hanzoai 2.2.10 → 8.5.89

package/dist/api/runner-api.js

@@ -30,67 +30,7 @@ const base_1 = require("../base");
 const RunnerApiAxiosParamCreator = function (configuration) {
     return {
         /**
-         * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-         * @summary Lists the self-publish releases this process has run.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getRunnerReleases: async (options = {}) => {
-            const localVarPath = `/v1/runner/releases`;
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication bearer required
-            // http bearer authentication required
-            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-         * @summary Returns one self-publish release by the id its 202 returned.
-         * @param {string} id ID is the build id the release trigger answered with, from the path.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getRunnerReleasesById: async (id, options = {}) => {
-            // verify required parameter 'id' is not null or undefined
-            (0, common_1.assertParamExists)('getRunnerReleasesById', 'id', id);
-            const localVarPath = `/v1/runner/releases/{id}`
-                .replace(`{${"id"}}`, encodeURIComponent(String(id)));
-            // use dummy base URL string because the URL constructor only accepts absolute URLs.
-            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
-            let baseOptions;
-            if (configuration) {
-                baseOptions = configuration.baseOptions;
-            }
-            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
-            const localVarHeaderParameter = {};
-            const localVarQueryParameter = {};
-            // authentication bearer required
-            // http bearer authentication required
-            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
-            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
-            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
-            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
-            return {
-                url: (0, common_1.toPathString)(localVarUrlObj),
-                options: localVarRequestOptions,
-            };
-        },
-        /**
-         * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+         * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
          * @summary Triggers a native build — an image, or the binaries a repo declares.
          * @param {RunnerBuildReq} runnerBuildReq
          * @param {*} [options] Override http request option.
@@ -133,32 +73,7 @@ const RunnerApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.RunnerApiAxiosParamCreator)(configuration);
     return {
         /**
-         * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-         * @summary Lists the self-publish releases this process has run.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async getRunnerReleases(options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.getRunnerReleases(options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = base_1.operationServerMap['RunnerApi.getRunnerReleases']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-        /**
-         * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-         * @summary Returns one self-publish release by the id its 202 returned.
-         * @param {string} id ID is the build id the release trigger answered with, from the path.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        async getRunnerReleasesById(id, options) {
-            const localVarAxiosArgs = await localVarAxiosParamCreator.getRunnerReleasesById(id, options);
-            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
-            const localVarOperationServerBasePath = base_1.operationServerMap['RunnerApi.getRunnerReleasesById']?.[localVarOperationServerIndex]?.url;
-            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
-        },
-        /**
-         * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+         * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
          * @summary Triggers a native build — an image, or the binaries a repo declares.
          * @param {RunnerBuildReq} runnerBuildReq
          * @param {*} [options] Override http request option.
@@ -181,26 +96,7 @@ const RunnerApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.RunnerApiFp)(configuration);
     return {
         /**
-         * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-         * @summary Lists the self-publish releases this process has run.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getRunnerReleases(options) {
-            return localVarFp.getRunnerReleases(options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-         * @summary Returns one self-publish release by the id its 202 returned.
-         * @param {RunnerApiGetRunnerReleasesByIdRequest} requestParameters Request parameters.
-         * @param {*} [options] Override http request option.
-         * @throws {RequiredError}
-         */
-        getRunnerReleasesById(requestParameters, options) {
-            return localVarFp.getRunnerReleasesById(requestParameters.id, options).then((request) => request(axios, basePath));
-        },
-        /**
-         * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+         * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
          * @summary Triggers a native build — an image, or the binaries a repo declares.
          * @param {RunnerApiPostRunnerRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -220,28 +116,7 @@ exports.RunnerApiFactory = RunnerApiFactory;
  */
 class RunnerApi extends base_1.BaseAPI {
     /**
-     * Lists the self-publish releases this process has run.  It lists the platform\'s own release runs with their current state, so a release that answered 202 with an id can be followed to its end. SuperAdmin only — this is the platform\'s own publishing record, not a tenant surface.  The record lives in THIS process\'s memory, so it covers the releases this instance started and does not survive a restart.
-     * @summary Lists the self-publish releases this process has run.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof RunnerApi
-     */
-    getRunnerReleases(options) {
-        return (0, exports.RunnerApiFp)(this.configuration).getRunnerReleases(options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * Returns one self-publish release by the id its 202 returned.  It returns the state of one release run — which is the whole reason the trigger answers with an id, because without this a release that died in the detached pipeline would look exactly like one still in flight. SuperAdmin only.  A 404 means the id is unknown OR has aged out of this process\'s in-memory record. That is the honest answer either way: the process genuinely cannot tell the two apart.
-     * @summary Returns one self-publish release by the id its 202 returned.
-     * @param {RunnerApiGetRunnerReleasesByIdRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof RunnerApi
-     */
-    getRunnerReleasesById(requestParameters, options) {
-        return (0, exports.RunnerApiFp)(this.configuration).getRunnerReleasesById(requestParameters.id, options).then((request) => request(this.axios, this.basePath));
-    }
-    /**
-     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build`, git-push-to-deploy and cloud\'s own self-release all call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both. `release: true` is the third mode: cloud self-publishing its own image, version computed, built, smoke-tested, tagged and announced.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  `release: true` is the exception, and takes SUPERADMIN. It publishes the platform\'s own image — the binary the whole fleet runs — so what it lands reaches every org at the next reconcile, and no role inside the caller\'s own org can authorize that. An org admin is refused however the registry namespace lines up, and the build token, which carries no identity at all, may enqueue an ordinary build but never a release.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
+     * Triggers a native build — an image, or the binaries a repo declares.  The fabric\'s own build trigger, and what `hanzo build` and git-push-to-deploy call. It answers 202 with the build job id: a queued build, not a pushed artifact.  Two lanes, and a build is exactly one of them. The IMAGE lane takes `repo` and the output `image` and launches a BuildKit Job that pushes it. The ARTIFACT lane takes `binaries` — the same recipe the repo\'s hanzo.yml declares — and publishes to object storage instead; it must carry no `image`, because a build produces binaries or an image, never both.  PRIVILEGED, with exactly two credentials and never a third: the shared build-callback token compared in constant time — the machine path, which a user never holds — or a validated IAM principal who is an ADMIN of their org, which is the `hanzo build` user path and means one IAM login authorizes a build with no separate build token. A plain member is refused.  Both paths are bounded the same way: the output must push to a registry the fabric owns, and on the IAM path the image\'s registry namespace must MATCH the caller\'s own validated org — so an org admin can only publish into their own brand and can never overwrite another\'s through the shared push credential. The same confinement applies to the artifact lane\'s repo owner.  The output image is parsed and validated as a single well-formed OCI ref before any authorization decision reads it, so a crafted ref cannot smuggle a build-exporter attribute past the check.
      * @summary Triggers a native build — an image, or the binaries a repo declares.
      * @param {RunnerApiPostRunnerRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.

package/dist/api/s3-api.d.ts

@@ -13,10 +13,6 @@ import type { Configuration } from '../configuration';
 import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import globalAxios from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
-import type { ProvisionRequest } from '../models';
-import type { ProvisionResult } from '../models';
-import type { ProvisionedResource } from '../models';
-import type { ProvisionedSummary } from '../models';
 /**
  * S3Api - axios parameter creator
  * @export
@@ -39,21 +35,6 @@ export declare const S3ApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     deleteS3BucketsByBucketObjectsByWildcard1: (bucket: string, wildcard1: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one bucket from the shared object store and removes its metadata row.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    deleteS3ByName: (name: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-     * @summary Lists the caller org\'s object-storage buckets.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getS3: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary List your org\'s buckets
@@ -78,14 +59,6 @@ export declare const S3ApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     getS3BucketsByBucketObjectsByWildcard1: (bucket: string, wildcard1: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-     * @summary Returns one bucket\'s metadata.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getS3ByName: (name: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
      * @summary Whether object storage is usable here
@@ -93,14 +66,6 @@ export declare const S3ApiAxiosParamCreator: (configuration?: Configuration) =>
      * @throws {RequiredError}
      */
     getS3Health: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
-    /**
-     * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision an object storage bucket for your org
-     * @param {ProvisionRequest} [provisionRequest]
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    postS3: (provisionRequest?: ProvisionRequest, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary Create a bucket in your org
@@ -139,21 +104,6 @@ export declare const S3ApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     deleteS3BucketsByBucketObjectsByWildcard1(bucket: string, wildcard1: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
-    /**
-     * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one bucket from the shared object store and removes its metadata row.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    deleteS3ByName(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
-    /**
-     * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-     * @summary Lists the caller org\'s object-storage buckets.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getS3(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<ProvisionedSummary>>>;
     /**
      * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary List your org\'s buckets
@@ -178,14 +128,6 @@ export declare const S3ApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getS3BucketsByBucketObjectsByWildcard1(bucket: string, wildcard1: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
-    /**
-     * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-     * @summary Returns one bucket\'s metadata.
-     * @param {string} name Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getS3ByName(name: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ProvisionedResource>>;
     /**
      * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
      * @summary Whether object storage is usable here
@@ -193,14 +135,6 @@ export declare const S3ApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getS3Health(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
-    /**
-     * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision an object storage bucket for your org
-     * @param {ProvisionRequest} [provisionRequest]
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    postS3(provisionRequest?: ProvisionRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ProvisionResult>>;
     /**
      * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary Create a bucket in your org
@@ -238,21 +172,6 @@ export declare const S3ApiFactory: (configuration?: Configuration, basePath?: st
      * @throws {RequiredError}
      */
     deleteS3BucketsByBucketObjectsByWildcard1(requestParameters: S3ApiDeleteS3BucketsByBucketObjectsByWildcard1Request, options?: RawAxiosRequestConfig): AxiosPromise<void>;
-    /**
-     * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one bucket from the shared object store and removes its metadata row.
-     * @param {S3ApiDeleteS3ByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    deleteS3ByName(requestParameters: S3ApiDeleteS3ByNameRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
-    /**
-     * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-     * @summary Lists the caller org\'s object-storage buckets.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getS3(options?: RawAxiosRequestConfig): AxiosPromise<Array<ProvisionedSummary>>;
     /**
      * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary List your org\'s buckets
@@ -276,14 +195,6 @@ export declare const S3ApiFactory: (configuration?: Configuration, basePath?: st
      * @throws {RequiredError}
      */
     getS3BucketsByBucketObjectsByWildcard1(requestParameters: S3ApiGetS3BucketsByBucketObjectsByWildcard1Request, options?: RawAxiosRequestConfig): AxiosPromise<void>;
-    /**
-     * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-     * @summary Returns one bucket\'s metadata.
-     * @param {S3ApiGetS3ByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    getS3ByName(requestParameters: S3ApiGetS3ByNameRequest, options?: RawAxiosRequestConfig): AxiosPromise<ProvisionedResource>;
     /**
      * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
      * @summary Whether object storage is usable here
@@ -291,14 +202,6 @@ export declare const S3ApiFactory: (configuration?: Configuration, basePath?: st
      * @throws {RequiredError}
      */
     getS3Health(options?: RawAxiosRequestConfig): AxiosPromise<void>;
-    /**
-     * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision an object storage bucket for your org
-     * @param {S3ApiPostS3Request} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     */
-    postS3(requestParameters?: S3ApiPostS3Request, options?: RawAxiosRequestConfig): AxiosPromise<ProvisionResult>;
     /**
      * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary Create a bucket in your org
@@ -347,19 +250,6 @@ export interface S3ApiDeleteS3BucketsByBucketObjectsByWildcard1Request {
      */
     readonly wildcard1: string;
 }
-/**
- * Request parameters for deleteS3ByName operation in S3Api.
- * @export
- * @interface S3ApiDeleteS3ByNameRequest
- */
-export interface S3ApiDeleteS3ByNameRequest {
-    /**
-     * Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @type {string}
-     * @memberof S3ApiDeleteS3ByName
-     */
-    readonly name: string;
-}
 /**
  * Request parameters for getS3BucketsByBucketObjects operation in S3Api.
  * @export
@@ -392,32 +282,6 @@ export interface S3ApiGetS3BucketsByBucketObjectsByWildcard1Request {
      */
     readonly wildcard1: string;
 }
-/**
- * Request parameters for getS3ByName operation in S3Api.
- * @export
- * @interface S3ApiGetS3ByNameRequest
- */
-export interface S3ApiGetS3ByNameRequest {
-    /**
-     * Name is the resource\&#39;s org-unique slug, from the path. Lower-cased and trimmed before lookup, exactly as it was at create.
-     * @type {string}
-     * @memberof S3ApiGetS3ByName
-     */
-    readonly name: string;
-}
-/**
- * Request parameters for postS3 operation in S3Api.
- * @export
- * @interface S3ApiPostS3Request
- */
-export interface S3ApiPostS3Request {
-    /**
-     *
-     * @type {ProvisionRequest}
-     * @memberof S3ApiPostS3
-     */
-    readonly provisionRequest?: ProvisionRequest;
-}
 /**
  * Request parameters for postS3BucketsByBucketObjects operation in S3Api.
  * @export
@@ -456,23 +320,6 @@ export declare class S3Api extends BaseAPI {
      * @memberof S3Api
      */
     deleteS3BucketsByBucketObjectsByWildcard1(requestParameters: S3ApiDeleteS3BucketsByBucketObjectsByWildcard1Request, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
-    /**
-     * Deletes one bucket from the shared object store and removes its metadata row. Answers 204 with no body; a second call is a 404.
-     * @summary Deletes one bucket from the shared object store and removes its metadata row.
-     * @param {S3ApiDeleteS3ByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    deleteS3ByName(requestParameters: S3ApiDeleteS3ByNameRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
-    /**
-     * Lists the caller org\'s object-storage buckets. A bucket lives in an already-live shared object store and is reached through the public gateway. The names here are the friendly ones the org provisioned; the physical bucket is org-namespaced underneath, which is what keeps two tenants\' buckets distinct.
-     * @summary Lists the caller org\'s object-storage buckets.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    getS3(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ProvisionedSummary[], any, {}>>;
     /**
      * Returns the caller\'s own buckets under the friendly names they were created with, each with its creation time.  Another tenant\'s bucket is not refused, it is INVISIBLE — a bucket outside the caller\'s namespace is skipped during the listing rather than reported, so the operation cannot be used to discover that a name is taken elsewhere.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary List your org\'s buckets
@@ -499,15 +346,6 @@ export declare class S3Api extends BaseAPI {
      * @memberof S3Api
      */
     getS3BucketsByBucketObjectsByWildcard1(requestParameters: S3ApiGetS3BucketsByBucketObjectsByWildcard1Request, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
-    /**
-     * Returns one bucket\'s metadata. It carries the bucket\'s status and the gateway address it is reached at, and no username: the object store authenticates with a shared, out-of-band key rather than a per-bucket credential.
-     * @summary Returns one bucket\'s metadata.
-     * @param {S3ApiGetS3ByNameRequest} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    getS3ByName(requestParameters: S3ApiGetS3ByNameRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ProvisionedResource, any, {}>>;
     /**
      * A real readiness probe rather than a liveness stub: 200 only when the storage credentials are present, and it additionally reports whether presigning is available — the capability the two URL-issuing operations need and refuse without.  An unconfigured deployment answers 503 with `ready:false` and the reason, which is the same state in which every data-plane operation here refuses. Not token-gated, so the platform can probe it without a credential, and it carries no credential, bucket or tenant detail.
      * @summary Whether object storage is usable here
@@ -516,15 +354,6 @@ export declare class S3Api extends BaseAPI {
      * @memberof S3Api
      */
     getS3Health(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
-    /**
-     * Creates an S3-compatible bucket inside the already-running shared object store and answers with the endpoint that reaches it.  `name` is the org-unique slug every physical name derives from, and must match ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$. `instance` optionally BINDS the add-on to one of your app instances: the DSN is injected into that instance\'s addons secret as <KIND>_URL, switching the app off its built-in store and onto this one. Omit it and the connection string is yours to wire.  THE CREDENTIAL COMES BACK ONCE. The connection string and password are in this response and nowhere else — every read beside it omits the password — so a caller that does not keep them has to provision again. Where KMS is configured the password is sealed there and only a reference is persisted; where it is not, it is returned this once and stored nowhere. It is never held in plaintext.  Scoped to the caller\'s validated org (403 without one), which also namespaces the physical resource under a fixed-width hash, so two tenants can never fold onto one backend resource — a residual collision fails closed with 409 rather than silently sharing. A name already taken in your org is 409; an invalid name or instance slug is 400; a backend that refuses the create is 502. Where a later step fails after the backend resource already exists, it is torn back down rather than left orphaned.  Billing is gated BEFORE anything is created: an unfunded org — or, in the fail-closed default, an unreachable meter — gets the fleet-wide 402/503 and nothing is provisioned. The fee is per-kind and set by the deployment.
-     * @summary Provision an object storage bucket for your org
-     * @param {S3ApiPostS3Request} requestParameters Request parameters.
-     * @param {*} [options] Override http request option.
-     * @throws {RequiredError}
-     * @memberof S3Api
-     */
-    postS3(requestParameters?: S3ApiPostS3Request, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ProvisionResult, any, {}>>;
     /**
      * Creates a new bucket in the caller\'s own namespace and answers 201 with its friendly name and creation time.  The name is validated exactly as sent and never quietly normalised: it must match `^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$`, so a mixed-case name is a clean 400 rather than a bucket created as `photos` that the caller keeps asking for as `Photos`. A name already in use in the caller\'s own namespace is 409.  A validated principal is required, and every bucket and key is resolved inside the caller\'s own org: physical bucket names are derived from the org, so a tenant cannot name another\'s storage. The operation is billed per call — the balance is checked BEFORE anything is touched, so an unfunded org is refused with nothing done, and the debit happens only after the work succeeds. Object storage that is not configured answers 503 under this subsystem\'s own name rather than falling through to another.
      * @summary Create a bucket in your org