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof IntegrationsApi
+     */
+    getIntegrationsGitlabProjects(options) {
+        return (0, exports.IntegrationsApiFp)(this.configuration).getIntegrationsGitlabProjects(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * The address behind Slack\'s \"Add to Slack\" and Marketplace Install buttons. It answers a 302 to Slack\'s own consent screen and does nothing else — it is a redirector by design.  It exists because Slack refuses a slack.com URL in that field and requires one of ours that redirects there, which makes the field an ATTRIBUTION hook: routing the click through our own address is what lets an install be counted, and always answering the redirect is what keeps the counter from becoming a detour that never reaches consent. The destination is the same consent URL every time, built from the same scopes the console\'s Connect button asks for, so a workspace is asked to grant one thing however the install began.  It is PUBLIC and carries no principal, because whoever clicks Install in Slack\'s directory has no Hanzo session yet. It binds no org either, and that is deliberate rather than missing: the org is resolved at the shared provider callback, from the signed state a console connect minted or from the workspace\'s existing connection. Minting an org for an anonymous click is the one thing that would break tenant isolation, so an install begun here finishes under exactly the rules every other install obeys.  Where the app is not configured it answers 503, rather than a consent URL carrying an empty client_id that Slack would render as its own dead-end error page.
      * @summary Install the Hanzo app into a Slack workspace

package/dist/api/o11y-api.d.ts

@@ -2597,7 +2597,7 @@ export declare const O11yApiAxiosParamCreator: (configuration?: Configuration) =
      */
     postO11yAlertsByReceiver: (receiver: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
      * @summary Receive a Sentry envelope on the SDK\'s own DSN path
      * @param {string} projectId
      * @param {*} [options] Override http request option.
@@ -5852,7 +5852,7 @@ export declare const O11yApiFp: (configuration?: Configuration) => {
      */
     postO11yAlertsByReceiver(receiver: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
-     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
      * @summary Receive a Sentry envelope on the SDK\'s own DSN path
      * @param {string} projectId
      * @param {*} [options] Override http request option.
@@ -8772,7 +8772,7 @@ export declare const O11yApiFactory: (configuration?: Configuration, basePath?:
      */
     postO11yAlertsByReceiver(requestParameters: O11yApiPostO11yAlertsByReceiverRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
-     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
      * @summary Receive a Sentry envelope on the SDK\'s own DSN path
      * @param {O11yApiPostO11yApiByProjectIdEnvelopeRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -18274,7 +18274,7 @@ export declare class O11yApi extends BaseAPI {
      */
     postO11yAlertsByReceiver(requestParameters: O11yApiPostO11yAlertsByReceiverRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
-     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
      * @summary Receive a Sentry envelope on the SDK\'s own DSN path
      * @param {O11yApiPostO11yApiByProjectIdEnvelopeRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/api/o11y-api.js

@@ -9127,7 +9127,7 @@ const O11yApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+         * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
          * @summary Receive a Sentry envelope on the SDK\'s own DSN path
          * @param {string} projectId
          * @param {*} [options] Override http request option.
@@ -16718,7 +16718,7 @@ const O11yApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+         * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
          * @summary Receive a Sentry envelope on the SDK\'s own DSN path
          * @param {string} projectId
          * @param {*} [options] Override http request option.
@@ -20730,7 +20730,7 @@ const O11yApiFactory = function (configuration, basePath, axios) {
             return localVarFp.postO11yAlertsByReceiver(requestParameters.receiver, options).then((request) => request(axios, basePath));
         },
         /**
-         * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+         * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
          * @summary Receive a Sentry envelope on the SDK\'s own DSN path
          * @param {O11yApiPostO11yApiByProjectIdEnvelopeRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -24586,7 +24586,7 @@ class O11yApi extends base_1.BaseAPI {
         return (0, exports.O11yApiFp)(this.configuration).postO11yAlertsByReceiver(requestParameters.receiver, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentry/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
+     * Accepts an application/x-sentry-envelope frame from a Sentry SDK — the batched wire format carrying events, sessions and attachments — and ingests it against the project named in the path.  THE /api/ SEGMENT IS NOT OURS TO NAME. An SDK appends its own fixed /api/<project>/envelope/ suffix to whatever DSN it is given, so this address is the SDK\'s, received verbatim. We receive this shape; we do not publish it. The clean spelling of the same wire is /v1/sentinel/{project}/envelope/.  AUTHENTICATED BY THE DSN PUBLIC KEY, never a Hanzo session, and therefore exempt from the principal gate: the ingest verifier checks the key in constant time, fails closed, and derives the org from it. A keyless submission is a 401 from that verifier — not a 403 from the gate, and not a 404 — which is how you tell the hops apart. The exemption is matched by method plus prefix plus suffix, never a bare prefix, so no read is reachable through it.
      * @summary Receive a Sentry envelope on the SDK\'s own DSN path
      * @param {O11yApiPostO11yApiByProjectIdEnvelopeRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/api/responses-api.d.ts

@@ -19,7 +19,7 @@ import { type RequestArgs, BaseAPI } from '../base';
  */
 export declare const ResponsesApiAxiosParamCreator: (configuration?: Configuration) => {
     /**
-     * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+     * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
      * @summary Implements POST /v1/responses.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -32,7 +32,7 @@ export declare const ResponsesApiAxiosParamCreator: (configuration?: Configurati
  */
 export declare const ResponsesApiFp: (configuration?: Configuration) => {
     /**
-     * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+     * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
      * @summary Implements POST /v1/responses.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -45,7 +45,7 @@ export declare const ResponsesApiFp: (configuration?: Configuration) => {
  */
 export declare const ResponsesApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
     /**
-     * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+     * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
      * @summary Implements POST /v1/responses.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -60,7 +60,7 @@ export declare const ResponsesApiFactory: (configuration?: Configuration, basePa
  */
 export declare class ResponsesApi extends BaseAPI {
     /**
-     * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+     * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
      * @summary Implements POST /v1/responses.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}

package/dist/api/responses-api.js

@@ -30,7 +30,7 @@ const base_1 = require("../base");
 const ResponsesApiAxiosParamCreator = function (configuration) {
     return {
         /**
-         * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+         * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
          * @summary Implements POST /v1/responses.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -68,7 +68,7 @@ const ResponsesApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.ResponsesApiAxiosParamCreator)(configuration);
     return {
         /**
-         * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+         * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
          * @summary Implements POST /v1/responses.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -90,7 +90,7 @@ const ResponsesApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.ResponsesApiFp)(configuration);
     return {
         /**
-         * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+         * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
          * @summary Implements POST /v1/responses.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -109,7 +109,7 @@ exports.ResponsesApiFactory = ResponsesApiFactory;
  */
 class ResponsesApi extends base_1.BaseAPI {
     /**
-     * Implements POST /v1/responses. The converted request is passed to ChatCompletions and an installed ResponseWriter converts its OpenAI chat JSON or SSE back into Responses JSON/SSE on the fly.
+     * Implements POST /v1/responses. The converted request is completed by the chat path, which is handed a sink saying where the answer goes: a stream is translated as it is produced, a whole body is translated entire.
      * @summary Implements POST /v1/responses.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}

package/dist/api/router-api.d.ts

@@ -13,7 +13,6 @@ import type { Configuration } from '../configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import globalAxios from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
-import type { Envelope } from '../models';
 /**
  * RouterApi - axios parameter creator
  * @export
@@ -248,7 +247,7 @@ export declare const RouterApiFp: (configuration?: Configuration) => {
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    deleteRouterData(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Envelope>>;
+    deleteRouterData(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]). It dispatches IN-PROCESS through dispatchGateway — the SAME canonical ZAP gateway registry (zap_registry.go) that the MsgType 200 handler serves over the gateway transport. The native ZAP handler is the ONE and ONLY implementation of these routes; this is purely the api.hanzo.ai HTTP binding, so there is NO controller twin to drift from and the split-brain the router refactor removed stays removed.  Why a bridge and not a twin controller method: every other migrated route (get-records, get-connections, …) carries BOTH a controller method and a ZAP handler — the exact dual-impl drift that silently NULLed customer router settings (the update-router-policy data-wipe). Routing these nouns through the ZAP handler over one adapter keeps a single source of truth.  Identity is the request\'s own Bearer credential (Authorization header), which the native handlers resolve exactly as the gateway does — every caller (console, chat, app) already sends it. The dispatched handler returns a ZAP message whose status is field 0 and body is field 4 (BuildCloudResponse / BuildGatewayResponse layout); both are relayed verbatim. The route is mapped \"*\" (any verb) because the native handler is method-aware: /v1/router/policy splits GET (read) vs PUT (write), /v1/org/settings GET/PUT/DELETE, and returns 405 for a verb it does not own.
      * @summary The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]).
@@ -290,7 +289,7 @@ export declare const RouterApiFp: (configuration?: Configuration) => {
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    getRouterData(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Envelope>>;
+    getRouterData(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]). It dispatches IN-PROCESS through dispatchGateway — the SAME canonical ZAP gateway registry (zap_registry.go) that the MsgType 200 handler serves over the gateway transport. The native ZAP handler is the ONE and ONLY implementation of these routes; this is purely the api.hanzo.ai HTTP binding, so there is NO controller twin to drift from and the split-brain the router refactor removed stays removed.  Why a bridge and not a twin controller method: every other migrated route (get-records, get-connections, …) carries BOTH a controller method and a ZAP handler — the exact dual-impl drift that silently NULLed customer router settings (the update-router-policy data-wipe). Routing these nouns through the ZAP handler over one adapter keeps a single source of truth.  Identity is the request\'s own Bearer credential (Authorization header), which the native handlers resolve exactly as the gateway does — every caller (console, chat, app) already sends it. The dispatched handler returns a ZAP message whose status is field 0 and body is field 4 (BuildCloudResponse / BuildGatewayResponse layout); both are relayed verbatim. The route is mapped \"*\" (any verb) because the native handler is method-aware: /v1/router/policy splits GET (read) vs PUT (write), /v1/org/settings GET/PUT/DELETE, and returns 405 for a verb it does not own.
      * @summary The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]).
@@ -464,7 +463,7 @@ export declare const RouterApiFactory: (configuration?: Configuration, basePath?
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    deleteRouterData(options?: RawAxiosRequestConfig): AxiosPromise<Envelope>;
+    deleteRouterData(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]). It dispatches IN-PROCESS through dispatchGateway — the SAME canonical ZAP gateway registry (zap_registry.go) that the MsgType 200 handler serves over the gateway transport. The native ZAP handler is the ONE and ONLY implementation of these routes; this is purely the api.hanzo.ai HTTP binding, so there is NO controller twin to drift from and the split-brain the router refactor removed stays removed.  Why a bridge and not a twin controller method: every other migrated route (get-records, get-connections, …) carries BOTH a controller method and a ZAP handler — the exact dual-impl drift that silently NULLed customer router settings (the update-router-policy data-wipe). Routing these nouns through the ZAP handler over one adapter keeps a single source of truth.  Identity is the request\'s own Bearer credential (Authorization header), which the native handlers resolve exactly as the gateway does — every caller (console, chat, app) already sends it. The dispatched handler returns a ZAP message whose status is field 0 and body is field 4 (BuildCloudResponse / BuildGatewayResponse layout); both are relayed verbatim. The route is mapped \"*\" (any verb) because the native handler is method-aware: /v1/router/policy splits GET (read) vs PUT (write), /v1/org/settings GET/PUT/DELETE, and returns 405 for a verb it does not own.
      * @summary The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]).
@@ -506,7 +505,7 @@ export declare const RouterApiFactory: (configuration?: Configuration, basePath?
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
-    getRouterData(options?: RawAxiosRequestConfig): AxiosPromise<Envelope>;
+    getRouterData(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]). It dispatches IN-PROCESS through dispatchGateway — the SAME canonical ZAP gateway registry (zap_registry.go) that the MsgType 200 handler serves over the gateway transport. The native ZAP handler is the ONE and ONLY implementation of these routes; this is purely the api.hanzo.ai HTTP binding, so there is NO controller twin to drift from and the split-brain the router refactor removed stays removed.  Why a bridge and not a twin controller method: every other migrated route (get-records, get-connections, …) carries BOTH a controller method and a ZAP handler — the exact dual-impl drift that silently NULLed customer router settings (the update-router-policy data-wipe). Routing these nouns through the ZAP handler over one adapter keeps a single source of truth.  Identity is the request\'s own Bearer credential (Authorization header), which the native handlers resolve exactly as the gateway does — every caller (console, chat, app) already sends it. The dispatched handler returns a ZAP message whose status is field 0 and body is field 4 (BuildCloudResponse / BuildGatewayResponse layout); both are relayed verbatim. The route is mapped \"*\" (any verb) because the native handler is method-aware: /v1/router/policy splits GET (read) vs PUT (write), /v1/org/settings GET/PUT/DELETE, and returns 405 for a verb it does not own.
      * @summary The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]).
@@ -684,7 +683,7 @@ export declare class RouterApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof RouterApi
      */
-    deleteRouterData(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<Envelope, any, {}>>;
+    deleteRouterData(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
      * The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]). It dispatches IN-PROCESS through dispatchGateway — the SAME canonical ZAP gateway registry (zap_registry.go) that the MsgType 200 handler serves over the gateway transport. The native ZAP handler is the ONE and ONLY implementation of these routes; this is purely the api.hanzo.ai HTTP binding, so there is NO controller twin to drift from and the split-brain the router refactor removed stays removed.  Why a bridge and not a twin controller method: every other migrated route (get-records, get-connections, …) carries BOTH a controller method and a ZAP handler — the exact dual-impl drift that silently NULLed customer router settings (the update-router-policy data-wipe). Routing these nouns through the ZAP handler over one adapter keeps a single source of truth.  Identity is the request\'s own Bearer credential (Authorization header), which the native handlers resolve exactly as the gateway does — every caller (console, chat, app) already sends it. The dispatched handler returns a ZAP message whose status is field 0 and body is field 4 (BuildCloudResponse / BuildGatewayResponse layout); both are relayed verbatim. The route is mapped \"*\" (any verb) because the native handler is method-aware: /v1/router/policy splits GET (read) vs PUT (write), /v1/org/settings GET/PUT/DELETE, and returns 405 for a verb it does not own.
      * @summary The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]).
@@ -732,7 +731,7 @@ export declare class RouterApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof RouterApi
      */
-    getRouterData(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<Envelope, any, {}>>;
+    getRouterData(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
      * The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]). It dispatches IN-PROCESS through dispatchGateway — the SAME canonical ZAP gateway registry (zap_registry.go) that the MsgType 200 handler serves over the gateway transport. The native ZAP handler is the ONE and ONLY implementation of these routes; this is purely the api.hanzo.ai HTTP binding, so there is NO controller twin to drift from and the split-brain the router refactor removed stays removed.  Why a bridge and not a twin controller method: every other migrated route (get-records, get-connections, …) carries BOTH a controller method and a ZAP handler — the exact dual-impl drift that silently NULLed customer router settings (the update-router-policy data-wipe). Routing these nouns through the ZAP handler over one adapter keeps a single source of truth.  Identity is the request\'s own Bearer credential (Authorization header), which the native handlers resolve exactly as the gateway does — every caller (console, chat, app) already sends it. The dispatched handler returns a ZAP message whose status is field 0 and body is field 4 (BuildCloudResponse / BuildGatewayResponse layout); both are relayed verbatim. The route is mapped \"*\" (any verb) because the native handler is method-aware: /v1/router/policy splits GET (read) vs PUT (write), /v1/org/settings GET/PUT/DELETE, and returns 405 for a verb it does not own.
      * @summary The HTTP transport binding for the RESTful router-config nouns (/v1/router/{policy,defaults,ledger,rewards,artifact-meta} and /v1/org/settings[/list]).

package/dist/api/runner-api.d.ts

@@ -13,32 +13,15 @@ import type { Configuration } from '../configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import globalAxios from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
-import type { ReleaseState } from '../models';
 import type { RunnerBuildReq } from '../models';
 import type { RunnerBuildResp } from '../models';
-import type { SelfReleaseList } from '../models';
 /**
  * RunnerApi - axios parameter creator
  * @export
  */
 export declare const RunnerApiAxiosParamCreator: (configuration?: Configuration) => {
     /**
-     * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-     * @summary Lists the self-publish releases this process has run.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getRunnerReleases: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-     * @summary Returns one self-publish release by the id its 202 returned.
-     * @param {string} id ID is the build id the release trigger answered with, from the path.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getRunnerReleasesById: (id: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
      * @summary Triggers a native build — an image, or the binaries a repo declares.
      * @param {RunnerBuildReq} runnerBuildReq
      * @param {*} [options] Override http request option.
@@ -52,22 +35,7 @@ export declare const RunnerApiAxiosParamCreator: (configuration?: Configuration)
  */
 export declare const RunnerApiFp: (configuration?: Configuration) => {
     /**
-     * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-     * @summary Lists the self-publish releases this process has run.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getRunnerReleases(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<SelfReleaseList>>;
-    /**
-     * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-     * @summary Returns one self-publish release by the id its 202 returned.
-     * @param {string} id ID is the build id the release trigger answered with, from the path.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getRunnerReleasesById(id: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ReleaseState>>;
-    /**
-     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
      * @summary Triggers a native build — an image, or the binaries a repo declares.
      * @param {RunnerBuildReq} runnerBuildReq
      * @param {*} [options] Override http request option.
@@ -81,22 +49,7 @@ export declare const RunnerApiFp: (configuration?: Configuration) => {
  */
 export declare const RunnerApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
     /**
-     * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-     * @summary Lists the self-publish releases this process has run.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getRunnerReleases(options?: RawAxiosRequestConfig): AxiosPromise<SelfReleaseList>;
-    /**
-     * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-     * @summary Returns one self-publish release by the id its 202 returned.
-     * @param {RunnerApiGetRunnerReleasesByIdRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getRunnerReleasesById(requestParameters: RunnerApiGetRunnerReleasesByIdRequest, options?: RawAxiosRequestConfig): AxiosPromise<ReleaseState>;
-    /**
-     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
      * @summary Triggers a native build — an image, or the binaries a repo declares.
      * @param {RunnerApiPostRunnerRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -104,19 +57,6 @@ export declare const RunnerApiFactory: (configuration?: Configuration, basePath?
      */
     postRunner(requestParameters: RunnerApiPostRunnerRequest, options?: RawAxiosRequestConfig): AxiosPromise<RunnerBuildResp>;
 };
-/**
- * Request parameters for getRunnerReleasesById operation in RunnerApi.
- * @export
- * @interface RunnerApiGetRunnerReleasesByIdRequest
- */
-export interface RunnerApiGetRunnerReleasesByIdRequest {
-    /**
-     * ID is the build id the release trigger answered with, from the path.
-     * @type {string}
-     * @memberof RunnerApiGetRunnerReleasesById
-     */
-    readonly id: string;
-}
 /**
  * Request parameters for postRunner operation in RunnerApi.
  * @export
@@ -138,24 +78,7 @@ export interface RunnerApiPostRunnerRequest {
  */
 export declare class RunnerApi extends BaseAPI {
     /**
-     * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-     * @summary Lists the self-publish releases this process has run.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof RunnerApi
-     */
-    getRunnerReleases(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<SelfReleaseList, any, {}>>;
-    /**
-     * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-     * @summary Returns one self-publish release by the id its 202 returned.
-     * @param {RunnerApiGetRunnerReleasesByIdRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof RunnerApi
-     */
-    getRunnerReleasesById(requestParameters: RunnerApiGetRunnerReleasesByIdRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ReleaseState, any, {}>>;
-    /**
-     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
      * @summary Triggers a native build — an image, or the binaries a repo declares.
      * @param {RunnerApiPostRunnerRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.