hanzoai 8.5.718 → 8.5.719

package/dist/api/agent-api.d.ts

@@ -286,7 +286,7 @@ export declare const AgentApiAxiosParamCreator: (configuration?: Configuration)
      */
     getAgentSessions: (root?: string, parent?: string, status?: string, project?: string, room?: string, kind?: string, limit?: number, after?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {string} id ID is the session to act on, from the path.
      * @param {*} [options] Override http request option.
@@ -326,7 +326,7 @@ export declare const AgentApiAxiosParamCreator: (configuration?: Configuration)
      */
     getAgentSessionsStream: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -780,7 +780,7 @@ export declare const AgentApiFp: (configuration?: Configuration) => {
      */
     getAgentSessions(root?: string, parent?: string, status?: string, project?: string, room?: string, kind?: string, limit?: number, after?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AgentSessionList>>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {string} id ID is the session to act on, from the path.
      * @param {*} [options] Override http request option.
@@ -820,7 +820,7 @@ export declare const AgentApiFp: (configuration?: Configuration) => {
      */
     getAgentSessionsStream(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -1258,7 +1258,7 @@ export declare const AgentApiFactory: (configuration?: Configuration, basePath?:
      */
     getAgentSessions(requestParameters?: AgentApiGetAgentSessionsRequest, options?: RawAxiosRequestConfig): AxiosPromise<AgentSessionList>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {AgentApiGetAgentSessionsByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -1297,7 +1297,7 @@ export declare const AgentApiFactory: (configuration?: Configuration, basePath?:
      */
     getAgentSessionsStream(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -2532,7 +2532,7 @@ export declare class AgentApi extends BaseAPI {
      */
     getAgentSessions(requestParameters?: AgentApiGetAgentSessionsRequest, options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<AgentSessionList, any, {}>>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {AgentApiGetAgentSessionsByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -2576,7 +2576,7 @@ export declare class AgentApi extends BaseAPI {
      */
     getAgentSessionsStream(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<void, any, {}>>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}

package/dist/api/agent-api.js

@@ -934,7 +934,7 @@ const AgentApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+         * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
          * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
          * @param {string} id ID is the session to act on, from the path.
          * @param {*} [options] Override http request option.
@@ -1094,7 +1094,7 @@ const AgentApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+         * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
          * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -2367,7 +2367,7 @@ const AgentApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+         * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
          * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
          * @param {string} id ID is the session to act on, from the path.
          * @param {*} [options] Override http request option.
@@ -2432,7 +2432,7 @@ const AgentApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+         * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
          * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -3063,7 +3063,7 @@ const AgentApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getAgentSessions(requestParameters.root, requestParameters.parent, requestParameters.status, requestParameters.project, requestParameters.room, requestParameters.kind, requestParameters.limit, requestParameters.after, options).then((request) => request(axios, basePath));
         },
         /**
-         * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+         * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
          * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
          * @param {AgentApiGetAgentSessionsByIdRequest} requestParameters Request parameters.
          * @param {*} [options] Override http request option.
@@ -3112,7 +3112,7 @@ const AgentApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getAgentSessionsStream(options).then((request) => request(axios, basePath));
         },
         /**
-         * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+         * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
          * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
@@ -3678,7 +3678,7 @@ class AgentApi extends base_1.BaseAPI {
         return (0, exports.AgentApiFp)(this.configuration).getAgentSessions(requestParameters.root, requestParameters.parent, requestParameters.status, requestParameters.project, requestParameters.room, requestParameters.kind, requestParameters.limit, requestParameters.after, options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {AgentApiGetAgentSessionsByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -3732,7 +3732,7 @@ class AgentApi extends base_1.BaseAPI {
         return (0, exports.AgentApiFp)(this.configuration).getAgentSessionsStream(options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}

package/dist/api/share-api.d.ts

@@ -14,6 +14,7 @@ import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
 import globalAxios from 'axios';
 import { type RequestArgs, BaseAPI } from '../base';
 import type { ShareEnableResp } from '../models';
+import type { ShareRotated } from '../models';
 import type { ShareSharesOut } from '../models';
 /**
  * ShareApi - axios parameter creator
@@ -21,19 +22,26 @@ import type { ShareSharesOut } from '../models';
  */
 export declare const ShareApiAxiosParamCreator: (configuration?: Configuration) => {
     /**
-     * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-     * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+     * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+     * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     getShare: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-     * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+     * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+     * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     postShareEnable: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+     * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postShareRotate: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
 };
 /**
  * ShareApi - functional programming interface
@@ -41,19 +49,26 @@ export declare const ShareApiAxiosParamCreator: (configuration?: Configuration)
  */
 export declare const ShareApiFp: (configuration?: Configuration) => {
     /**
-     * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-     * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+     * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+     * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     getShare(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ShareSharesOut>>;
     /**
-     * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-     * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+     * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+     * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     postShareEnable(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ShareEnableResp>>;
+    /**
+     * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+     * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postShareRotate(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ShareRotated>>;
 };
 /**
  * ShareApi - factory interface
@@ -61,19 +76,26 @@ export declare const ShareApiFp: (configuration?: Configuration) => {
  */
 export declare const ShareApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
     /**
-     * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-     * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+     * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+     * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     getShare(options?: RawAxiosRequestConfig): AxiosPromise<ShareSharesOut>;
     /**
-     * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-     * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+     * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+     * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      */
     postShareEnable(options?: RawAxiosRequestConfig): AxiosPromise<ShareEnableResp>;
+    /**
+     * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+     * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    postShareRotate(options?: RawAxiosRequestConfig): AxiosPromise<ShareRotated>;
 };
 /**
  * ShareApi - object-oriented interface
@@ -83,19 +105,27 @@ export declare const ShareApiFactory: (configuration?: Configuration, basePath?:
  */
 export declare class ShareApi extends BaseAPI {
     /**
-     * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-     * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+     * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+     * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof ShareApi
      */
     getShare(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ShareSharesOut, any, {}>>;
     /**
-     * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-     * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+     * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+     * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof ShareApi
      */
     postShareEnable(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ShareEnableResp, any, {}>>;
+    /**
+     * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+     * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ShareApi
+     */
+    postShareRotate(options?: RawAxiosRequestConfig): Promise<globalAxios.AxiosResponse<ShareRotated, any, {}>>;
 }

package/dist/api/share-api.js

@@ -30,8 +30,8 @@ const base_1 = require("../base");
 const ShareApiAxiosParamCreator = function (configuration) {
     return {
         /**
-         * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-         * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+         * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+         * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -58,8 +58,8 @@ const ShareApiAxiosParamCreator = function (configuration) {
             };
         },
         /**
-         * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-         * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+         * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+         * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -85,6 +85,34 @@ const ShareApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+         * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postShareRotate: async (options = {}) => {
+            const localVarPath = `/v1/share/rotate`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options };
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication bearer required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = { ...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers };
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
     };
 };
 exports.ShareApiAxiosParamCreator = ShareApiAxiosParamCreator;
@@ -96,8 +124,8 @@ const ShareApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.ShareApiAxiosParamCreator)(configuration);
     return {
         /**
-         * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-         * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+         * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+         * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -108,8 +136,8 @@ const ShareApiFp = function (configuration) {
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
         /**
-         * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-         * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+         * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+         * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -119,6 +147,18 @@ const ShareApiFp = function (configuration) {
             const localVarOperationServerBasePath = base_1.operationServerMap['ShareApi.postShareEnable']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+         * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async postShareRotate(options) {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.postShareRotate(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = base_1.operationServerMap['ShareApi.postShareRotate']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
     };
 };
 exports.ShareApiFp = ShareApiFp;
@@ -130,8 +170,8 @@ const ShareApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.ShareApiFp)(configuration);
     return {
         /**
-         * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-         * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+         * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+         * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
@@ -139,14 +179,23 @@ const ShareApiFactory = function (configuration, basePath, axios) {
             return localVarFp.getShare(options).then((request) => request(axios, basePath));
         },
         /**
-         * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-         * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+         * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+         * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
         postShareEnable(options) {
             return localVarFp.postShareEnable(options).then((request) => request(axios, basePath));
         },
+        /**
+         * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+         * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        postShareRotate(options) {
+            return localVarFp.postShareRotate(options).then((request) => request(axios, basePath));
+        },
     };
 };
 exports.ShareApiFactory = ShareApiFactory;
@@ -158,8 +207,8 @@ exports.ShareApiFactory = ShareApiFactory;
  */
 class ShareApi extends base_1.BaseAPI {
     /**
-     * Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
-     * @summary Returns the tunnel shares the caller\'s org currently has open, across every environment that org has enabled.
+     * Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled. It is a READ and it degrades honestly: an unconfigured deployment, an org that has not provisioned yet, and an unreachable controller all answer an EMPTY list at 200 rather than an error, so the console never error-toasts on load.
+     * @summary Returns the tunnel shares the caller\'s account currently has open — their org\'s, or in a held org their own — across every environment it has enabled.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof ShareApi
@@ -168,8 +217,8 @@ class ShareApi extends base_1.BaseAPI {
         return (0, exports.ShareApiFp)(this.configuration).getShare(options).then((request) => request(this.axios, this.basePath));
     }
     /**
-     * Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN org\'s account. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
-     * @summary Provisions the caller org\'s tunnel account and returns the credential the `hanzo share` CLI needs to run a tunnel.
+     * Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel. It is idempotent: the account is keyed deterministically off the VALIDATED org and, in a held org, the caller\'s attested subject, so a repeat call hands back the same account rather than creating a second one, and a caller can only ever provision their OWN. 503 when the deployment has no share controller configured; 502 when that controller is unreachable.
+     * @summary Provisions the caller\'s tunnel account — their org\'s, or in a held org, where every self-serve signup lands, their own — and returns the credential the `hanzo share` CLI needs to run a tunnel.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
      * @memberof ShareApi
@@ -177,5 +226,15 @@ class ShareApi extends base_1.BaseAPI {
     postShareEnable(options) {
         return (0, exports.ShareApiFp)(this.configuration).postShareEnable(options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on. The account is kept: enable hands its holder the new credential.  In a customer\'s org the account is the org\'s, which its members share, and an admin of the org or a SuperAdmin rotates it. In a held org each person\'s account is their own, and they rotate it — every account they hold, the one an API key of theirs was handed before included, so none stays live. An admin of the org or a SuperAdmin then rotates the org\'s own account, which no call there hands out, whether or not they hold an account of their own; when that one cannot be rotated, `pending` says so and their own are rotated still.  An account never provisioned has nothing to rotate and counts 0. 503 when the deployment has no share controller configured; 502 when that controller is unreachable, or holds the caller\'s account under a credential this deployment does not derive — out of a rotation\'s reach, so it is refused rather than reported done.
+     * @summary Replaces the credential of a tunnel account and ends every environment enabled with it, shares and all, so a credential handed out before — to a member who has left, or to anyone who read it — opens nothing from now on.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof ShareApi
+     */
+    postShareRotate(options) {
+        return (0, exports.ShareApiFp)(this.configuration).postShareRotate(options).then((request) => request(this.axios, this.basePath));
+    }
 }
 exports.ShareApi = ShareApi;

package/dist/esm/api/agent-api.d.ts

@@ -285,7 +285,7 @@ export declare const AgentApiAxiosParamCreator: (configuration?: Configuration)
      */
     getAgentSessions: (root?: string, parent?: string, status?: string, project?: string, room?: string, kind?: string, limit?: number, after?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {string} id ID is the session to act on, from the path.
      * @param {*} [options] Override http request option.
@@ -325,7 +325,7 @@ export declare const AgentApiAxiosParamCreator: (configuration?: Configuration)
      */
     getAgentSessionsStream: (options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -779,7 +779,7 @@ export declare const AgentApiFp: (configuration?: Configuration) => {
      */
     getAgentSessions(root?: string, parent?: string, status?: string, project?: string, room?: string, kind?: string, limit?: number, after?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AgentSessionList>>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {string} id ID is the session to act on, from the path.
      * @param {*} [options] Override http request option.
@@ -819,7 +819,7 @@ export declare const AgentApiFp: (configuration?: Configuration) => {
      */
     getAgentSessionsStream(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -1257,7 +1257,7 @@ export declare const AgentApiFactory: (configuration?: Configuration, basePath?:
      */
     getAgentSessions(requestParameters?: AgentApiGetAgentSessionsRequest, options?: RawAxiosRequestConfig): AxiosPromise<AgentSessionList>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {AgentApiGetAgentSessionsByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -1296,7 +1296,7 @@ export declare const AgentApiFactory: (configuration?: Configuration, basePath?:
      */
     getAgentSessionsStream(options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -2531,7 +2531,7 @@ export declare class AgentApi extends BaseAPI {
      */
     getAgentSessions(requestParameters?: AgentApiGetAgentSessionsRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<AgentSessionList, any, {}>>;
     /**
-     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org.
+     * Returns one session with its direct child sessions and its 50 most recent events, oldest of those first. The children are those the caller may see, by the rule the session itself is read by: a member\'s own, and every one for an admin of the org. In a held org, where self-serve signups land beside the platform\'s staff, a session is its person\'s alone.
      * @summary Returns one session with its direct child sessions and its 50 most recent events, oldest of those first.
      * @param {AgentApiGetAgentSessionsByIdRequest} requestParameters Request parameters.
      * @param {*} [options] Override http request option.
@@ -2575,7 +2575,7 @@ export declare class AgentApi extends BaseAPI {
      */
     getAgentSessionsStream(options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
-     * Returns every machine registered to the caller\'s org, newest first, each with its live session load.
+     * Returns every machine registered to the caller\'s org, newest first, each with its live session load. In a held org, where self-serve signups land beside the platform\'s staff, it is only the caller\'s own.
      * @summary Returns every machine registered to the caller\'s org, newest first, each with its live session load.
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}