hanzoai 2.2.10 → 8.5.89

package/dist/api/billing-api.js

@@ -329,6 +329,34 @@ const BillingApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Returns the same balance /v1/billing/credit-balance reports, split by the tag each grant carries, so a reader can tell trial credit from bought credit and show the earliest expiry within each group. A console needs the split to say what will lapse and when; the single number cannot.  The subject is pinned to the caller before the handler runs, exactly as in the sibling reads, so the userId parameter can never name another tenant. A subject with no grants is an empty breakdown and a zero total, which is an answer and not an error.
+         * @summary What is left of your credit, grouped by where it came from
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getBillingCreditBalanceBreakdown: async (options = {}) => {
+            const localVarPath = `/v1/billing/credit-balance/breakdown`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Returns the caller org\'s credit grants — each with its original amount, what remains and when it expires — so a customer can see what was given and what is left before metered spend draws it down. It is a READ of the caller\'s own subject, pinned before the handler runs, so a grant belonging to another tenant is simply absent. Granting credit is not this route and never has been: minting lands on the mint-gated POST /v1/billing/credit, which no browser can reach. Reading an empty balance is an empty array, not an error.
          * @summary List the credit grants on your org\'s balance
@@ -757,6 +785,34 @@ const BillingApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Answers the one read the account page renders: the subject\'s resolved plan, the plan\'s included monthly allotment beside what was actually granted this period, consumption capped at that grant, the overage past it, and the spendable wallet (balance minus holds) — all for the current UTC month, every figure derived from the same transactions the gateway\'s balance gate reads, so this read can never disagree with the gate that admits the next call. It rides the same pinned chain as the sibling reads: the user parameter is overwritten with the validated caller\'s own billing subject before the handler runs, so it can never name another tenant; user is required, which only a service-to-service caller can omit and be refused 400 for, and plan is optional — omitted, it is resolved from the subject\'s subscription. The rule to get right is that the two sides are DIFFERENT MONEY: the included figures are usage the subscription grants and the wallet is prepaid credit the customer bought, so a reader who sums them invents a balance nobody holds — and before the period\'s first allotment grant runs, monthlyCents shows the plan\'s entitlement while grantedCents is zero, which is the figure consumption actually draws down.
+         * @summary What plan you are on and how much of it is left, beside the wallet
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getBillingUsageRollup: async (options = {}) => {
+            const localVarPath = `/v1/billing/usage/rollup`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Answers the receiving bank details for the brand this deployment serves — the account the funds actually land in, hydrated per brand rather than hard-coded — together with the payment reference to put on the transfer.  THE REFERENCE IS THE POINT. It carries your own billing key, and it is how an arriving wire is attributed to your account; a transfer sent without it arrives as an unidentified receipt. That is why this read is gated at all: an unpinned caller would be handed an unattributable reference.  Reading it credits nothing and reserves nothing. A wire is settled by an operator when the bank shows the funds, so the balance moves on receipt, not on this call.
          * @summary Where to wire funds, and the reference that credits them to you
@@ -1429,6 +1485,18 @@ const BillingApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['BillingApi.getBillingCreditBalance']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Returns the same balance /v1/billing/credit-balance reports, split by the tag each grant carries, so a reader can tell trial credit from bought credit and show the earliest expiry within each group. A console needs the split to say what will lapse and when; the single number cannot.  The subject is pinned to the caller before the handler runs, exactly as in the sibling reads, so the userId parameter can never name another tenant. A subject with no grants is an empty breakdown and a zero total, which is an answer and not an error.
+         * @summary What is left of your credit, grouped by where it came from
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getBillingCreditBalanceBreakdown(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getBillingCreditBalanceBreakdown(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['BillingApi.getBillingCreditBalanceBreakdown']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Returns the caller org\'s credit grants — each with its original amount, what remains and when it expires — so a customer can see what was given and what is left before metered spend draws it down. It is a READ of the caller\'s own subject, pinned before the handler runs, so a grant belonging to another tenant is simply absent. Granting credit is not this route and never has been: minting lands on the mint-gated POST /v1/billing/credit, which no browser can reach. Reading an empty balance is an empty array, not an error.
          * @summary List the credit grants on your org\'s balance
@@ -1611,6 +1679,18 @@ const BillingApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['BillingApi.getBillingUsageAccounts']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Answers the one read the account page renders: the subject\'s resolved plan, the plan\'s included monthly allotment beside what was actually granted this period, consumption capped at that grant, the overage past it, and the spendable wallet (balance minus holds) — all for the current UTC month, every figure derived from the same transactions the gateway\'s balance gate reads, so this read can never disagree with the gate that admits the next call. It rides the same pinned chain as the sibling reads: the user parameter is overwritten with the validated caller\'s own billing subject before the handler runs, so it can never name another tenant; user is required, which only a service-to-service caller can omit and be refused 400 for, and plan is optional — omitted, it is resolved from the subject\'s subscription. The rule to get right is that the two sides are DIFFERENT MONEY: the included figures are usage the subscription grants and the wallet is prepaid credit the customer bought, so a reader who sums them invents a balance nobody holds — and before the period\'s first allotment grant runs, monthlyCents shows the plan\'s entitlement while grantedCents is zero, which is the figure consumption actually draws down.
+         * @summary What plan you are on and how much of it is left, beside the wallet
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getBillingUsageRollup(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getBillingUsageRollup(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['BillingApi.getBillingUsageRollup']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Answers the receiving bank details for the brand this deployment serves — the account the funds actually land in, hydrated per brand rather than hard-coded — together with the payment reference to put on the transfer.  THE REFERENCE IS THE POINT. It carries your own billing key, and it is how an arriving wire is attributed to your account; a transfer sent without it arrives as an unidentified receipt. That is why this read is gated at all: an unpinned caller would be handed an unattributable reference.  Reading it credits nothing and reserves nothing. A wire is settled by an operator when the bank shows the funds, so the balance moves on receipt, not on this call.
          * @summary Where to wire funds, and the reference that credits them to you
@@ -1940,6 +2020,15 @@ const BillingApiFactory = function (configuration, basePath, axios) {
         getBillingCreditBalance(options) {
             return localVarFp.getBillingCreditBalance(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Returns the same balance /v1/billing/credit-balance reports, split by the tag each grant carries, so a reader can tell trial credit from bought credit and show the earliest expiry within each group. A console needs the split to say what will lapse and when; the single number cannot.  The subject is pinned to the caller before the handler runs, exactly as in the sibling reads, so the userId parameter can never name another tenant. A subject with no grants is an empty breakdown and a zero total, which is an answer and not an error.
+         * @summary What is left of your credit, grouped by where it came from
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getBillingCreditBalanceBreakdown(options) {
+            return localVarFp.getBillingCreditBalanceBreakdown(options).then((request) => request(axios, basePath));
+        },
         /**
          * Returns the caller org\'s credit grants — each with its original amount, what remains and when it expires — so a customer can see what was given and what is left before metered spend draws it down. It is a READ of the caller\'s own subject, pinned before the handler runs, so a grant belonging to another tenant is simply absent. Granting credit is not this route and never has been: minting lands on the mint-gated POST /v1/billing/credit, which no browser can reach. Reading an empty balance is an empty array, not an error.
          * @summary List the credit grants on your org\'s balance
@@ -2077,6 +2166,15 @@ const BillingApiFactory = function (configuration, basePath, axios) {
         getBillingUsageAccounts(options) {
             return localVarFp.getBillingUsageAccounts(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Answers the one read the account page renders: the subject\'s resolved plan, the plan\'s included monthly allotment beside what was actually granted this period, consumption capped at that grant, the overage past it, and the spendable wallet (balance minus holds) — all for the current UTC month, every figure derived from the same transactions the gateway\'s balance gate reads, so this read can never disagree with the gate that admits the next call. It rides the same pinned chain as the sibling reads: the user parameter is overwritten with the validated caller\'s own billing subject before the handler runs, so it can never name another tenant; user is required, which only a service-to-service caller can omit and be refused 400 for, and plan is optional — omitted, it is resolved from the subject\'s subscription. The rule to get right is that the two sides are DIFFERENT MONEY: the included figures are usage the subscription grants and the wallet is prepaid credit the customer bought, so a reader who sums them invents a balance nobody holds — and before the period\'s first allotment grant runs, monthlyCents shows the plan\'s entitlement while grantedCents is zero, which is the figure consumption actually draws down.
+         * @summary What plan you are on and how much of it is left, beside the wallet
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getBillingUsageRollup(options) {
+            return localVarFp.getBillingUsageRollup(options).then((request) => request(axios, basePath));
+        },
         /**
          * Answers the receiving bank details for the brand this deployment serves — the account the funds actually land in, hydrated per brand rather than hard-coded — together with the payment reference to put on the transfer.  THE REFERENCE IS THE POINT. It carries your own billing key, and it is how an arriving wire is attributed to your account; a transfer sent without it arrives as an unidentified receipt. That is why this read is gated at all: an unpinned caller would be handed an unattributable reference.  Reading it credits nothing and reserves nothing. A wire is settled by an operator when the bank shows the funds, so the balance moves on receipt, not on this call.
          * @summary Where to wire funds, and the reference that credits them to you
@@ -2362,6 +2460,16 @@ class BillingApi extends base_1.BaseAPI {
     getBillingCreditBalance(options) {
         return (0, exports.BillingApiFp)(this.configuration).getBillingCreditBalance(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Returns the same balance /v1/billing/credit-balance reports, split by the tag each grant carries, so a reader can tell trial credit from bought credit and show the earliest expiry within each group. A console needs the split to say what will lapse and when; the single number cannot.  The subject is pinned to the caller before the handler runs, exactly as in the sibling reads, so the userId parameter can never name another tenant. A subject with no grants is an empty breakdown and a zero total, which is an answer and not an error.
+     * @summary What is left of your credit, grouped by where it came from
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof BillingApi
+     */
+    getBillingCreditBalanceBreakdown(options) {
+        return (0, exports.BillingApiFp)(this.configuration).getBillingCreditBalanceBreakdown(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Returns the caller org\'s credit grants — each with its original amount, what remains and when it expires — so a customer can see what was given and what is left before metered spend draws it down. It is a READ of the caller\'s own subject, pinned before the handler runs, so a grant belonging to another tenant is simply absent. Granting credit is not this route and never has been: minting lands on the mint-gated POST /v1/billing/credit, which no browser can reach. Reading an empty balance is an empty array, not an error.
      * @summary List the credit grants on your org\'s balance
@@ -2514,6 +2622,16 @@ class BillingApi extends base_1.BaseAPI {
     getBillingUsageAccounts(options) {
         return (0, exports.BillingApiFp)(this.configuration).getBillingUsageAccounts(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Answers the one read the account page renders: the subject\'s resolved plan, the plan\'s included monthly allotment beside what was actually granted this period, consumption capped at that grant, the overage past it, and the spendable wallet (balance minus holds) — all for the current UTC month, every figure derived from the same transactions the gateway\'s balance gate reads, so this read can never disagree with the gate that admits the next call. It rides the same pinned chain as the sibling reads: the user parameter is overwritten with the validated caller\'s own billing subject before the handler runs, so it can never name another tenant; user is required, which only a service-to-service caller can omit and be refused 400 for, and plan is optional — omitted, it is resolved from the subject\'s subscription. The rule to get right is that the two sides are DIFFERENT MONEY: the included figures are usage the subscription grants and the wallet is prepaid credit the customer bought, so a reader who sums them invents a balance nobody holds — and before the period\'s first allotment grant runs, monthlyCents shows the plan\'s entitlement while grantedCents is zero, which is the figure consumption actually draws down.
+     * @summary What plan you are on and how much of it is left, beside the wallet
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof BillingApi
+     */
+    getBillingUsageRollup(options) {
+        return (0, exports.BillingApiFp)(this.configuration).getBillingUsageRollup(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Answers the receiving bank details for the brand this deployment serves — the account the funds actually land in, hydrated per brand rather than hard-coded — together with the payment reference to put on the transfer.  THE REFERENCE IS THE POINT. It carries your own billing key, and it is how an arriving wire is attributed to your account; a transfer sent without it arrives as an unidentified receipt. That is why this read is gated at all: an unpinned caller would be handed an unattributable reference.  Reading it credits nothing and reserves nothing. A wire is settled by an operator when the bank shows the funds, so the balance moves on receipt, not on this call.
      * @summary Where to wire funds, and the reference that credits them to you

package/dist/api/chat-api.d.ts

@@ -32,6 +32,13 @@ export declare const ChatApiAxiosParamCreator: (configuration?: Configuration) =
      * @throws {RequiredError}
      */
     postChatCompletions: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Serves one completion to a caller with no account.
+     * @summary Serves one completion to a caller with no account.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postChatPublic: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
 };
 /**
  * ChatApi - functional programming interface
@@ -52,6 +59,13 @@ export declare const ChatApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     postChatCompletions(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Serves one completion to a caller with no account.
+     * @summary Serves one completion to a caller with no account.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postChatPublic(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
 };
 /**
  * ChatApi - factory interface
@@ -72,6 +86,13 @@ export declare const ChatApiFactory: (configuration?: Configuration, basePath?:
      * @throws {RequiredError}
      */
     postChatCompletions(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Serves one completion to a caller with no account.
+     * @summary Serves one completion to a caller with no account.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postChatPublic(options?: RawAxiosRequestConfig): AxiosPromise<void>;
 };
 /**
  * ChatApi - object-oriented interface
@@ -96,4 +117,12 @@ export declare class ChatApi extends BaseAPI {
      * @memberof ChatApi
      */
     postChatCompletions(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
+    /**
+     * Serves one completion to a caller with no account.
+     * @summary Serves one completion to a caller with no account.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ChatApi
+     */
+    postChatPublic(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
 }

package/dist/api/chat-api.js

@@ -85,6 +85,34 @@ const ChatApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Serves one completion to a caller with no account.
+         * @summary Serves one completion to a caller with no account.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postChatPublic: async (options = {}) => {
+            const localVarPath = `/v1/chat/public`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
     };
 };
 exports.ChatApiAxiosParamCreator = ChatApiAxiosParamCreator;
@@ -119,6 +147,18 @@ const ChatApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['ChatApi.postChatCompletions']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Serves one completion to a caller with no account.
+         * @summary Serves one completion to a caller with no account.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async postChatPublic(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.postChatPublic(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['ChatApi.postChatPublic']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
     };
 };
 exports.ChatApiFp = ChatApiFp;
@@ -147,6 +187,15 @@ const ChatApiFactory = function (configuration, basePath, axios) {
         postChatCompletions(options) {
             return localVarFp.postChatCompletions(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Serves one completion to a caller with no account.
+         * @summary Serves one completion to a caller with no account.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postChatPublic(options) {
+            return localVarFp.postChatPublic(options).then((request) => request(axios, basePath));
+        },
     };
 };
 exports.ChatApiFactory = ChatApiFactory;
@@ -177,5 +226,15 @@ class ChatApi extends base_1.BaseAPI {
     postChatCompletions(options) {
         return (0, exports.ChatApiFp)(this.configuration).postChatCompletions(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Serves one completion to a caller with no account.
+     * @summary Serves one completion to a caller with no account.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ChatApi
+     */
+    postChatPublic(options) {
+        return (0, exports.ChatApiFp)(this.configuration).postChatPublic(options).then((request) => request(this.axios, this.basePath));
+    }
 }
 exports.ChatApi = ChatApi;

package/dist/api/compliance-api.d.ts

@@ -50,8 +50,8 @@ export declare const ComplianceApiAxiosParamCreator: (configuration?: Configurat
      */
     getComplianceAccreditationById: (id: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-     * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+     * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+     * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
      * @param {string} [result] Result filters rows by outcome result: success, deny, or error; empty means all.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -191,8 +191,8 @@ export declare const ComplianceApiFp: (configuration?: Configuration) => {
      */
     getComplianceAccreditationById(id: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AccView>>;
     /**
-     * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-     * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+     * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+     * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
      * @param {string} [result] Result filters rows by outcome result: success, deny, or error; empty means all.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -332,8 +332,8 @@ export declare const ComplianceApiFactory: (configuration?: Configuration, baseP
      */
     getComplianceAccreditationById(requestParameters: ComplianceApiGetComplianceAccreditationByIdRequest, options?: RawAxiosRequestConfig): AxiosPromise<AccView>;
     /**
-     * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-     * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+     * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+     * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
      * @param {ComplianceApiGetComplianceAuditRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -669,8 +669,8 @@ export declare class ComplianceApi extends BaseAPI {
      */
     getComplianceAccreditationById(requestParameters: ComplianceApiGetComplianceAccreditationByIdRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AccView, any, {}>>;
     /**
-     * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-     * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+     * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+     * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
      * @param {ComplianceApiGetComplianceAuditRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}

package/dist/api/compliance-api.js

@@ -94,8 +94,8 @@ const ComplianceApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-         * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+         * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+         * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
          * @param {string} [result] Result filters rows by outcome result: success, deny, or error; empty means all.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -611,8 +611,8 @@ const ComplianceApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-         * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+         * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+         * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
          * @param {string} [result] Result filters rows by outcome result: success, deny, or error; empty means all.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -835,8 +835,8 @@ const ComplianceApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getComplianceAccreditationById(requestParameters.id, options).then((request) => request(axios, basePath));
         },
         /**
-         * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-         * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+         * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+         * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
          * @param {ComplianceApiGetComplianceAuditRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -1014,8 +1014,8 @@ class ComplianceApi extends base_1.BaseAPI {
         return (0, exports.ComplianceApiFp)(this.configuration).getComplianceAccreditationById(requestParameters.id, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
-     * @summary AuditRead is the compliance-scoped read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
+     * AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when). The org is PINNED to the caller\'s validated org and the rows are narrowed to compliance.* actions. Fail-closed: no principal is a 403, no configured audit store a 501.
+     * @summary AuditRead is the compliance read of the SHARED tamper-evident audit plane — the SOC 2 posture surface (privileged actions: who started/decided what, when).
      * @param {ComplianceApiGetComplianceAuditRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}

package/dist/api/default-api.d.ts

@@ -268,6 +268,13 @@ export declare const DefaultApiAxiosParamCreator: (configuration?: Configuration
      * @throws {RequiredError}
      */
     getWellKnownOauthAuthorizationServer: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+     * @summary The API description, at the conventional address
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getWellKnownOpenapiJson: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
      * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
@@ -676,6 +683,13 @@ export declare const DefaultApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     getWellKnownOauthAuthorizationServer(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+     * @summary The API description, at the conventional address
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getWellKnownOpenapiJson(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
      * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
@@ -1069,6 +1083,13 @@ export declare const DefaultApiFactory: (configuration?: Configuration, basePath
      * @throws {RequiredError}
      */
     getWellKnownOauthAuthorizationServer(options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+     * @summary The API description, at the conventional address
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getWellKnownOpenapiJson(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
      * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
@@ -1978,6 +1999,14 @@ export declare class DefaultApi extends BaseAPI {
      * @memberof DefaultApi
      */
     getWellKnownOauthAuthorizationServer(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
+    /**
+     * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+     * @summary The API description, at the conventional address
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof DefaultApi
+     */
+    getWellKnownOpenapiJson(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
      * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
      * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.

package/dist/api/default-api.js

@@ -1014,6 +1014,31 @@ const DefaultApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+         * @summary The API description, at the conventional address
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getWellKnownOpenapiJson: async (options = {}) => {
+            const localVarPath = `/.well-known/openapi.json`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
          * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
@@ -2043,6 +2068,18 @@ const DefaultApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['DefaultApi.getWellKnownOauthAuthorizationServer']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+         * @summary The API description, at the conventional address
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getWellKnownOpenapiJson(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getWellKnownOpenapiJson(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['DefaultApi.getWellKnownOpenapiJson']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
          * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
@@ -2597,6 +2634,15 @@ const DefaultApiFactory = function (configuration, basePath, axios) {
         getWellKnownOauthAuthorizationServer(options) {
             return localVarFp.getWellKnownOauthAuthorizationServer(options).then((request) => request(axios, basePath));
         },
+        /**
+         * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+         * @summary The API description, at the conventional address
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getWellKnownOpenapiJson(options) {
+            return localVarFp.getWellKnownOpenapiJson(options).then((request) => request(axios, basePath));
+        },
         /**
          * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
          * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.
@@ -3114,6 +3160,16 @@ class DefaultApi extends base_1.BaseAPI {
     getWellKnownOauthAuthorizationServer(options) {
         return (0, exports.DefaultApiFp)(this.configuration).getWellKnownOauthAuthorizationServer(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * The same document /v1/openapi.json serves, at the address RFC 8615 reserves for discovery — one handler over one render, so the two cannot describe different APIs.  It exists because a client that has never seen this API probes here first. Prefer /v1/openapi.json when you already know the API: it is canonical, and it is what the document\'s own self-description names.
+     * @summary The API description, at the conventional address
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof DefaultApi
+     */
+    getWellKnownOpenapiJson(options) {
+        return (0, exports.DefaultApiFp)(this.configuration).getWellKnownOpenapiJson(options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.  It advertises only what is actually implemented, so a client that reads it cannot ask for a flow that will fail: the authorization-code flow, PKCE with S256, the supported grants, and the signing algorithms whose public keys the JWKS really publishes.  The issuer is derived from the host you asked on and is the same value the tokens carry, so a client that pins the issuer never sees it change.
      * @summary Returns the OpenID Connect discovery document — the one URL you point a standards-compliant client at so it can find every other endpoint on its own, instead of you configuring them by hand.