regen the cloud client from the resynced spec (1f9b03b) and repoint every flow

The document grew: cloud's woven spec was merged and won, taking hanzo.yaml from
1132 paths / 1519 operations / 779 schemas to 1737 / 2452 / 1798.
pkg/hanzoai/cloud/ is now 263 api + 2031 model modules, all importing.
`generate.py python --check` reports [python] clean.

The resync also RENAMED nearly every operationId to cloud_<method>_<path>, which
renames every generated method: billing_billingBalance became
cloud_get_v1_billing_balance, cloud_AgentsController.Create became
cloud_post_v1_agents. Examples written against the old names stop resolving —
exactly what the examples gate exists to catch. It went red; this is the fix.

Every flow was re-probed against api.hanzo.ai unauthenticated and with a bogus
key, because a spec says what SHOULD be served and only a request says what IS.
All eleven operations answer 401/403 — routed and identity-gated. Two moved:

  store  to the PROVISIONING plane (POST /v1/kv, GET|DELETE /v1/kv/{name}). The
         per-key data plane the spec also describes is mounted nowhere: GET
         /v1/kv/keys/{key} 404s, PUT and DELETE 405, kv.hanzo.ai 404s the whole
         prefix. A round-trip on keys could not run.
  tools  to GET /v1/tools, the catalog. A live JSON-RPC door at POST /v1/mcp
         answers tools/list with 730 tools but is absent from hanzo.yaml, so the
         generator emits no method and an example would have to bypass the SDK
         to reach it. Of the declared MCP routes /v1/automations/mcp returns 405.

hello stays on bot_authMe: /v1/ai/account answers 200 with
type="anonymous-user" to a request with NO Authorization header, so a hello
built on it certifies a key that would 401 everywhere else.

All six run and report the server's own refusal for a bogus key:
  hello  403 no validated principal      store  403 X-Org-Id required
  chat   401 API key validation failed   agent  403 X-Org-Id required
  money  401 sign in to view billing     tools  403 a validated principal required

money goes through the generated *_without_preload_content variant, because its
two operations are declared with a `default` response and no content so the
typed methods return None though the server sends JSON — a spec gap, and not a
small one: 696 of 2425 operations model no response body. That raw variant does
NOT raise on 4xx (the check lives in the typed deserialization these lack), so
the example checks status itself; without it a 401 body printed as the balance.

3.1.5 -> 3.1.6. 3.1.5 is live on PyPI, so this is a real patch above it.

Co-authored-by: Hanzo Dev <[email protected]>

README.md

@@ -57,12 +57,12 @@ Hanzo SDK, so a reader who knows one language's set can navigate another's.
 
 | flow | what it does | routes |
 |---|---|---|
-| [`hello`](examples/hello) | identity — prove the key works | `GET /v1/ai/account` |
+| [`hello`](examples/hello) | identity — prove the key works | `GET /v1/bot/auth/me` |
 | [`chat`](examples/chat) | one completion | `POST /v1/chat/completions` |
 | [`money`](examples/money) | balance + usage | `GET /v1/billing/balance`, `GET /v1/billing/usage` |
-| [`store`](examples/store) | KV round-trip | `PUT`/`GET`/`DELETE /v1/kv/keys/{key}` |
-| [`agent`](examples/agent) | create + run + read | `POST /v1/agents`, `POST /v1/agents/{ref}/run`, `GET /v1/agents/{ref}` |
-| [`tools`](examples/tools) | MCP `tools/list` | `POST /v1/automations/mcp` |
+| [`store`](examples/store) | KV round-trip | `POST /v1/kv`, `GET`/`DELETE /v1/kv/{name}` |
+| [`agent`](examples/agent) | create + run + read | `POST /v1/agents`, `POST /v1/agents/{ref}/run`, `GET /v1/agents/{ref}/runs` |
+| [`tools`](examples/tools) | tool catalog | `GET /v1/tools` |
 
 Each reads `HANZO_API_KEY` from the environment and talks to
 `https://api.hanzo.ai` unless `HANZO_BASE_URL` says otherwise:
@@ -73,7 +73,7 @@ uv run python -m examples.hello
 ```
 
 They import from **`hanzoai.cloud`** — the client generated from the Hanzo
-OpenAPI surface (1519 operations, 779 schemas), which is where new work goes.
+OpenAPI surface (2452 operations, 1798 schemas), which is where new work goes.
 `examples/client.py` is the single place a base URL or an env var is resolved.
 CI imports all six on every push, which is what keeps them from rotting into
 pseudocode.

examples/agent/__main__.py

@@ -1,19 +1,23 @@
-"""agent — define one, run it, read it back.
+"""agent — define one, run it, read the run back.
 
-    POST /v1/agents            cloud_AgentsController.Create
-    POST /v1/agents/{ref}/run  cloud_AgentsController.Run
-    GET  /v1/agents/{ref}      cloud_AgentsController.Get
+    POST /v1/agents            cloud_post_v1_agents
+    POST /v1/agents/{ref}/run  cloud_post_v1_agents_by_ref_run
+    GET  /v1/agents/{ref}/runs cloud_get_v1_agents_ref_runs
 
 ``ref`` is the agent's public id (``agent_...``) OR its org-unique name, which
 is why the run and the read below can both use the name we just created without
 waiting for an id to come back.
 
+The read-back is the RUN list rather than the agent record: an agent you just
+created tells you nothing you did not just send, while its runs are the part the
+server actually produced.
+
     python -m examples.agent
 """
 
 import time
 
-from hanzoai.cloud import AgentsAPIApi, CloudAgentsCreateAgentRequest, CloudAgentsRunRequest
+from hanzoai.cloud import AgentsApi, CloudCreateAgentIn
 
 from examples.client import MODEL, client, run
 
@@ -23,24 +27,26 @@ NAME = f"example-greeter-{time.time_ns()}"
 
 def main() -> None:
     with client() as api:
-        agents = AgentsAPIApi(api)
+        agents = AgentsApi(api)
 
-        created = agents.cloud_agents_controller_create(
-            CloudAgentsCreateAgentRequest(
+        created = agents.cloud_post_v1_agents(
+            CloudCreateAgentIn(
                 name=NAME,
                 model=MODEL,
                 description="Created by the hanzoai SDK agent example.",
                 instructions="You greet the user in one short sentence.",
             )
         )
-        print("created:", created)
+        print(f"created {created.name} ({created.id}) on {created.model}")
 
-        run_result = agents.cloud_agents_controller_run(
-            NAME, CloudAgentsRunRequest(input="Greet a new Hanzo user.")
-        )
-        print("run:", run_result)
+        agents.cloud_post_v1_agents_by_ref_run(NAME)
+        print("run started")
 
-        print("read back:", agents.cloud_agents_controller_get(NAME))
+        runs = agents.cloud_get_v1_agents_ref_runs(NAME, limit=5)
+        entries = runs.runs or []
+        print(f"{len(entries)} run(s):")
+        for entry in entries:
+            print(f"  {entry.to_str()}")
 
 
 if __name__ == "__main__":

examples/chat/__main__.py

@@ -5,8 +5,8 @@ route is OpenAI-compatible, so the request and response shapes are the ones you
 already know; only the base URL and the key change.
 
 ``stream`` is left False on purpose. Streaming is a different transport (SSE)
-that the generated client returns as an opaque body, so a streaming example
-here would teach the wrong thing.
+that the generated client returns as an opaque body, so a streaming example here
+would teach the wrong thing.
 
     python -m examples.chat
 """
@@ -25,6 +25,9 @@ def main() -> None:
             )
         )
 
+    # `choices[0].message.content` is reachable without a cast only because the
+    # spec models a ChatChoice. It used to be `items: {type: object}`, which every
+    # generator turns into its untyped bag — on the most-called route in the API.
     choices = completion.choices or []
     if not choices:
         raise SystemExit("no choices returned")

examples/hello/__main__.py

@@ -1,33 +1,32 @@
 """hello — who am I?
 
 The smallest complete call: prove the key works and print the identity behind
-it. ``GET /v1/ai/account`` (operationId ``ai_getAccount``).
+it. ``GET /v1/bot/auth/me`` (operationId ``bot_authMe``).
 
-This is also where you meet the envelope, because every ``/v1/ai/*`` route uses
-it: ``status`` is the OUTCOME, not the HTTP code. A handled failure comes back
-as HTTP 200 with ``status='error'`` and a human ``msg``, so the client does NOT
-raise and code that only checks for an exception reports success on a failure.
-Branch on ``status``. Every AI-plane example in this repo does.
+This flow's whole job is to FAIL when the key is bad, so the route has to be one
+that actually checks. Not every identity-shaped route does: ``/v1/ai/account``
+answers 200 with ``type="anonymous-user"`` to a request carrying no
+Authorization header at all, so a ``hello`` built on it prints a cheerful
+identity for a key that would 401 everywhere else — worse than no check, because
+it reads as proof. ``/v1/bot/auth/me`` answers 403
+``{"error":"no validated principal"}``. Verified against api.hanzo.ai, not
+assumed from the spec.
 
     python -m examples.hello
 """
 
-import json
-
-from hanzoai.cloud import AccountApi
+from hanzoai.cloud import AuthApi
 
 from examples.client import BASE_URL, client, run
 
 
 def main() -> None:
     with client() as api:
-        envelope = AccountApi(api).ai_get_account()
-
-    if envelope.status != "ok":
-        raise SystemExit(f"account read failed: {envelope.msg or 'no message'}")
+        me = AuthApi(api).bot_auth_me()
 
     print(f"hello from {BASE_URL}")
-    print(json.dumps(envelope.data, indent=2, default=str))
+    print(f"  {me.display_name or me.handle or '(unnamed)'} <{me.email or 'no email'}>")
+    print(f"  id {me.id} · role {me.role}")
 
 
 if __name__ == "__main__":

examples/money/__main__.py

@@ -1,16 +1,23 @@
 """money — what is in the wallet, and what spent it.
 
-    GET /v1/billing/balance   billing_billingBalance   prepaid credit balance
-    GET /v1/billing/usage     billing_billingUsage     per-request usage ledger
+    GET /v1/billing/balance   cloud_get_v1_billing_balance
+    GET /v1/billing/usage     cloud_get_v1_billing_usage
 
-Neither call takes an org: both derive the tenant SERVER-side from the JWT
+Neither call takes an org: both derive the tenant SERVER-side from the token's
 ``owner`` claim, so a key can only ever read its own money. There is no org
-argument to pass and no ``X-Org-Id`` header to set.
+argument to pass.
+
+Both are declared with a ``default`` response and no ``content``, so the typed
+methods return None even though the server sends JSON. That is a spec gap, not
+an SDK one — 696 of 2425 operations currently model no response body — so this
+example reads the raw payload through the generated ``*_without_preload_content``
+variant rather than pretending a type it was not given. When the schemas land,
+these become ordinary typed calls and nothing else about them changes.
 
     python -m examples.money
 """
 
-from datetime import datetime, timedelta, timezone
+import json
 
 from hanzoai.cloud import BillingApi
 
@@ -20,17 +27,18 @@ from examples.client import client, run
 def main() -> None:
     with client() as api:
         billing = BillingApi(api)
-
-        print("balance:", billing.billing_billing_balance().to_str())
-
-        # Unbounded, the ledger is every request the org ever made. Ask for a window.
-        end = datetime.now(timezone.utc)
-        start = end - timedelta(days=7)
-        usage = billing.billing_billing_usage(
-            start=start.isoformat(),
-            end=end.isoformat(),
-        )
-        print("usage (last 7d):", usage.to_str())
+        for label, call in (
+            ("balance", billing.cloud_get_v1_billing_balance_without_preload_content),
+            ("usage", billing.cloud_get_v1_billing_usage_without_preload_content),
+        ):
+            response = call()
+            body = response.read()
+            # The raw variant does NOT raise on a 4xx — that check is part of the
+            # typed deserialization this operation does not have. Without this,
+            # a 401 body prints as though it were the balance.
+            if response.status >= 400:
+                raise SystemExit(f"HTTP {response.status}: {body.decode(errors='replace')}")
+            print(f"{label}: {json.dumps(json.loads(body), indent=2)}")
 
 
 if __name__ == "__main__":

examples/store/__main__.py

@@ -1,37 +1,44 @@
-"""store — a KV round-trip: set, read it back, delete.
+"""store — a KV round-trip: provision a store, read it back, delete it.
 
-    PUT    /v1/kv/keys/{key}   kv_setKey
-    GET    /v1/kv/keys/{key}   kv_getKey
-    DELETE /v1/kv/keys/{key}   kv_deleteKey
+    POST   /v1/kv          cloud_post_v1_kv         provision
+    GET    /v1/kv/{name}   cloud_get_v1_kv_name     read back
+    DELETE /v1/kv/{name}   cloud_delete_v1_kv_name  tear down
 
-The delete runs in ``finally``, so a failed read still cleans up rather than
-leaving the key behind for the next run to collide with.
+This is the PROVISIONING plane. The per-key data plane the spec also describes
+(``/v1/kv/keys/{key}``) is not mounted anywhere — GET 404s and PUT/DELETE 405 at
+api.hanzo.ai, and kv.hanzo.ai 404s the whole prefix — so a set/get/delete
+round-trip on keys would be an example that cannot run. These three all answer
+403 unauthenticated, i.e. routed and gated.
+
+The delete runs in ``finally``, so a failed read still tears the store down
+rather than leaving it billable for the next run to collide with.
 
     python -m examples.store
 """
 
 import time
 
-from hanzoai.cloud import KeysApi, KvSetKeyRequest
+from hanzoai.cloud import CloudProvisionRequest, KvApi
 
 from examples.client import client, run
 
-KEY = f"examples/store/{time.time_ns()}"
-VALUE = "hello from the hanzoai SDK"
+NAME = f"example-store-{time.time_ns()}"
 
 
 def main() -> None:
     with client() as api:
-        kv = KeysApi(api)
+        kv = KvApi(api)
 
-        kv.kv_set_key(KEY, KvSetKeyRequest(value=VALUE, ttl=60))
-        print(f"set {KEY}")
+        kv.cloud_post_v1_kv(CloudProvisionRequest(name=NAME))
+        print(f"provisioned {NAME}")
 
         try:
-            print("read back:", kv.kv_get_key(KEY).to_str())
+            store = kv.cloud_get_v1_kv_name(NAME)
+            print(f"read back: {store.name} · {store.kind} · status {store.status}")
+            print(f"  host {store.host}:{store.port}")
         finally:
-            kv.kv_delete_key(KEY)
-            print(f"deleted {KEY}")
+            kv.cloud_delete_v1_kv_name(NAME)
+            print(f"deleted {NAME}")
 
 
 if __name__ == "__main__":

examples/tools/__main__.py

@@ -1,35 +1,35 @@
-"""tools — list the MCP tools this key can reach.
+"""tools — list the tools this key can reach.
 
-``POST /v1/automations/mcp`` (operationId ``automations_mcp``) is the JSON-RPC
-2.0 MCP surface in hanzo.yaml, and the only one with typed request/response
-schemas — ``method`` is an enum the model validates, so ``tools/lst`` is a
-pydantic ValidationError here rather than a -32601 at runtime.
+``GET /v1/tools`` (operationId ``cloud_get_v1_tools``), the catalog behind the
+MCP surface: each entry is a tool name, its description and its input schema.
 
-JSON-RPC reports failure INSIDE a 200: a bad method comes back as
-``error={code, message}``, not an HTTP 4xx, so no exception is raised. Check
-``error`` before reading ``result``.
+A note on the MCP door, because it is easy to pick the wrong one. There is a
+live JSON-RPC endpoint at ``POST /v1/mcp`` that answers ``tools/list`` with the
+same catalog (730 tools at the time of writing) — but it is NOT in hanzo.yaml,
+so the generator emits no method for it and an example would have to bypass the
+SDK to call it, which defeats the point of an SDK example. Of the MCP routes
+that ARE declared, ``/v1/automations/mcp`` returns 405 at api.hanzo.ai. So this
+catalog read is the one that is both generated and served. When ``/v1/mcp`` is
+added to the spec, this flow should move to it.
 
     python -m examples.tools
 """
 
-from hanzoai.cloud import AutomationsMcpRequest, MCPApi
+from hanzoai.cloud import ToolsApi
 
 from examples.client import client, run
 
 
 def main() -> None:
     with client() as api:
-        response = MCPApi(api).automations_mcp(
-            AutomationsMcpRequest(jsonrpc="2.0", id=1, method="tools/list")
-        )
+        catalog = ToolsApi(api).cloud_get_v1_tools()
 
-    if response.error:
-        raise SystemExit(f"JSON-RPC {response.error.code}: {response.error.message}")
-
-    tools = (response.result or {}).get("tools", [])
+    tools = catalog.tools or []
     print(f"{len(tools)} tools")
-    for tool in tools:
-        print(f"  {tool.get('name')} — {tool.get('description') or '(no description)'}")
+    for tool in tools[:20]:
+        print(f"  {tool.name} — {tool.description or '(no description)'}")
+    if len(tools) > 20:
+        print(f"  … and {len(tools) - 20} more")
 
 
 if __name__ == "__main__":

pkg/hanzoai/cloud/api/__init__.py

@@ -4,35 +4,23 @@
 from hanzoai.cloud.api.ai_api import AIApi
 from hanzoai.cloud.api.access_tokens_api import AccessTokensApi
 from hanzoai.cloud.api.account_api import AccountApi
-from hanzoai.cloud.api.account_api_api import AccountAPIApi
 from hanzoai.cloud.api.activities_api import ActivitiesApi
-from hanzoai.cloud.api.activity_api_api import ActivityAPIApi
 from hanzoai.cloud.api.admin_api import AdminApi
-from hanzoai.cloud.api.affiliate_api import AffiliateApi
 from hanzoai.cloud.api.affiliates_api import AffiliatesApi
-from hanzoai.cloud.api.agent_sessions_api_api import AgentSessionsAPIApi
-from hanzoai.cloud.api.agents_api_api import AgentsAPIApi
 from hanzoai.cloud.api.analytics_api import AnalyticsApi
 from hanzoai.cloud.api.answer_api import AnswerApi
-from hanzoai.cloud.api.application_api_api import ApplicationAPIApi
 from hanzoai.cloud.api.applications_api import ApplicationsApi
-from hanzoai.cloud.api.article_api_api import ArticleAPIApi
 from hanzoai.cloud.api.articles_api import ArticlesApi
 from hanzoai.cloud.api.assets_api import AssetsApi
-from hanzoai.cloud.api.audit_api import AuditApi
 from hanzoai.cloud.api.auth_api import AuthApi
 from hanzoai.cloud.api.authentication_api import AuthenticationApi
-from hanzoai.cloud.api.authors_api import AuthorsApi
 from hanzoai.cloud.api.batches_api import BatchesApi
-from hanzoai.cloud.api.billing_api import BillingApi
 from hanzoai.cloud.api.bindings_api import BindingsApi
 from hanzoai.cloud.api.bots_api import BotsApi
 from hanzoai.cloud.api.buckets_api import BucketsApi
 from hanzoai.cloud.api.cdn_api import CDNApi
 from hanzoai.cloud.api.cart_api import CartApi
-from hanzoai.cloud.api.catalog_api import CatalogApi
 from hanzoai.cloud.api.chat_api import ChatApi
-from hanzoai.cloud.api.chat_api_api import ChatAPIApi
 from hanzoai.cloud.api.chats_api import ChatsApi
 from hanzoai.cloud.api.checkout_api import CheckoutApi
 from hanzoai.cloud.api.claude_compatible_api import ClaudeCompatibleApi
@@ -40,142 +28,85 @@ from hanzoai.cloud.api.cloud_api import CloudApi
 from hanzoai.cloud.api.clusters_api import ClustersApi
 from hanzoai.cloud.api.collect_api import CollectApi
 from hanzoai.cloud.api.collections_api import CollectionsApi
-from hanzoai.cloud.api.companies_api import CompaniesApi
 from hanzoai.cloud.api.completions_api import CompletionsApi
 from hanzoai.cloud.api.conflict_api import ConflictApi
-from hanzoai.cloud.api.connection_api_api import ConnectionAPIApi
-from hanzoai.cloud.api.connectors_api import ConnectorsApi
-from hanzoai.cloud.api.contacts_api import ContactsApi
-from hanzoai.cloud.api.container_api_api import ContainerAPIApi
 from hanzoai.cloud.api.counters_api import CountersApi
-from hanzoai.cloud.api.customers_api import CustomersApi
 from hanzoai.cloud.api.dns_api import DNSApi
 from hanzoai.cloud.api.dnssec_api import DNSSECApi
 from hanzoai.cloud.api.dashboards_agents_api import DashboardsAgentsApi
 from hanzoai.cloud.api.dashboards_vm_api import DashboardsVmApi
 from hanzoai.cloud.api.data_api import DataApi
-from hanzoai.cloud.api.datasets_api import DatasetsApi
-from hanzoai.cloud.api.deployment_api_api import DeploymentAPIApi
 from hanzoai.cloud.api.deployments_api import DeploymentsApi
-from hanzoai.cloud.api.deploys_api import DeploysApi
-from hanzoai.cloud.api.doc_types_api import DocTypesApi
 from hanzoai.cloud.api.documents_api import DocumentsApi
 from hanzoai.cloud.api.domains_api import DomainsApi
 from hanzoai.cloud.api.dumps_api import DumpsApi
 from hanzoai.cloud.api.edge_api import EdgeApi
 from hanzoai.cloud.api.embeddings_api import EmbeddingsApi
 from hanzoai.cloud.api.encryption_api import EncryptionApi
-from hanzoai.cloud.api.enforcement_api import EnforcementApi
-from hanzoai.cloud.api.evaluators_api import EvaluatorsApi
 from hanzoai.cloud.api.events_api import EventsApi
 from hanzoai.cloud.api.exec_api import ExecApi
 from hanzoai.cloud.api.experimental_api import ExperimentalApi
 from hanzoai.cloud.api.experiments_api import ExperimentsApi
 from hanzoai.cloud.api.export_api import ExportApi
 from hanzoai.cloud.api.facet_search_api import FacetSearchApi
-from hanzoai.cloud.api.file_api_api import FileAPIApi
 from hanzoai.cloud.api.files_api import FilesApi
-from hanzoai.cloud.api.findings_api import FindingsApi
-from hanzoai.cloud.api.flows_api import FlowsApi
-from hanzoai.cloud.api.form_api_api import FormAPIApi
 from hanzoai.cloud.api.forms_api import FormsApi
 from hanzoai.cloud.api.functions_api import FunctionsApi
-from hanzoai.cloud.api.gpus_api import GPUsApi
 from hanzoai.cloud.api.geo_api import GeoApi
 from hanzoai.cloud.api.graphs_api import GraphsApi
 from hanzoai.cloud.api.hash_api import HashApi
 from hanzoai.cloud.api.health_api import HealthApi
-from hanzoai.cloud.api.identity_api import IdentityApi
-from hanzoai.cloud.api.image_api_api import ImageAPIApi
-from hanzoai.cloud.api.indexers_api import IndexersApi
 from hanzoai.cloud.api.indexes_api import IndexesApi
-from hanzoai.cloud.api.infrastructure_api import InfrastructureApi
 from hanzoai.cloud.api.intel_api import IntelApi
-from hanzoai.cloud.api.issues_api import IssuesApi
 from hanzoai.cloud.api.k8s_status_api import K8sStatusApi
 from hanzoai.cloud.api.keys_api import KeysApi
 from hanzoai.cloud.api.lifecycle_api import LifecycleApi
 from hanzoai.cloud.api.list_api import ListApi
-from hanzoai.cloud.api.load_balancers_api import LoadBalancersApi
 from hanzoai.cloud.api.logs_api import LogsApi
 from hanzoai.cloud.api.mcp_api import MCPApi
 from hanzoai.cloud.api.mfa_api import MFAApi
-from hanzoai.cloud.api.machine_api_api import MachineAPIApi
-from hanzoai.cloud.api.machines_api import MachinesApi
 from hanzoai.cloud.api.marketing_api import MarketingApi
 from hanzoai.cloud.api.markets_api import MarketsApi
 from hanzoai.cloud.api.me_api import MeApi
-from hanzoai.cloud.api.mesh_api import MeshApi
-from hanzoai.cloud.api.message_api_api import MessageAPIApi
 from hanzoai.cloud.api.messages_api import MessagesApi
 from hanzoai.cloud.api.meta_api import MetaApi
 from hanzoai.cloud.api.metrics_api import MetricsApi
 from hanzoai.cloud.api.models_api import ModelsApi
-from hanzoai.cloud.api.modules_api import ModulesApi
-from hanzoai.cloud.api.money_api import MoneyApi
 from hanzoai.cloud.api.multi_search_api import MultiSearchApi
 from hanzoai.cloud.api.namespaces_api import NamespacesApi
 from hanzoai.cloud.api.network_api import NetworkApi
-from hanzoai.cloud.api.networks_api import NetworksApi
 from hanzoai.cloud.api.news_api import NewsApi
-from hanzoai.cloud.api.node_api_api import NodeAPIApi
 from hanzoai.cloud.api.nodes_api import NodesApi
 from hanzoai.cloud.api.o11y_api import O11yApi
-from hanzoai.cloud.api.o_auth_api import OAuthApi
 from hanzoai.cloud.api.objects_api import ObjectsApi
-from hanzoai.cloud.api.observability_api import ObservabilityApi
 from hanzoai.cloud.api.open_ai_compatible_api import OpenAICompatibleApi
-from hanzoai.cloud.api.opportunities_api import OpportunitiesApi
-from hanzoai.cloud.api.oracles_api import OraclesApi
 from hanzoai.cloud.api.orders_api import OrdersApi
 from hanzoai.cloud.api.organizations_api import OrganizationsApi
-from hanzoai.cloud.api.overview_api import OverviewApi
 from hanzoai.cloud.api.pageviews_api import PageviewsApi
 from hanzoai.cloud.api.payments_api import PaymentsApi
-from hanzoai.cloud.api.permission_api_api import PermissionAPIApi
 from hanzoai.cloud.api.permissions_api import PermissionsApi
-from hanzoai.cloud.api.pieces_api import PiecesApi
 from hanzoai.cloud.api.pipelines_api import PipelinesApi
-from hanzoai.cloud.api.plan_api import PlanApi
-from hanzoai.cloud.api.plans_api import PlansApi
-from hanzoai.cloud.api.plugins_api import PluginsApi
-from hanzoai.cloud.api.pod_api_api import PodAPIApi
 from hanzoai.cloud.api.points_api import PointsApi
 from hanzoai.cloud.api.policies_api import PoliciesApi
-from hanzoai.cloud.api.policy_api import PolicyApi
 from hanzoai.cloud.api.preferences_api import PreferencesApi
 from hanzoai.cloud.api.products_api import ProductsApi
-from hanzoai.cloud.api.projects_api import ProjectsApi
 from hanzoai.cloud.api.prometheus_api import PrometheusApi
 from hanzoai.cloud.api.promotions_api import PromotionsApi
-from hanzoai.cloud.api.prompts_api import PromptsApi
-from hanzoai.cloud.api.provider_api_api import ProviderAPIApi
 from hanzoai.cloud.api.providers_api import ProvidersApi
 from hanzoai.cloud.api.pub_sub_api import PubSubApi
 from hanzoai.cloud.api.realtime_api import RealtimeApi
-from hanzoai.cloud.api.record_api_api import RecordAPIApi
 from hanzoai.cloud.api.records_api import RecordsApi
-from hanzoai.cloud.api.referrals_api import ReferralsApi
 from hanzoai.cloud.api.remote_connections_api import RemoteConnectionsApi
 from hanzoai.cloud.api.reports_api import ReportsApi
-from hanzoai.cloud.api.repos_api import ReposApi
-from hanzoai.cloud.api.research_api import ResearchApi
 from hanzoai.cloud.api.resources_api import ResourcesApi
-from hanzoai.cloud.api.roles_api import RolesApi
 from hanzoai.cloud.api.roles_permissions_api import RolesPermissionsApi
 from hanzoai.cloud.api.routes_api import RoutesApi
-from hanzoai.cloud.api.rules_api import RulesApi
 from hanzoai.cloud.api.runs_api import RunsApi
-from hanzoai.cloud.api.ssh_keys_api import SSHKeysApi
-from hanzoai.cloud.api.sttapi_api import STTAPIApi
 from hanzoai.cloud.api.scales_api import ScalesApi
 from hanzoai.cloud.api.scans_api import ScansApi
-from hanzoai.cloud.api.scores_api import ScoresApi
 from hanzoai.cloud.api.scrape_api import ScrapeApi
 from hanzoai.cloud.api.search_api import SearchApi
-from hanzoai.cloud.api.search_api_api import SearchAPIApi
 from hanzoai.cloud.api.secrets_api import SecretsApi
-from hanzoai.cloud.api.send_api import SendApi
 from hanzoai.cloud.api.service_api import ServiceApi
 from hanzoai.cloud.api.sessions_api import SessionsApi
 from hanzoai.cloud.api.settings_api import SettingsApi
@@ -183,61 +114,154 @@ from hanzoai.cloud.api.share_api import ShareApi
 from hanzoai.cloud.api.signin_api import SigninApi
 from hanzoai.cloud.api.signout_api import SignoutApi
 from hanzoai.cloud.api.similar_api import SimilarApi
-from hanzoai.cloud.api.sites_api import SitesApi
-from hanzoai.cloud.api.slack_api import SlackApi
-from hanzoai.cloud.api.smart_http_api import SmartHTTPApi
 from hanzoai.cloud.api.snapshots_api import SnapshotsApi
 from hanzoai.cloud.api.spend_api import SpendApi
-from hanzoai.cloud.api.spend_caps_api import SpendCapsApi
 from hanzoai.cloud.api.stats_api import StatsApi
-from hanzoai.cloud.api.status_api import StatusApi
-from hanzoai.cloud.api.storage_provider_api_api import StorageProviderAPIApi
 from hanzoai.cloud.api.store_api import StoreApi
-from hanzoai.cloud.api.store_api_api import StoreAPIApi
 from hanzoai.cloud.api.stores_api import StoresApi
 from hanzoai.cloud.api.streams_api import StreamsApi
 from hanzoai.cloud.api.subscriptions_api import SubscriptionsApi
-from hanzoai.cloud.api.summary_api import SummaryApi
 from hanzoai.cloud.api.swap_api import SwapApi
 from hanzoai.cloud.api.system_api import SystemApi
-from hanzoai.cloud.api.system_api_api import SystemAPIApi
-from hanzoai.cloud.api.ttsapi_api import TTSAPIApi
-from hanzoai.cloud.api.task_api_api import TaskAPIApi
 from hanzoai.cloud.api.tasks_api import TasksApi
 from hanzoai.cloud.api.teams_api import TeamsApi
-from hanzoai.cloud.api.template_api_api import TemplateAPIApi
 from hanzoai.cloud.api.templates_api import TemplatesApi
 from hanzoai.cloud.api.tokens_api import TokensApi
 from hanzoai.cloud.api.training_contribution_api import TrainingContributionApi
 from hanzoai.cloud.api.transactions_api import TransactionsApi
 from hanzoai.cloud.api.tree_files_api import TreeFilesApi
-from hanzoai.cloud.api.usage_api import UsageApi
-from hanzoai.cloud.api.usage_api_api import UsageAPIApi
 from hanzoai.cloud.api.usages_api import UsagesApi
 from hanzoai.cloud.api.users_api import UsersApi
-from hanzoai.cloud.api.vpcs_api import VPCsApi
-from hanzoai.cloud.api.vector_api import VectorApi
-from hanzoai.cloud.api.vector_api_api import VectorAPIApi
 from hanzoai.cloud.api.vectors_api import VectorsApi
 from hanzoai.cloud.api.version_api import VersionApi
 from hanzoai.cloud.api.versioning_api import VersioningApi
 from hanzoai.cloud.api.versions_api import VersionsApi
 from hanzoai.cloud.api.video_api import VideoApi
-from hanzoai.cloud.api.video_api_api import VideoAPIApi
 from hanzoai.cloud.api.videos_api import VideosApi
 from hanzoai.cloud.api.webhooks_api import WebhooksApi
 from hanzoai.cloud.api.websites_api import WebsitesApi
-from hanzoai.cloud.api.workflow_api_api import WorkflowAPIApi
 from hanzoai.cloud.api.workflows_api import WorkflowsApi
 from hanzoai.cloud.api.zones_api import ZonesApi
+from hanzoai.cloud.api.ads_api import AdsApi
+from hanzoai.cloud.api.agent_api import AgentApi
+from hanzoai.cloud.api.agents_api import AgentsApi
+from hanzoai.cloud.api.ask_api import AskApi
+from hanzoai.cloud.api.audit_api import AuditApi
+from hanzoai.cloud.api.authors_api import AuthorsApi
+from hanzoai.cloud.api.authz_api import AuthzApi
+from hanzoai.cloud.api.auto_api import AutoApi
+from hanzoai.cloud.api.automations_api import AutomationsApi
+from hanzoai.cloud.api.base_api import BaseApi
+from hanzoai.cloud.api.benchmark_api import BenchmarkApi
+from hanzoai.cloud.api.billing_api import BillingApi
+from hanzoai.cloud.api.blueprint_api import BlueprintApi
+from hanzoai.cloud.api.books_api import BooksApi
+from hanzoai.cloud.api.bot_api import BotApi
+from hanzoai.cloud.api.builds_api import BuildsApi
+from hanzoai.cloud.api.campaign_api import CampaignApi
+from hanzoai.cloud.api.captable_api import CaptableApi
+from hanzoai.cloud.api.catalog_api import CatalogApi
+from hanzoai.cloud.api.channels_api import ChannelsApi
+from hanzoai.cloud.api.cloudflare_api import CloudflareApi
+from hanzoai.cloud.api.code_api import CodeApi
+from hanzoai.cloud.api.commerce_api import CommerceApi
+from hanzoai.cloud.api.company_api import CompanyApi
+from hanzoai.cloud.api.compliance_api import ComplianceApi
+from hanzoai.cloud.api.compute_api import ComputeApi
+from hanzoai.cloud.api.connector_api import ConnectorApi
+from hanzoai.cloud.api.connectors_api import ConnectorsApi
+from hanzoai.cloud.api.content_api import ContentApi
+from hanzoai.cloud.api.crawl_api import CrawlApi
+from hanzoai.cloud.api.crm_api import CrmApi
+from hanzoai.cloud.api.csrf_api import CsrfApi
+from hanzoai.cloud.api.dataroom_api import DataroomApi
 from hanzoai.cloud.api.datastore_api import DatastoreApi
+from hanzoai.cloud.api.deploy_api import DeployApi
+from hanzoai.cloud.api.destinations_api import DestinationsApi
 from hanzoai.cloud.api.docdb_api import DocdbApi
+from hanzoai.cloud.api.domain_api import DomainApi
+from hanzoai.cloud.api.download_api import DownloadApi
+from hanzoai.cloud.api.embed_status_api import EmbedStatusApi
+from hanzoai.cloud.api.enablement_api import EnablementApi
+from hanzoai.cloud.api.engine_api import EngineApi
+from hanzoai.cloud.api.entitlements_api import EntitlementsApi
+from hanzoai.cloud.api.environments_api import EnvironmentsApi
+from hanzoai.cloud.api.errors_api import ErrorsApi
+from hanzoai.cloud.api.esign_api import EsignApi
+from hanzoai.cloud.api.evals_api import EvalsApi
+from hanzoai.cloud.api.event_api import EventApi
+from hanzoai.cloud.api.finance_api import FinanceApi
+from hanzoai.cloud.api.flags_api import FlagsApi
+from hanzoai.cloud.api.fleet_api import FleetApi
+from hanzoai.cloud.api.flow_api import FlowApi
+from hanzoai.cloud.api.framework_api import FrameworkApi
+from hanzoai.cloud.api.gateway_api import GatewayApi
+from hanzoai.cloud.api.git_api import GitApi
+from hanzoai.cloud.api.gpus_api import GpusApi
+from hanzoai.cloud.api.guide_api import GuideApi
+from hanzoai.cloud.api.help_api import HelpApi
+from hanzoai.cloud.api.iam_api import IamApi
+from hanzoai.cloud.api.index_api import IndexApi
+from hanzoai.cloud.api.indexers_api import IndexersApi
+from hanzoai.cloud.api.ingress_api import IngressApi
+from hanzoai.cloud.api.insights_api import InsightsApi
 from hanzoai.cloud.api.integrations_api import IntegrationsApi
+from hanzoai.cloud.api.k8s_api import K8sApi
+from hanzoai.cloud.api.kb_api import KbApi
+from hanzoai.cloud.api.kms_api import KmsApi
 from hanzoai.cloud.api.kv_api import KvApi
+from hanzoai.cloud.api.legal_api import LegalApi
+from hanzoai.cloud.api.licensing_api import LicensingApi
+from hanzoai.cloud.api.links_api import LinksApi
+from hanzoai.cloud.api.load_balancers_api import LoadBalancersApi
+from hanzoai.cloud.api.machines_api import MachinesApi
+from hanzoai.cloud.api.marketplace_api import MarketplaceApi
+from hanzoai.cloud.api.meet_api import MeetApi
+from hanzoai.cloud.api.mesh_api import MeshApi
+from hanzoai.cloud.api.ml_api import MlApi
+from hanzoai.cloud.api.mq_api import MqApi
+from hanzoai.cloud.api.networks_api import NetworksApi
+from hanzoai.cloud.api.notify_api import NotifyApi
+from hanzoai.cloud.api.oracles_api import OraclesApi
+from hanzoai.cloud.api.orgs_api import OrgsApi
 from hanzoai.cloud.api.personas_api import PersonasApi
+from hanzoai.cloud.api.plans_api import PlansApi
 from hanzoai.cloud.api.platform_api import PlatformApi
+from hanzoai.cloud.api.plugins_api import PluginsApi
+from hanzoai.cloud.api.prefs_api import PrefsApi
+from hanzoai.cloud.api.pricing_api import PricingApi
+from hanzoai.cloud.api.pricing_policy_api import PricingPolicyApi
+from hanzoai.cloud.api.projects_api import ProjectsApi
+from hanzoai.cloud.api.prompts_api import PromptsApi
+from hanzoai.cloud.api.referrals_api import ReferralsApi
+from hanzoai.cloud.api.registry_api import RegistryApi
+from hanzoai.cloud.api.releases_api import ReleasesApi
+from hanzoai.cloud.api.research_api import ResearchApi
+from hanzoai.cloud.api.run_api import RunApi
+from hanzoai.cloud.api.runner_api import RunnerApi
 from hanzoai.cloud.api.s3_api import S3Api
+from hanzoai.cloud.api.sbom_api import SbomApi
+from hanzoai.cloud.api.search_docs_api import SearchDocsApi
+from hanzoai.cloud.api.security_api import SecurityApi
+from hanzoai.cloud.api.sentry_api import SentryApi
+from hanzoai.cloud.api.sites_api import SitesApi
 from hanzoai.cloud.api.skills_api import SkillsApi
+from hanzoai.cloud.api.social_api import SocialApi
 from hanzoai.cloud.api.sql_api import SqlApi
+from hanzoai.cloud.api.sync_api import SyncApi
+from hanzoai.cloud.api.team_api import TeamApi
+from hanzoai.cloud.api.tools_api import ToolsApi
+from hanzoai.cloud.api.traces_api import TracesApi
+from hanzoai.cloud.api.tracker_api import TrackerApi
+from hanzoai.cloud.api.train_api import TrainApi
+from hanzoai.cloud.api.translate_api import TranslateApi
 from hanzoai.cloud.api.upload_api import UploadApi
+from hanzoai.cloud.api.usage_api import UsageApi
+from hanzoai.cloud.api.validators_api import ValidatorsApi
+from hanzoai.cloud.api.vector_api import VectorApi
+from hanzoai.cloud.api.vpcs_api import VpcsApi
+from hanzoai.cloud.api.wallets_api import WalletsApi
+from hanzoai.cloud.api.websearch_api import WebsearchApi
+from hanzoai.cloud.api.world_api import WorldApi
+from hanzoai.cloud.api.x402_api import X402Api
 

pkg/hanzoai/cloud/api/access_tokens_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: [email protected]

pkg/hanzoai/cloud/api/account_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: [email protected]

pkg/hanzoai/cloud/api/activities_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: [email protected]

pkg/hanzoai/cloud/api/agent_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,20 +17,14 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from pydantic import Field, StrictStr
-from typing import Optional
-from typing_extensions import Annotated
-from hanzoai.cloud.models.admin_admin_overview200_response import AdminAdminOverview200Response
-from hanzoai.cloud.models.admin_admin_products200_response import AdminAdminProducts200Response
-from hanzoai.cloud.models.admin_admin_sync200_response import AdminAdminSync200Response
-from hanzoai.cloud.models.admin_admin_usage200_response import AdminAdminUsage200Response
+from pydantic import StrictStr
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class OverviewApi:
+class AgentApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -44,7 +38,7 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_overview(
+    def cloud_get_v1_agent_conversations(
         self,
         _request_timeout: Union[
             None,
@@ -58,8 +52,8 @@ class OverviewApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AdminAdminOverview200Response:
-        """Fleet overview tiles
+    ) -> None:
+        """cloud_get_v1_agent_conversations
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -84,7 +78,7 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_overview_serialize(
+        _param = self._cloud_get_v1_agent_conversations_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -92,8 +86,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminOverview200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -107,7 +99,7 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_overview_with_http_info(
+    def cloud_get_v1_agent_conversations_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -121,8 +113,8 @@ class OverviewApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AdminAdminOverview200Response]:
-        """Fleet overview tiles
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_agent_conversations
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -147,7 +139,7 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_overview_serialize(
+        _param = self._cloud_get_v1_agent_conversations_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -155,8 +147,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminOverview200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -170,7 +160,7 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_overview_without_preload_content(
+    def cloud_get_v1_agent_conversations_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -185,7 +175,7 @@ class OverviewApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Fleet overview tiles
+        """cloud_get_v1_agent_conversations
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -210,7 +200,7 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_overview_serialize(
+        _param = self._cloud_get_v1_agent_conversations_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -218,8 +208,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminOverview200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -228,7 +216,7 @@ class OverviewApi:
         return response_data.response
 
 
-    def _admin_admin_overview_serialize(
+    def _cloud_get_v1_agent_conversations_serialize(
         self,
         _request_auth,
         _content_type,
@@ -257,13 +245,6 @@ class OverviewApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -273,7 +254,7 @@ class OverviewApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/admin/overview',
+            resource_path='/v1/agent/conversations',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -290,8 +271,9 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_products(
+    def cloud_get_v1_agent_conversations_by_id(
         self,
+        id: StrictStr,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -304,10 +286,12 @@ class OverviewApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AdminAdminProducts200Response:
-        """Product / workload registry
+    ) -> None:
+        """cloud_get_v1_agent_conversations_by_id
 
 
+        :param id: (required)
+        :type id: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -330,7 +314,8 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_products_serialize(
+        _param = self._cloud_get_v1_agent_conversations_by_id_serialize(
+            id=id,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -338,8 +323,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminProducts200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -353,8 +336,9 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_products_with_http_info(
+    def cloud_get_v1_agent_conversations_by_id_with_http_info(
         self,
+        id: StrictStr,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -367,10 +351,12 @@ class OverviewApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AdminAdminProducts200Response]:
-        """Product / workload registry
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_agent_conversations_by_id
 
 
+        :param id: (required)
+        :type id: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -393,7 +379,8 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_products_serialize(
+        _param = self._cloud_get_v1_agent_conversations_by_id_serialize(
+            id=id,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -401,8 +388,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminProducts200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -416,8 +401,9 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_products_without_preload_content(
+    def cloud_get_v1_agent_conversations_by_id_without_preload_content(
         self,
+        id: StrictStr,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -431,9 +417,11 @@ class OverviewApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Product / workload registry
+        """cloud_get_v1_agent_conversations_by_id
 
 
+        :param id: (required)
+        :type id: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -456,7 +444,8 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_products_serialize(
+        _param = self._cloud_get_v1_agent_conversations_by_id_serialize(
+            id=id,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -464,8 +453,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminProducts200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -474,8 +461,9 @@ class OverviewApi:
         return response_data.response
 
 
-    def _admin_admin_products_serialize(
+    def _cloud_get_v1_agent_conversations_by_id_serialize(
         self,
+        id,
         _request_auth,
         _content_type,
         _headers,
@@ -497,19 +485,14 @@ class OverviewApi:
         _body_params: Optional[bytes] = None
 
         # process the path parameters
+        if id is not None:
+            _path_params['id'] = id
         # process the query parameters
         # process the header parameters
         # process the form parameters
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -519,7 +502,7 @@ class OverviewApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/admin/products',
+            resource_path='/v1/agent/conversations/{id}',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -536,7 +519,7 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_sync(
+    def cloud_get_v1_agent_presets(
         self,
         _request_timeout: Union[
             None,
@@ -550,8 +533,8 @@ class OverviewApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AdminAdminSync200Response:
-        """Trigger a fleet re-read
+    ) -> None:
+        """cloud_get_v1_agent_presets
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -576,7 +559,7 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_sync_serialize(
+        _param = self._cloud_get_v1_agent_presets_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -584,8 +567,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminSync200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -599,7 +580,7 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_sync_with_http_info(
+    def cloud_get_v1_agent_presets_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -613,8 +594,8 @@ class OverviewApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AdminAdminSync200Response]:
-        """Trigger a fleet re-read
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_agent_presets
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -639,7 +620,7 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_sync_serialize(
+        _param = self._cloud_get_v1_agent_presets_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -647,8 +628,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminSync200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -662,7 +641,7 @@ class OverviewApi:
 
 
     @validate_call
-    def admin_admin_sync_without_preload_content(
+    def cloud_get_v1_agent_presets_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -677,7 +656,7 @@ class OverviewApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Trigger a fleet re-read
+        """cloud_get_v1_agent_presets
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -702,7 +681,7 @@ class OverviewApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_sync_serialize(
+        _param = self._cloud_get_v1_agent_presets_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -710,8 +689,6 @@ class OverviewApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminSync200Response",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -720,7 +697,240 @@ class OverviewApi:
         return response_data.response
 
 
-    def _admin_admin_sync_serialize(
+    def _cloud_get_v1_agent_presets_serialize(
+        self,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+
+
+
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'bearerAuth'
+        ]
+
+        return self.api_client.param_serialize(
+            method='GET',
+            resource_path='/v1/agent/presets',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+
+
+
+    @validate_call
+    def cloud_post_v1_agent(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> None:
+        """cloud_post_v1_agent
+
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_post_v1_agent_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def cloud_post_v1_agent_with_http_info(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[None]:
+        """cloud_post_v1_agent
+
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_post_v1_agent_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def cloud_post_v1_agent_without_preload_content(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """cloud_post_v1_agent
+
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_post_v1_agent_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _cloud_post_v1_agent_serialize(
         self,
         _request_auth,
         _content_type,
@@ -749,13 +959,6 @@ class OverviewApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -765,270 +968,7 @@ class OverviewApi:
 
         return self.api_client.param_serialize(
             method='POST',
-            resource_path='/v1/admin/sync',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-
-
-
-    @validate_call
-    def admin_admin_usage(
-        self,
-        org: Annotated[Optional[StrictStr], Field(description="Scope to one org (default fleet)")] = None,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AdminAdminUsage200Response:
-        """Fleet usage roll-up
-
-
-        :param org: Scope to one org (default fleet)
-        :type org: str
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._admin_admin_usage_serialize(
-            org=org,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminUsage200Response",
-            '401': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def admin_admin_usage_with_http_info(
-        self,
-        org: Annotated[Optional[StrictStr], Field(description="Scope to one org (default fleet)")] = None,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AdminAdminUsage200Response]:
-        """Fleet usage roll-up
-
-
-        :param org: Scope to one org (default fleet)
-        :type org: str
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._admin_admin_usage_serialize(
-            org=org,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminUsage200Response",
-            '401': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def admin_admin_usage_without_preload_content(
-        self,
-        org: Annotated[Optional[StrictStr], Field(description="Scope to one org (default fleet)")] = None,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """Fleet usage roll-up
-
-
-        :param org: Scope to one org (default fleet)
-        :type org: str
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._admin_admin_usage_serialize(
-            org=org,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminUsage200Response",
-            '401': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _admin_admin_usage_serialize(
-        self,
-        org,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        if org is not None:
-            
-            _query_params.append(('org', org))
-            
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-
-        # authentication setting
-        _auth_settings: List[str] = [
-            'bearerAuth'
-        ]
-
-        return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/admin/usage',
+            resource_path='/v1/agent',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/ai_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/answer_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/applications_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/articles_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/ask_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,14 +17,15 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from hanzoai.cloud.models.pricing_pricing_policy import PricingPricingPolicy
+from typing import Optional
+from hanzoai.cloud.models.cloud_ask_request import CloudAskRequest
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class PolicyApi:
+class AskApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -38,8 +39,9 @@ class PolicyApi:
 
 
     @validate_call
-    def pricing_get_pricing_policy(
+    def cloud_post_v1_ask(
         self,
+        cloud_ask_request: Optional[CloudAskRequest] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -52,11 +54,12 @@ class PolicyApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> PricingPricingPolicy:
-        """Pricing policy and revenue sharing
+    ) -> None:
+        """cloud_post_v1_ask
 
-        Returns the transparent pricing policy including markup rates, revenue sharing percentages, and free tier details. 
 
+        :param cloud_ask_request:
+        :type cloud_ask_request: CloudAskRequest
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -79,7 +82,8 @@ class PolicyApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._pricing_get_pricing_policy_serialize(
+        _param = self._cloud_post_v1_ask_serialize(
+            cloud_ask_request=cloud_ask_request,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -87,7 +91,6 @@ class PolicyApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "PricingPricingPolicy",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -101,8 +104,9 @@ class PolicyApi:
 
 
     @validate_call
-    def pricing_get_pricing_policy_with_http_info(
+    def cloud_post_v1_ask_with_http_info(
         self,
+        cloud_ask_request: Optional[CloudAskRequest] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -115,11 +119,12 @@ class PolicyApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[PricingPricingPolicy]:
-        """Pricing policy and revenue sharing
+    ) -> ApiResponse[None]:
+        """cloud_post_v1_ask
 
-        Returns the transparent pricing policy including markup rates, revenue sharing percentages, and free tier details. 
 
+        :param cloud_ask_request:
+        :type cloud_ask_request: CloudAskRequest
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -142,7 +147,8 @@ class PolicyApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._pricing_get_pricing_policy_serialize(
+        _param = self._cloud_post_v1_ask_serialize(
+            cloud_ask_request=cloud_ask_request,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -150,7 +156,6 @@ class PolicyApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "PricingPricingPolicy",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -164,8 +169,9 @@ class PolicyApi:
 
 
     @validate_call
-    def pricing_get_pricing_policy_without_preload_content(
+    def cloud_post_v1_ask_without_preload_content(
         self,
+        cloud_ask_request: Optional[CloudAskRequest] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -179,10 +185,11 @@ class PolicyApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Pricing policy and revenue sharing
+        """cloud_post_v1_ask
 
-        Returns the transparent pricing policy including markup rates, revenue sharing percentages, and free tier details. 
 
+        :param cloud_ask_request:
+        :type cloud_ask_request: CloudAskRequest
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -205,7 +212,8 @@ class PolicyApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._pricing_get_pricing_policy_serialize(
+        _param = self._cloud_post_v1_ask_serialize(
+            cloud_ask_request=cloud_ask_request,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -213,7 +221,6 @@ class PolicyApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "PricingPricingPolicy",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -222,8 +229,9 @@ class PolicyApi:
         return response_data.response
 
 
-    def _pricing_get_pricing_policy_serialize(
+    def _cloud_post_v1_ask_serialize(
         self,
+        cloud_ask_request,
         _request_auth,
         _content_type,
         _headers,
@@ -249,16 +257,24 @@ class PolicyApi:
         # process the header parameters
         # process the form parameters
         # process the body parameter
+        if cloud_ask_request is not None:
+            _body_params = cloud_ask_request
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
+
+        # set the HTTP header `Content-Type`
+        if _content_type:
+            _header_params['Content-Type'] = _content_type
+        else:
+            _default_content_type = (
+                self.api_client.select_header_content_type(
+                    [
+                        'application/json'
+                    ]
+                )
             )
-
+            if _default_content_type is not None:
+                _header_params['Content-Type'] = _default_content_type
 
         # authentication setting
         _auth_settings: List[str] = [
@@ -266,8 +282,8 @@ class PolicyApi:
         ]
 
         return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/pricing/policy',
+            method='POST',
+            resource_path='/v1/ask',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/assets_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/audit_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,11 +17,10 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from datetime import datetime
-from pydantic import StrictInt, StrictStr
+from pydantic import Field, StrictStr
 from typing import Optional
-from hanzoai.cloud.models.admin_admin_list_audit200_response import AdminAdminListAudit200Response
-from hanzoai.cloud.models.admin_admin_verify_audit200_response import AdminAdminVerifyAudit200Response
+from typing_extensions import Annotated
+from hanzoai.cloud.models.cloud_trail_page import CloudTrailPage
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
@@ -42,17 +41,17 @@ class AuditApi:
 
 
     @validate_call
-    def admin_admin_list_audit(
+    def cloud_get_v1_audit(
         self,
-        org: Optional[StrictStr] = None,
-        sub: Optional[StrictStr] = None,
-        action: Optional[StrictStr] = None,
-        resource: Optional[StrictStr] = None,
-        result: Optional[StrictStr] = None,
-        since: Optional[datetime] = None,
-        until: Optional[datetime] = None,
-        page_size: Optional[StrictInt] = None,
-        p: Optional[StrictInt] = None,
+        sub: Annotated[Optional[StrictStr], Field(description="Sub narrows the trail to one actor — the validated subject that made the request. Blank means every actor in the org.")] = None,
+        action: Annotated[Optional[StrictStr], Field(description="Action narrows it to one action name, e.g. \"machine.create\".")] = None,
+        resource: Annotated[Optional[StrictStr], Field(description="Resource narrows it to one resource TYPE, e.g. \"apikey\".")] = None,
+        resource_id: Annotated[Optional[StrictStr], Field(description="ResourceID narrows it to one resource instance.")] = None,
+        result: Annotated[Optional[StrictStr], Field(description="Result narrows it to one outcome: \"success\", \"deny\" or \"error\".")] = None,
+        since: Annotated[Optional[StrictStr], Field(description="Since is the inclusive lower time bound, RFC3339. An unparseable value is ignored rather than refused — one malformed filter must not hide the trail.")] = None,
+        until: Annotated[Optional[StrictStr], Field(description="Until is the upper time bound, RFC3339, with the same tolerance.")] = None,
+        page_size: Annotated[Optional[StrictStr], Field(description="PageSize is rows per page, default 100. A value that is not a positive integer falls back to the default.")] = None,
+        p: Annotated[Optional[StrictStr], Field(description="Page is the 1-based page number, driving the offset. Anything below 2 reads the first page.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -65,28 +64,29 @@ class AuditApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AdminAdminListAudit200Response:
-        """Query the tamper-evident audit trail
+    ) -> CloudTrailPage:
+        """List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.
 
+        List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.  Every filter is optional and applies WITHIN the caller's org — the org itself is the validated principal's and can never be widened by a request. Fails closed: an absent principal is a true \"not signed in\" (401), and a deployment with no local tamper-evident store answers an honest 501 rather than silently serving somebody else's trail.
 
-        :param org:
-        :type org: str
-        :param sub:
+        :param sub: Sub narrows the trail to one actor — the validated subject that made the request. Blank means every actor in the org.
         :type sub: str
-        :param action:
+        :param action: Action narrows it to one action name, e.g. \"machine.create\".
         :type action: str
-        :param resource:
+        :param resource: Resource narrows it to one resource TYPE, e.g. \"apikey\".
         :type resource: str
-        :param result:
+        :param resource_id: ResourceID narrows it to one resource instance.
+        :type resource_id: str
+        :param result: Result narrows it to one outcome: \"success\", \"deny\" or \"error\".
         :type result: str
-        :param since:
-        :type since: datetime
-        :param until:
-        :type until: datetime
-        :param page_size:
-        :type page_size: int
-        :param p:
-        :type p: int
+        :param since: Since is the inclusive lower time bound, RFC3339. An unparseable value is ignored rather than refused — one malformed filter must not hide the trail.
+        :type since: str
+        :param until: Until is the upper time bound, RFC3339, with the same tolerance.
+        :type until: str
+        :param page_size: PageSize is rows per page, default 100. A value that is not a positive integer falls back to the default.
+        :type page_size: str
+        :param p: Page is the 1-based page number, driving the offset. Anything below 2 reads the first page.
+        :type p: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -109,11 +109,11 @@ class AuditApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_list_audit_serialize(
-            org=org,
+        _param = self._cloud_get_v1_audit_serialize(
             sub=sub,
             action=action,
             resource=resource,
+            resource_id=resource_id,
             result=result,
             since=since,
             until=until,
@@ -126,8 +126,7 @@ class AuditApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminListAudit200Response",
-            '401': "AdminAdminCreatePromo400Response",
+            '200': "CloudTrailPage",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -141,17 +140,17 @@ class AuditApi:
 
 
     @validate_call
-    def admin_admin_list_audit_with_http_info(
+    def cloud_get_v1_audit_with_http_info(
         self,
-        org: Optional[StrictStr] = None,
-        sub: Optional[StrictStr] = None,
-        action: Optional[StrictStr] = None,
-        resource: Optional[StrictStr] = None,
-        result: Optional[StrictStr] = None,
-        since: Optional[datetime] = None,
-        until: Optional[datetime] = None,
-        page_size: Optional[StrictInt] = None,
-        p: Optional[StrictInt] = None,
+        sub: Annotated[Optional[StrictStr], Field(description="Sub narrows the trail to one actor — the validated subject that made the request. Blank means every actor in the org.")] = None,
+        action: Annotated[Optional[StrictStr], Field(description="Action narrows it to one action name, e.g. \"machine.create\".")] = None,
+        resource: Annotated[Optional[StrictStr], Field(description="Resource narrows it to one resource TYPE, e.g. \"apikey\".")] = None,
+        resource_id: Annotated[Optional[StrictStr], Field(description="ResourceID narrows it to one resource instance.")] = None,
+        result: Annotated[Optional[StrictStr], Field(description="Result narrows it to one outcome: \"success\", \"deny\" or \"error\".")] = None,
+        since: Annotated[Optional[StrictStr], Field(description="Since is the inclusive lower time bound, RFC3339. An unparseable value is ignored rather than refused — one malformed filter must not hide the trail.")] = None,
+        until: Annotated[Optional[StrictStr], Field(description="Until is the upper time bound, RFC3339, with the same tolerance.")] = None,
+        page_size: Annotated[Optional[StrictStr], Field(description="PageSize is rows per page, default 100. A value that is not a positive integer falls back to the default.")] = None,
+        p: Annotated[Optional[StrictStr], Field(description="Page is the 1-based page number, driving the offset. Anything below 2 reads the first page.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -164,28 +163,29 @@ class AuditApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AdminAdminListAudit200Response]:
-        """Query the tamper-evident audit trail
+    ) -> ApiResponse[CloudTrailPage]:
+        """List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.
 
+        List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.  Every filter is optional and applies WITHIN the caller's org — the org itself is the validated principal's and can never be widened by a request. Fails closed: an absent principal is a true \"not signed in\" (401), and a deployment with no local tamper-evident store answers an honest 501 rather than silently serving somebody else's trail.
 
-        :param org:
-        :type org: str
-        :param sub:
+        :param sub: Sub narrows the trail to one actor — the validated subject that made the request. Blank means every actor in the org.
         :type sub: str
-        :param action:
+        :param action: Action narrows it to one action name, e.g. \"machine.create\".
         :type action: str
-        :param resource:
+        :param resource: Resource narrows it to one resource TYPE, e.g. \"apikey\".
         :type resource: str
-        :param result:
+        :param resource_id: ResourceID narrows it to one resource instance.
+        :type resource_id: str
+        :param result: Result narrows it to one outcome: \"success\", \"deny\" or \"error\".
         :type result: str
-        :param since:
-        :type since: datetime
-        :param until:
-        :type until: datetime
-        :param page_size:
-        :type page_size: int
-        :param p:
-        :type p: int
+        :param since: Since is the inclusive lower time bound, RFC3339. An unparseable value is ignored rather than refused — one malformed filter must not hide the trail.
+        :type since: str
+        :param until: Until is the upper time bound, RFC3339, with the same tolerance.
+        :type until: str
+        :param page_size: PageSize is rows per page, default 100. A value that is not a positive integer falls back to the default.
+        :type page_size: str
+        :param p: Page is the 1-based page number, driving the offset. Anything below 2 reads the first page.
+        :type p: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -208,11 +208,11 @@ class AuditApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_list_audit_serialize(
-            org=org,
+        _param = self._cloud_get_v1_audit_serialize(
             sub=sub,
             action=action,
             resource=resource,
+            resource_id=resource_id,
             result=result,
             since=since,
             until=until,
@@ -225,8 +225,7 @@ class AuditApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminListAudit200Response",
-            '401': "AdminAdminCreatePromo400Response",
+            '200': "CloudTrailPage",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -240,17 +239,17 @@ class AuditApi:
 
 
     @validate_call
-    def admin_admin_list_audit_without_preload_content(
+    def cloud_get_v1_audit_without_preload_content(
         self,
-        org: Optional[StrictStr] = None,
-        sub: Optional[StrictStr] = None,
-        action: Optional[StrictStr] = None,
-        resource: Optional[StrictStr] = None,
-        result: Optional[StrictStr] = None,
-        since: Optional[datetime] = None,
-        until: Optional[datetime] = None,
-        page_size: Optional[StrictInt] = None,
-        p: Optional[StrictInt] = None,
+        sub: Annotated[Optional[StrictStr], Field(description="Sub narrows the trail to one actor — the validated subject that made the request. Blank means every actor in the org.")] = None,
+        action: Annotated[Optional[StrictStr], Field(description="Action narrows it to one action name, e.g. \"machine.create\".")] = None,
+        resource: Annotated[Optional[StrictStr], Field(description="Resource narrows it to one resource TYPE, e.g. \"apikey\".")] = None,
+        resource_id: Annotated[Optional[StrictStr], Field(description="ResourceID narrows it to one resource instance.")] = None,
+        result: Annotated[Optional[StrictStr], Field(description="Result narrows it to one outcome: \"success\", \"deny\" or \"error\".")] = None,
+        since: Annotated[Optional[StrictStr], Field(description="Since is the inclusive lower time bound, RFC3339. An unparseable value is ignored rather than refused — one malformed filter must not hide the trail.")] = None,
+        until: Annotated[Optional[StrictStr], Field(description="Until is the upper time bound, RFC3339, with the same tolerance.")] = None,
+        page_size: Annotated[Optional[StrictStr], Field(description="PageSize is rows per page, default 100. A value that is not a positive integer falls back to the default.")] = None,
+        p: Annotated[Optional[StrictStr], Field(description="Page is the 1-based page number, driving the offset. Anything below 2 reads the first page.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -264,27 +263,28 @@ class AuditApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Query the tamper-evident audit trail
+        """List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.
 
+        List reads the caller's OWN org audit trail, newest first, with the total the filter matched so a console can page it.  Every filter is optional and applies WITHIN the caller's org — the org itself is the validated principal's and can never be widened by a request. Fails closed: an absent principal is a true \"not signed in\" (401), and a deployment with no local tamper-evident store answers an honest 501 rather than silently serving somebody else's trail.
 
-        :param org:
-        :type org: str
-        :param sub:
+        :param sub: Sub narrows the trail to one actor — the validated subject that made the request. Blank means every actor in the org.
         :type sub: str
-        :param action:
+        :param action: Action narrows it to one action name, e.g. \"machine.create\".
         :type action: str
-        :param resource:
+        :param resource: Resource narrows it to one resource TYPE, e.g. \"apikey\".
         :type resource: str
-        :param result:
+        :param resource_id: ResourceID narrows it to one resource instance.
+        :type resource_id: str
+        :param result: Result narrows it to one outcome: \"success\", \"deny\" or \"error\".
         :type result: str
-        :param since:
-        :type since: datetime
-        :param until:
-        :type until: datetime
-        :param page_size:
-        :type page_size: int
-        :param p:
-        :type p: int
+        :param since: Since is the inclusive lower time bound, RFC3339. An unparseable value is ignored rather than refused — one malformed filter must not hide the trail.
+        :type since: str
+        :param until: Until is the upper time bound, RFC3339, with the same tolerance.
+        :type until: str
+        :param page_size: PageSize is rows per page, default 100. A value that is not a positive integer falls back to the default.
+        :type page_size: str
+        :param p: Page is the 1-based page number, driving the offset. Anything below 2 reads the first page.
+        :type p: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -307,11 +307,11 @@ class AuditApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._admin_admin_list_audit_serialize(
-            org=org,
+        _param = self._cloud_get_v1_audit_serialize(
             sub=sub,
             action=action,
             resource=resource,
+            resource_id=resource_id,
             result=result,
             since=since,
             until=until,
@@ -324,8 +324,7 @@ class AuditApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminListAudit200Response",
-            '401': "AdminAdminCreatePromo400Response",
+            '200': "CloudTrailPage",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -334,12 +333,12 @@ class AuditApi:
         return response_data.response
 
 
-    def _admin_admin_list_audit_serialize(
+    def _cloud_get_v1_audit_serialize(
         self,
-        org,
         sub,
         action,
         resource,
+        resource_id,
         result,
         since,
         until,
@@ -367,10 +366,6 @@ class AuditApi:
 
         # process the path parameters
         # process the query parameters
-        if org is not None:
-            
-            _query_params.append(('org', org))
-            
         if sub is not None:
             
             _query_params.append(('sub', sub))
@@ -383,35 +378,21 @@ class AuditApi:
             
             _query_params.append(('resource', resource))
             
+        if resource_id is not None:
+            
+            _query_params.append(('resourceId', resource_id))
+            
         if result is not None:
             
             _query_params.append(('result', result))
             
         if since is not None:
-            if isinstance(since, datetime):
-                _query_params.append(
-                    (
-                        'since',
-                        since.strftime(
-                            self.api_client.configuration.datetime_format
-                        )
-                    )
-                )
-            else:
-                _query_params.append(('since', since))
+            
+            _query_params.append(('since', since))
             
         if until is not None:
-            if isinstance(until, datetime):
-                _query_params.append(
-                    (
-                        'until',
-                        until.strftime(
-                            self.api_client.configuration.datetime_format
-                        )
-                    )
-                )
-            else:
-                _query_params.append(('until', until))
+            
+            _query_params.append(('until', until))
             
         if page_size is not None:
             
@@ -442,253 +423,7 @@ class AuditApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/admin/audit',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-
-
-
-    @validate_call
-    def admin_admin_verify_audit(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AdminAdminVerifyAudit200Response:
-        """Verify audit-chain integrity
-
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._admin_admin_verify_audit_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminVerifyAudit200Response",
-            '401': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def admin_admin_verify_audit_with_http_info(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AdminAdminVerifyAudit200Response]:
-        """Verify audit-chain integrity
-
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._admin_admin_verify_audit_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminVerifyAudit200Response",
-            '401': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def admin_admin_verify_audit_without_preload_content(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """Verify audit-chain integrity
-
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._admin_admin_verify_audit_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AdminAdminVerifyAudit200Response",
-            '401': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _admin_admin_verify_audit_serialize(
-        self,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-
-        # authentication setting
-        _auth_settings: List[str] = [
-            'bearerAuth'
-        ]
-
-        return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/admin/audit/verify',
+            resource_path='/v1/audit',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/auth_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -28,8 +28,6 @@ from hanzoai.cloud.models.analytics_user import AnalyticsUser
 from hanzoai.cloud.models.bot_user import BotUser
 from hanzoai.cloud.models.commerce_o_auth_request import CommerceOAuthRequest
 from hanzoai.cloud.models.commerce_o_auth_response import CommerceOAuthResponse
-from hanzoai.cloud.models.kms_post_v1_kms_auth_login200_response import KmsPostV1KmsAuthLogin200Response
-from hanzoai.cloud.models.kms_post_v1_kms_auth_login_request import KmsPostV1KmsAuthLoginRequest
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
@@ -3116,282 +3114,3 @@ class AuthApi:
         )
 
 
-
-
-    @validate_call
-    def kms_post_v1_kms_auth_login(
-        self,
-        kms_post_v1_kms_auth_login_request: KmsPostV1KmsAuthLoginRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> KmsPostV1KmsAuthLogin200Response:
-        """Exchange machine identity for a bearer token
-
-        The only auth route. The token is org-scoped, and the org is read from it: a token reaches its own org's secrets and nothing else.
-
-        :param kms_post_v1_kms_auth_login_request: (required)
-        :type kms_post_v1_kms_auth_login_request: KmsPostV1KmsAuthLoginRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._kms_post_v1_kms_auth_login_serialize(
-            kms_post_v1_kms_auth_login_request=kms_post_v1_kms_auth_login_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "KmsPostV1KmsAuthLogin200Response",
-            '400': None,
-            '401': None,
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def kms_post_v1_kms_auth_login_with_http_info(
-        self,
-        kms_post_v1_kms_auth_login_request: KmsPostV1KmsAuthLoginRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[KmsPostV1KmsAuthLogin200Response]:
-        """Exchange machine identity for a bearer token
-
-        The only auth route. The token is org-scoped, and the org is read from it: a token reaches its own org's secrets and nothing else.
-
-        :param kms_post_v1_kms_auth_login_request: (required)
-        :type kms_post_v1_kms_auth_login_request: KmsPostV1KmsAuthLoginRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._kms_post_v1_kms_auth_login_serialize(
-            kms_post_v1_kms_auth_login_request=kms_post_v1_kms_auth_login_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "KmsPostV1KmsAuthLogin200Response",
-            '400': None,
-            '401': None,
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def kms_post_v1_kms_auth_login_without_preload_content(
-        self,
-        kms_post_v1_kms_auth_login_request: KmsPostV1KmsAuthLoginRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """Exchange machine identity for a bearer token
-
-        The only auth route. The token is org-scoped, and the org is read from it: a token reaches its own org's secrets and nothing else.
-
-        :param kms_post_v1_kms_auth_login_request: (required)
-        :type kms_post_v1_kms_auth_login_request: KmsPostV1KmsAuthLoginRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._kms_post_v1_kms_auth_login_serialize(
-            kms_post_v1_kms_auth_login_request=kms_post_v1_kms_auth_login_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "KmsPostV1KmsAuthLogin200Response",
-            '400': None,
-            '401': None,
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _kms_post_v1_kms_auth_login_serialize(
-        self,
-        kms_post_v1_kms_auth_login_request,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-        if kms_post_v1_kms_auth_login_request is not None:
-            _body_params = kms_post_v1_kms_auth_login_request
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-        # set the HTTP header `Content-Type`
-        if _content_type:
-            _header_params['Content-Type'] = _content_type
-        else:
-            _default_content_type = (
-                self.api_client.select_header_content_type(
-                    [
-                        'application/json'
-                    ]
-                )
-            )
-            if _default_content_type is not None:
-                _header_params['Content-Type'] = _default_content_type
-
-        # authentication setting
-        _auth_settings: List[str] = [
-        ]
-
-        return self.api_client.param_serialize(
-            method='POST',
-            resource_path='/v1/kms/auth/login',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-

pkg/hanzoai/cloud/api/authentication_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/authz_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,16 +17,13 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from hanzoai.cloud.models.cloud_object_prometheus_info import CloudObjectPrometheusInfo
-from hanzoai.cloud.models.cloud_util_system_info import CloudUtilSystemInfo
-from hanzoai.cloud.models.cloud_util_version_info import CloudUtilVersionInfo
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class SystemAPIApi:
+class AuthzApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -40,7 +37,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_prometheus_info(
+    def cloud_get_v1_authz_health(
         self,
         _request_timeout: Union[
             None,
@@ -54,10 +51,9 @@ class SystemAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> CloudObjectPrometheusInfo:
-        """Api Controller Get Prometheus Info
+    ) -> None:
+        """cloud_get_v1_authz_health
 
-        get Prometheus Info
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -81,7 +77,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_prometheus_info_serialize(
+        _param = self._cloud_get_v1_authz_health_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -89,7 +85,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudObjectPrometheusInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -103,7 +98,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_prometheus_info_with_http_info(
+    def cloud_get_v1_authz_health_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -117,10 +112,9 @@ class SystemAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[CloudObjectPrometheusInfo]:
-        """Api Controller Get Prometheus Info
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_authz_health
 
-        get Prometheus Info
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -144,7 +138,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_prometheus_info_serialize(
+        _param = self._cloud_get_v1_authz_health_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -152,7 +146,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudObjectPrometheusInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -166,7 +159,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_prometheus_info_without_preload_content(
+    def cloud_get_v1_authz_health_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -181,9 +174,8 @@ class SystemAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Get Prometheus Info
+        """cloud_get_v1_authz_health
 
-        get Prometheus Info
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -207,7 +199,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_prometheus_info_serialize(
+        _param = self._cloud_get_v1_authz_health_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -215,7 +207,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudObjectPrometheusInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -224,7 +215,7 @@ class SystemAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_get_prometheus_info_serialize(
+    def _cloud_get_v1_authz_health_serialize(
         self,
         _request_auth,
         _content_type,
@@ -253,13 +244,6 @@ class SystemAPIApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -269,7 +253,7 @@ class SystemAPIApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/cloud/get-prometheus-info',
+            resource_path='/v1/authz/health',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -286,7 +270,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_system_info(
+    def cloud_get_v1_authz_readyz(
         self,
         _request_timeout: Union[
             None,
@@ -300,10 +284,9 @@ class SystemAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> CloudUtilSystemInfo:
-        """Api Controller Get System Info
+    ) -> None:
+        """cloud_get_v1_authz_readyz
 
-        get system info like CPU and memory usage
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -327,7 +310,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_system_info_serialize(
+        _param = self._cloud_get_v1_authz_readyz_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -335,7 +318,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudUtilSystemInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -349,7 +331,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_system_info_with_http_info(
+    def cloud_get_v1_authz_readyz_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -363,10 +345,9 @@ class SystemAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[CloudUtilSystemInfo]:
-        """Api Controller Get System Info
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_authz_readyz
 
-        get system info like CPU and memory usage
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -390,7 +371,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_system_info_serialize(
+        _param = self._cloud_get_v1_authz_readyz_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -398,7 +379,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudUtilSystemInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -412,7 +392,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_system_info_without_preload_content(
+    def cloud_get_v1_authz_readyz_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -427,9 +407,8 @@ class SystemAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Get System Info
+        """cloud_get_v1_authz_readyz
 
-        get system info like CPU and memory usage
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -453,7 +432,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_system_info_serialize(
+        _param = self._cloud_get_v1_authz_readyz_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -461,7 +440,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudUtilSystemInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -470,7 +448,7 @@ class SystemAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_get_system_info_serialize(
+    def _cloud_get_v1_authz_readyz_serialize(
         self,
         _request_auth,
         _content_type,
@@ -499,13 +477,6 @@ class SystemAPIApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -515,7 +486,7 @@ class SystemAPIApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/cloud/get-system-info',
+            resource_path='/v1/authz/readyz',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -532,7 +503,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_version_info(
+    def cloud_post_v1_authz_check(
         self,
         _request_timeout: Union[
             None,
@@ -546,10 +517,9 @@ class SystemAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> CloudUtilVersionInfo:
-        """Api Controller Get Version Info
+    ) -> None:
+        """cloud_post_v1_authz_check
 
-        get version info like IAM release version and commit ID
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -573,7 +543,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_version_info_serialize(
+        _param = self._cloud_post_v1_authz_check_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -581,7 +551,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudUtilVersionInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -595,7 +564,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_version_info_with_http_info(
+    def cloud_post_v1_authz_check_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -609,10 +578,9 @@ class SystemAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[CloudUtilVersionInfo]:
-        """Api Controller Get Version Info
+    ) -> ApiResponse[None]:
+        """cloud_post_v1_authz_check
 
-        get version info like IAM release version and commit ID
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -636,7 +604,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_version_info_serialize(
+        _param = self._cloud_post_v1_authz_check_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -644,7 +612,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudUtilVersionInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -658,7 +625,7 @@ class SystemAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_version_info_without_preload_content(
+    def cloud_post_v1_authz_check_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -673,9 +640,8 @@ class SystemAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Get Version Info
+        """cloud_post_v1_authz_check
 
-        get version info like IAM release version and commit ID
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -699,7 +665,7 @@ class SystemAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_version_info_serialize(
+        _param = self._cloud_post_v1_authz_check_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -707,7 +673,6 @@ class SystemAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudUtilVersionInfo",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -716,7 +681,7 @@ class SystemAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_get_version_info_serialize(
+    def _cloud_post_v1_authz_check_serialize(
         self,
         _request_auth,
         _content_type,
@@ -745,13 +710,6 @@ class SystemAPIApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -760,8 +718,8 @@ class SystemAPIApi:
         ]
 
         return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/cloud/get-version-info',
+            method='POST',
+            resource_path='/v1/authz/check',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/base_api.py

@@ -0,0 +1,283 @@
+# coding: utf-8
+
+"""
+    Hanzo Cloud — Unified API (V8 · Open Edition)
+
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+
+    The version of the OpenAPI document: 8.0.0
+    Contact: support@hanzo.ai
+    Generated by OpenAPI Generator (https://openapi-generator.tech)
+
+    Do not edit the class manually.
+"""  # noqa: E501
+
+import warnings
+from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
+from typing import Any, Dict, List, Optional, Tuple, Union
+from typing_extensions import Annotated
+
+from hanzoai.cloud.models.cloud_base_health import CloudBaseHealth
+
+from hanzoai.cloud.api_client import ApiClient, RequestSerialized
+from hanzoai.cloud.api_response import ApiResponse
+from hanzoai.cloud.rest import RESTResponseType
+
+
+class BaseApi:
+    """NOTE: This class is auto generated by OpenAPI Generator
+    Ref: https://openapi-generator.tech
+
+    Do not edit the class manually.
+    """
+
+    def __init__(self, api_client=None) -> None:
+        if api_client is None:
+            api_client = ApiClient.get_default()
+        self.api_client = api_client
+
+
+    @validate_call
+    def cloud_get_v1_base_health(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> CloudBaseHealth:
+        """BaseHealth reports that the base subsystem is serving.
+
+        BaseHealth reports that the base subsystem is serving.  It is deliberately INDEPENDENT of whether this deployment actually embeds the Base engine: the route answers before the CLOUD_BASE_EMBED gate and before the /v1/base/* wildcard, so a liveness probe measures the process rather than an optional feature, and the wildcard can never shadow it. It reads no tenant, so a prober that sends no principal is answered rather than refused.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_base_health_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudBaseHealth",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def cloud_get_v1_base_health_with_http_info(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[CloudBaseHealth]:
+        """BaseHealth reports that the base subsystem is serving.
+
+        BaseHealth reports that the base subsystem is serving.  It is deliberately INDEPENDENT of whether this deployment actually embeds the Base engine: the route answers before the CLOUD_BASE_EMBED gate and before the /v1/base/* wildcard, so a liveness probe measures the process rather than an optional feature, and the wildcard can never shadow it. It reads no tenant, so a prober that sends no principal is answered rather than refused.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_base_health_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudBaseHealth",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def cloud_get_v1_base_health_without_preload_content(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """BaseHealth reports that the base subsystem is serving.
+
+        BaseHealth reports that the base subsystem is serving.  It is deliberately INDEPENDENT of whether this deployment actually embeds the Base engine: the route answers before the CLOUD_BASE_EMBED gate and before the /v1/base/* wildcard, so a liveness probe measures the process rather than an optional feature, and the wildcard can never shadow it. It reads no tenant, so a prober that sends no principal is answered rather than refused.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_base_health_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudBaseHealth",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _cloud_get_v1_base_health_serialize(
+        self,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+
+
+        # set the HTTP header `Accept`
+        if 'Accept' not in _header_params:
+            _header_params['Accept'] = self.api_client.select_header_accept(
+                [
+                    'application/json'
+                ]
+            )
+
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'bearerAuth'
+        ]
+
+        return self.api_client.param_serialize(
+            method='GET',
+            resource_path='/v1/base/health',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+

pkg/hanzoai/cloud/api/batches_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/bindings_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -98,7 +98,7 @@ class BindingsApi:
         _response_types_map: Dict[str, Optional[str]] = {
             '200': "VisorAgentBinding",
             '400': None,
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -170,7 +170,7 @@ class BindingsApi:
         _response_types_map: Dict[str, Optional[str]] = {
             '200': "VisorAgentBinding",
             '400': None,
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -242,7 +242,7 @@ class BindingsApi:
         _response_types_map: Dict[str, Optional[str]] = {
             '200': "VisorAgentBinding",
             '400': None,
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -385,7 +385,7 @@ class BindingsApi:
 
         _response_types_map: Dict[str, Optional[str]] = {
             '200': "VisorAgentBinding",
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
             '404': None,
         }
         response_data = self.api_client.call_api(
@@ -453,7 +453,7 @@ class BindingsApi:
 
         _response_types_map: Dict[str, Optional[str]] = {
             '200': "VisorAgentBinding",
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
             '404': None,
         }
         response_data = self.api_client.call_api(
@@ -521,7 +521,7 @@ class BindingsApi:
 
         _response_types_map: Dict[str, Optional[str]] = {
             '200': "VisorAgentBinding",
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
             '404': None,
         }
         response_data = self.api_client.call_api(
@@ -649,7 +649,7 @@ class BindingsApi:
 
         _response_types_map: Dict[str, Optional[str]] = {
             '204': None,
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -716,7 +716,7 @@ class BindingsApi:
 
         _response_types_map: Dict[str, Optional[str]] = {
             '204': None,
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -783,7 +783,7 @@ class BindingsApi:
 
         _response_types_map: Dict[str, Optional[str]] = {
             '204': None,
-            '401': "AdminAdminCreatePromo400Response",
+            '401': "AdminAdminDeletePromo200Response",
         }
         response_data = self.api_client.call_api(
             *_param,

pkg/hanzoai/cloud/api/blueprint_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,17 +17,15 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from pydantic import Field, StrictStr
-from typing import Any, Dict
-from typing_extensions import Annotated
-from hanzoai.cloud.models.cloud_controllers_response import CloudControllersResponse
+from hanzoai.cloud.models.cloud_blueprint_health import CloudBlueprintHealth
+from hanzoai.cloud.models.cloud_blueprint_index import CloudBlueprintIndex
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class AccountAPIApi:
+class BlueprintApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -41,7 +39,7 @@ class AccountAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_account(
+    def cloud_get_v1_blueprint(
         self,
         _request_timeout: Union[
             None,
@@ -55,10 +53,10 @@ class AccountAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> object:
-        """Api Controller Get Account
+    ) -> CloudBlueprintIndex:
+        """Returns every deployable blueprint with its service count and estimated monthly compute cost.
 
-        get account
+        Returns every deployable blueprint with its service count and estimated monthly compute cost.  It is the lightweight index the console renders as a template gallery before drilling into one stack's bill of images — GET /v1/blueprint/sbom?template=<id> is the detail view. The cost is the same figure the deploy path meters the deploying org on and the 20% author royalty is taken from, priced from the active rate card (GET /v1/blueprint/health echoes that card).
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -82,7 +80,7 @@ class AccountAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_account_serialize(
+        _param = self._cloud_get_v1_blueprint_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -90,7 +88,7 @@ class AccountAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
+            '200': "CloudBlueprintIndex",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -104,7 +102,7 @@ class AccountAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_account_with_http_info(
+    def cloud_get_v1_blueprint_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -118,10 +116,10 @@ class AccountAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[object]:
-        """Api Controller Get Account
+    ) -> ApiResponse[CloudBlueprintIndex]:
+        """Returns every deployable blueprint with its service count and estimated monthly compute cost.
 
-        get account
+        Returns every deployable blueprint with its service count and estimated monthly compute cost.  It is the lightweight index the console renders as a template gallery before drilling into one stack's bill of images — GET /v1/blueprint/sbom?template=<id> is the detail view. The cost is the same figure the deploy path meters the deploying org on and the 20% author royalty is taken from, priced from the active rate card (GET /v1/blueprint/health echoes that card).
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -145,7 +143,7 @@ class AccountAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_account_serialize(
+        _param = self._cloud_get_v1_blueprint_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -153,7 +151,7 @@ class AccountAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
+            '200': "CloudBlueprintIndex",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -167,7 +165,7 @@ class AccountAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_account_without_preload_content(
+    def cloud_get_v1_blueprint_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -182,9 +180,9 @@ class AccountAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Get Account
+        """Returns every deployable blueprint with its service count and estimated monthly compute cost.
 
-        get account
+        Returns every deployable blueprint with its service count and estimated monthly compute cost.  It is the lightweight index the console renders as a template gallery before drilling into one stack's bill of images — GET /v1/blueprint/sbom?template=<id> is the detail view. The cost is the same figure the deploy path meters the deploying org on and the 20% author royalty is taken from, priced from the active rate card (GET /v1/blueprint/health echoes that card).
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -208,7 +206,7 @@ class AccountAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_account_serialize(
+        _param = self._cloud_get_v1_blueprint_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -216,7 +214,7 @@ class AccountAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
+            '200': "CloudBlueprintIndex",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -225,7 +223,7 @@ class AccountAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_get_account_serialize(
+    def _cloud_get_v1_blueprint_serialize(
         self,
         _request_auth,
         _content_type,
@@ -270,7 +268,7 @@ class AccountAPIApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/cloud/get-account',
+            resource_path='/v1/blueprint',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -287,10 +285,8 @@ class AccountAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_signin(
+    def cloud_get_v1_blueprint_health(
         self,
-        code: Annotated[StrictStr, Field(description="code of account")],
-        state: Annotated[StrictStr, Field(description="state of account")],
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -303,15 +299,11 @@ class AccountAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> object:
-        """Api Controller Signin
+    ) -> CloudBlueprintHealth:
+        """Reports blueprint liveness and echoes the compute rate card in force.
 
-        sign in
+        Reports blueprint liveness and echoes the compute rate card in force.  The rate card is the one the estimator actually applies after the operator env overlay, so an operator can confirm a tuned knob took effect rather than inferring it from a price. Not JWT-gated — a liveness probe must be reachable — and it always answers 200 while the subsystem is mounted.
 
-        :param code: code of account (required)
-        :type code: str
-        :param state: state of account (required)
-        :type state: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -334,9 +326,7 @@ class AccountAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_signin_serialize(
-            code=code,
-            state=state,
+        _param = self._cloud_get_v1_blueprint_health_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -344,7 +334,7 @@ class AccountAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
+            '200': "CloudBlueprintHealth",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -358,10 +348,8 @@ class AccountAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_signin_with_http_info(
+    def cloud_get_v1_blueprint_health_with_http_info(
         self,
-        code: Annotated[StrictStr, Field(description="code of account")],
-        state: Annotated[StrictStr, Field(description="state of account")],
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -374,15 +362,11 @@ class AccountAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[object]:
-        """Api Controller Signin
+    ) -> ApiResponse[CloudBlueprintHealth]:
+        """Reports blueprint liveness and echoes the compute rate card in force.
 
-        sign in
+        Reports blueprint liveness and echoes the compute rate card in force.  The rate card is the one the estimator actually applies after the operator env overlay, so an operator can confirm a tuned knob took effect rather than inferring it from a price. Not JWT-gated — a liveness probe must be reachable — and it always answers 200 while the subsystem is mounted.
 
-        :param code: code of account (required)
-        :type code: str
-        :param state: state of account (required)
-        :type state: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -405,9 +389,7 @@ class AccountAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_signin_serialize(
-            code=code,
-            state=state,
+        _param = self._cloud_get_v1_blueprint_health_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -415,7 +397,7 @@ class AccountAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
+            '200': "CloudBlueprintHealth",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -429,271 +411,7 @@ class AccountAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_signin_without_preload_content(
-        self,
-        code: Annotated[StrictStr, Field(description="code of account")],
-        state: Annotated[StrictStr, Field(description="state of account")],
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """Api Controller Signin
-
-        sign in
-
-        :param code: code of account (required)
-        :type code: str
-        :param state: state of account (required)
-        :type state: str
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._cloud_api_controller_signin_serialize(
-            code=code,
-            state=state,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _cloud_api_controller_signin_serialize(
-        self,
-        code,
-        state,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        if code is not None:
-            
-            _query_params.append(('code', code))
-            
-        if state is not None:
-            
-            _query_params.append(('state', state))
-            
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-
-        # authentication setting
-        _auth_settings: List[str] = [
-            'bearerAuth'
-        ]
-
-        return self.api_client.param_serialize(
-            method='POST',
-            resource_path='/v1/cloud/signin',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-
-
-
-    @validate_call
-    def cloud_api_controller_signout(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> CloudControllersResponse:
-        """Api Controller Signout
-
-        sign out
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._cloud_api_controller_signout_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudControllersResponse",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def cloud_api_controller_signout_with_http_info(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[CloudControllersResponse]:
-        """Api Controller Signout
-
-        sign out
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._cloud_api_controller_signout_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudControllersResponse",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def cloud_api_controller_signout_without_preload_content(
+    def cloud_get_v1_blueprint_health_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -708,9 +426,9 @@ class AccountAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Signout
+        """Reports blueprint liveness and echoes the compute rate card in force.
 
-        sign out
+        Reports blueprint liveness and echoes the compute rate card in force.  The rate card is the one the estimator actually applies after the operator env overlay, so an operator can confirm a tuned knob took effect rather than inferring it from a price. Not JWT-gated — a liveness probe must be reachable — and it always answers 200 while the subsystem is mounted.
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -734,7 +452,7 @@ class AccountAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_signout_serialize(
+        _param = self._cloud_get_v1_blueprint_health_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -742,7 +460,7 @@ class AccountAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CloudControllersResponse",
+            '200': "CloudBlueprintHealth",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -751,7 +469,7 @@ class AccountAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_signout_serialize(
+    def _cloud_get_v1_blueprint_health_serialize(
         self,
         _request_auth,
         _content_type,
@@ -795,8 +513,241 @@ class AccountAPIApi:
         ]
 
         return self.api_client.param_serialize(
-            method='POST',
-            resource_path='/v1/cloud/signout',
+            method='GET',
+            resource_path='/v1/blueprint/health',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+
+
+
+    @validate_call
+    def cloud_get_v1_blueprint_sbom(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> None:
+        """cloud_get_v1_blueprint_sbom
+
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_blueprint_sbom_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def cloud_get_v1_blueprint_sbom_with_http_info(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_blueprint_sbom
+
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_blueprint_sbom_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def cloud_get_v1_blueprint_sbom_without_preload_content(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """cloud_get_v1_blueprint_sbom
+
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_blueprint_sbom_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _cloud_get_v1_blueprint_sbom_serialize(
+        self,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+
+
+
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'bearerAuth'
+        ]
+
+        return self.api_client.param_serialize(
+            method='GET',
+            resource_path='/v1/blueprint/sbom',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/buckets_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/builds_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,14 +17,13 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from typing import Any, Dict
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class DeploymentAPIApi:
+class BuildsApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -38,7 +37,7 @@ class DeploymentAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_k8s_status(
+    def cloud_get_v1_builds(
         self,
         _request_timeout: Union[
             None,
@@ -52,10 +51,9 @@ class DeploymentAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> object:
-        """Api Controller Get K8s Status
+    ) -> None:
+        """cloud_get_v1_builds
 
-        get kubernetes cluster status
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -79,7 +77,7 @@ class DeploymentAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_k8s_status_serialize(
+        _param = self._cloud_get_v1_builds_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -87,7 +85,6 @@ class DeploymentAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -101,7 +98,7 @@ class DeploymentAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_k8s_status_with_http_info(
+    def cloud_get_v1_builds_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -115,10 +112,9 @@ class DeploymentAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[object]:
-        """Api Controller Get K8s Status
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_builds
 
-        get kubernetes cluster status
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -142,7 +138,7 @@ class DeploymentAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_k8s_status_serialize(
+        _param = self._cloud_get_v1_builds_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -150,7 +146,6 @@ class DeploymentAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -164,7 +159,7 @@ class DeploymentAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_k8s_status_without_preload_content(
+    def cloud_get_v1_builds_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -179,9 +174,8 @@ class DeploymentAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Get K8s Status
+        """cloud_get_v1_builds
 
-        get kubernetes cluster status
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -205,7 +199,7 @@ class DeploymentAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_k8s_status_serialize(
+        _param = self._cloud_get_v1_builds_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -213,7 +207,6 @@ class DeploymentAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "object",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -222,7 +215,7 @@ class DeploymentAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_get_k8s_status_serialize(
+    def _cloud_get_v1_builds_serialize(
         self,
         _request_auth,
         _content_type,
@@ -251,13 +244,6 @@ class DeploymentAPIApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -267,7 +253,7 @@ class DeploymentAPIApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/cloud/get-k8s-status',
+            resource_path='/v1/builds',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/cart_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/cdn_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/chat_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/chats_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/checkout_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/claude_compatible_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/collect_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/completions_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/conflict_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/connector_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,15 +17,13 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from typing import List
-from hanzoai.cloud.models.cloud_object_provider import CloudObjectProvider
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class StorageProviderAPIApi:
+class ConnectorApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -39,7 +37,7 @@ class StorageProviderAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_storage_providers(
+    def cloud_post_v1_connector_github_webhook(
         self,
         _request_timeout: Union[
             None,
@@ -53,10 +51,9 @@ class StorageProviderAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> List[CloudObjectProvider]:
-        """Api Controller Get Storage Providers
+    ) -> None:
+        """cloud_post_v1_connector_github_webhook
 
-        get storage providers
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -80,7 +77,7 @@ class StorageProviderAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_storage_providers_serialize(
+        _param = self._cloud_post_v1_connector_github_webhook_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -88,7 +85,6 @@ class StorageProviderAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "List[CloudObjectProvider]",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -102,7 +98,7 @@ class StorageProviderAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_storage_providers_with_http_info(
+    def cloud_post_v1_connector_github_webhook_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -116,10 +112,9 @@ class StorageProviderAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[List[CloudObjectProvider]]:
-        """Api Controller Get Storage Providers
+    ) -> ApiResponse[None]:
+        """cloud_post_v1_connector_github_webhook
 
-        get storage providers
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -143,7 +138,7 @@ class StorageProviderAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_storage_providers_serialize(
+        _param = self._cloud_post_v1_connector_github_webhook_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -151,7 +146,6 @@ class StorageProviderAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "List[CloudObjectProvider]",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -165,7 +159,7 @@ class StorageProviderAPIApi:
 
 
     @validate_call
-    def cloud_api_controller_get_storage_providers_without_preload_content(
+    def cloud_post_v1_connector_github_webhook_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -180,9 +174,8 @@ class StorageProviderAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Api Controller Get Storage Providers
+        """cloud_post_v1_connector_github_webhook
 
-        get storage providers
 
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
@@ -206,7 +199,7 @@ class StorageProviderAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_api_controller_get_storage_providers_serialize(
+        _param = self._cloud_post_v1_connector_github_webhook_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -214,7 +207,6 @@ class StorageProviderAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "List[CloudObjectProvider]",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -223,7 +215,7 @@ class StorageProviderAPIApi:
         return response_data.response
 
 
-    def _cloud_api_controller_get_storage_providers_serialize(
+    def _cloud_post_v1_connector_github_webhook_serialize(
         self,
         _request_auth,
         _content_type,
@@ -252,13 +244,6 @@ class StorageProviderAPIApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -267,8 +252,8 @@ class StorageProviderAPIApi:
         ]
 
         return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/cloud/get-storage-providers',
+            method='POST',
+            resource_path='/v1/connector/github/webhook',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/counters_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/crawl_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,16 +17,16 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from pydantic import StrictInt, StrictStr
 from typing import Optional
-from hanzoai.cloud.models.evals_get_v1_evals_scores200_response import EvalsGetV1EvalsScores200Response
+from hanzoai.cloud.models.cloud_crawl_request import CloudCrawlRequest
+from hanzoai.cloud.models.cloud_crawl_result import CloudCrawlResult
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class ScoresApi:
+class CrawlApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -40,10 +40,9 @@ class ScoresApi:
 
 
     @validate_call
-    def evals_get_v1_evals_scores(
+    def cloud_post_v1_crawl(
         self,
-        run_name: Optional[StrictStr] = None,
-        limit: Optional[StrictInt] = None,
+        cloud_crawl_request: Optional[CloudCrawlRequest] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -56,14 +55,12 @@ class ScoresApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> EvalsGetV1EvalsScores200Response:
-        """List scores
+    ) -> CloudCrawlResult:
+        """cloud_post_v1_crawl
 
 
-        :param run_name:
-        :type run_name: str
-        :param limit:
-        :type limit: int
+        :param cloud_crawl_request:
+        :type cloud_crawl_request: CloudCrawlRequest
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -86,9 +83,8 @@ class ScoresApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._evals_get_v1_evals_scores_serialize(
-            run_name=run_name,
-            limit=limit,
+        _param = self._cloud_post_v1_crawl_serialize(
+            cloud_crawl_request=cloud_crawl_request,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -96,8 +92,7 @@ class ScoresApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "EvalsGetV1EvalsScores200Response",
-            '401': "AdminAdminCreatePromo400Response",
+            '2XX': "CloudCrawlResult",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -111,10 +106,9 @@ class ScoresApi:
 
 
     @validate_call
-    def evals_get_v1_evals_scores_with_http_info(
+    def cloud_post_v1_crawl_with_http_info(
         self,
-        run_name: Optional[StrictStr] = None,
-        limit: Optional[StrictInt] = None,
+        cloud_crawl_request: Optional[CloudCrawlRequest] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -127,14 +121,12 @@ class ScoresApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[EvalsGetV1EvalsScores200Response]:
-        """List scores
+    ) -> ApiResponse[CloudCrawlResult]:
+        """cloud_post_v1_crawl
 
 
-        :param run_name:
-        :type run_name: str
-        :param limit:
-        :type limit: int
+        :param cloud_crawl_request:
+        :type cloud_crawl_request: CloudCrawlRequest
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -157,9 +149,8 @@ class ScoresApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._evals_get_v1_evals_scores_serialize(
-            run_name=run_name,
-            limit=limit,
+        _param = self._cloud_post_v1_crawl_serialize(
+            cloud_crawl_request=cloud_crawl_request,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -167,8 +158,7 @@ class ScoresApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "EvalsGetV1EvalsScores200Response",
-            '401': "AdminAdminCreatePromo400Response",
+            '2XX': "CloudCrawlResult",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -182,10 +172,9 @@ class ScoresApi:
 
 
     @validate_call
-    def evals_get_v1_evals_scores_without_preload_content(
+    def cloud_post_v1_crawl_without_preload_content(
         self,
-        run_name: Optional[StrictStr] = None,
-        limit: Optional[StrictInt] = None,
+        cloud_crawl_request: Optional[CloudCrawlRequest] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -199,13 +188,11 @@ class ScoresApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """List scores
+        """cloud_post_v1_crawl
 
 
-        :param run_name:
-        :type run_name: str
-        :param limit:
-        :type limit: int
+        :param cloud_crawl_request:
+        :type cloud_crawl_request: CloudCrawlRequest
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -228,9 +215,8 @@ class ScoresApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._evals_get_v1_evals_scores_serialize(
-            run_name=run_name,
-            limit=limit,
+        _param = self._cloud_post_v1_crawl_serialize(
+            cloud_crawl_request=cloud_crawl_request,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -238,8 +224,7 @@ class ScoresApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "EvalsGetV1EvalsScores200Response",
-            '401': "AdminAdminCreatePromo400Response",
+            '2XX': "CloudCrawlResult",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -248,10 +233,9 @@ class ScoresApi:
         return response_data.response
 
 
-    def _evals_get_v1_evals_scores_serialize(
+    def _cloud_post_v1_crawl_serialize(
         self,
-        run_name,
-        limit,
+        cloud_crawl_request,
         _request_auth,
         _content_type,
         _headers,
@@ -274,17 +258,11 @@ class ScoresApi:
 
         # process the path parameters
         # process the query parameters
-        if run_name is not None:
-            
-            _query_params.append(('runName', run_name))
-            
-        if limit is not None:
-            
-            _query_params.append(('limit', limit))
-            
         # process the header parameters
         # process the form parameters
         # process the body parameter
+        if cloud_crawl_request is not None:
+            _body_params = cloud_crawl_request
 
 
         # set the HTTP header `Accept`
@@ -295,6 +273,19 @@ class ScoresApi:
                 ]
             )
 
+        # set the HTTP header `Content-Type`
+        if _content_type:
+            _header_params['Content-Type'] = _content_type
+        else:
+            _default_content_type = (
+                self.api_client.select_header_content_type(
+                    [
+                        'application/json'
+                    ]
+                )
+            )
+            if _default_content_type is not None:
+                _header_params['Content-Type'] = _default_content_type
 
         # authentication setting
         _auth_settings: List[str] = [
@@ -302,8 +293,8 @@ class ScoresApi:
         ]
 
         return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/evals/scores',
+            method='POST',
+            resource_path='/v1/crawl',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/csrf_api.py

@@ -0,0 +1,283 @@
+# coding: utf-8
+
+"""
+    Hanzo Cloud — Unified API (V8 · Open Edition)
+
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+
+    The version of the OpenAPI document: 8.0.0
+    Contact: support@hanzo.ai
+    Generated by OpenAPI Generator (https://openapi-generator.tech)
+
+    Do not edit the class manually.
+"""  # noqa: E501
+
+import warnings
+from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
+from typing import Any, Dict, List, Optional, Tuple, Union
+from typing_extensions import Annotated
+
+from hanzoai.cloud.models.cloud_csrf_resp import CloudCsrfResp
+
+from hanzoai.cloud.api_client import ApiClient, RequestSerialized
+from hanzoai.cloud.api_response import ApiResponse
+from hanzoai.cloud.rest import RESTResponseType
+
+
+class CsrfApi:
+    """NOTE: This class is auto generated by OpenAPI Generator
+    Ref: https://openapi-generator.tech
+
+    Do not edit the class manually.
+    """
+
+    def __init__(self, api_client=None) -> None:
+        if api_client is None:
+            api_client = ApiClient.get_default()
+        self.api_client = api_client
+
+
+    @validate_call
+    def cloud_get_v1_csrf(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> CloudCsrfResp:
+        """IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs).
+
+        IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs). The token is bound to the caller's validated identity and expires, so one minted for one identity cannot authorize a write as another.  It is answered no-store, so it is never cached by a shared proxy. This is the same-origin endpoint the embedded console reads — the Same-Origin Policy is what stops a cross-site page from reading the response and forging a write.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_csrf_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudCsrfResp",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def cloud_get_v1_csrf_with_http_info(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[CloudCsrfResp]:
+        """IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs).
+
+        IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs). The token is bound to the caller's validated identity and expires, so one minted for one identity cannot authorize a write as another.  It is answered no-store, so it is never cached by a shared proxy. This is the same-origin endpoint the embedded console reads — the Same-Origin Policy is what stops a cross-site page from reading the response and forging a write.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_csrf_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudCsrfResp",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def cloud_get_v1_csrf_without_preload_content(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs).
+
+        IssueCSRFToken mints the anti-CSRF token a browser echoes as X-CSRF-Token on every money write (mint/revoke a key, top up, onboard, and the billing/commerce write verbs). The token is bound to the caller's validated identity and expires, so one minted for one identity cannot authorize a write as another.  It is answered no-store, so it is never cached by a shared proxy. This is the same-origin endpoint the embedded console reads — the Same-Origin Policy is what stops a cross-site page from reading the response and forging a write.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_csrf_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudCsrfResp",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _cloud_get_v1_csrf_serialize(
+        self,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+
+
+        # set the HTTP header `Accept`
+        if 'Accept' not in _header_params:
+            _header_params['Accept'] = self.api_client.select_header_accept(
+                [
+                    'application/json'
+                ]
+            )
+
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'bearerAuth'
+        ]
+
+        return self.api_client.param_serialize(
+            method='GET',
+            resource_path='/v1/csrf',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+

pkg/hanzoai/cloud/api/dashboards_agents_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/dashboards_vm_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/data_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/deploys_api.py

@@ -1,324 +0,0 @@
-# coding: utf-8
-
-"""
-    Hanzo Cloud — Unified API (V8 · Open Edition)
-
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
-
-    The version of the OpenAPI document: 8.0.0
-    Contact: support@hanzo.ai
-    Generated by OpenAPI Generator (https://openapi-generator.tech)
-
-    Do not edit the class manually.
-"""  # noqa: E501
-
-import warnings
-from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
-from typing import Any, Dict, List, Optional, Tuple, Union
-from typing_extensions import Annotated
-
-from hanzoai.cloud.models.authors_record_deploy200_response import AuthorsRecordDeploy200Response
-from hanzoai.cloud.models.authors_record_deploy_request import AuthorsRecordDeployRequest
-
-from hanzoai.cloud.api_client import ApiClient, RequestSerialized
-from hanzoai.cloud.api_response import ApiResponse
-from hanzoai.cloud.rest import RESTResponseType
-
-
-class DeploysApi:
-    """NOTE: This class is auto generated by OpenAPI Generator
-    Ref: https://openapi-generator.tech
-
-    Do not edit the class manually.
-    """
-
-    def __init__(self, api_client=None) -> None:
-        if api_client is None:
-            api_client = ApiClient.get_default()
-        self.api_client = api_client
-
-
-    @validate_call
-    def authors_record_deploy(
-        self,
-        authors_record_deploy_request: AuthorsRecordDeployRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AuthorsRecordDeploy200Response:
-        """Record a deploy
-
-        Records a deploy-attribution edge for the caller (the DEPLOYING org). When `repoUrl` matches a verified author repo, the edge is recorded (idempotent per repo+project+org) and becomes eligible for royalty. A deploy of a repo that is not a verified author repo is NOT an error — it returns `recorded: false` so the deploy path can fire this unconditionally. A self-deploy is recorded (provenance) but excluded from accrual. 
-
-        :param authors_record_deploy_request: (required)
-        :type authors_record_deploy_request: AuthorsRecordDeployRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._authors_record_deploy_serialize(
-            authors_record_deploy_request=authors_record_deploy_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AuthorsRecordDeploy200Response",
-            '201': "AuthorsDeployRecorded",
-            '400': "AuthorsError",
-            '403': "AuthorsError",
-            '500': "AuthorsError",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def authors_record_deploy_with_http_info(
-        self,
-        authors_record_deploy_request: AuthorsRecordDeployRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AuthorsRecordDeploy200Response]:
-        """Record a deploy
-
-        Records a deploy-attribution edge for the caller (the DEPLOYING org). When `repoUrl` matches a verified author repo, the edge is recorded (idempotent per repo+project+org) and becomes eligible for royalty. A deploy of a repo that is not a verified author repo is NOT an error — it returns `recorded: false` so the deploy path can fire this unconditionally. A self-deploy is recorded (provenance) but excluded from accrual. 
-
-        :param authors_record_deploy_request: (required)
-        :type authors_record_deploy_request: AuthorsRecordDeployRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._authors_record_deploy_serialize(
-            authors_record_deploy_request=authors_record_deploy_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AuthorsRecordDeploy200Response",
-            '201': "AuthorsDeployRecorded",
-            '400': "AuthorsError",
-            '403': "AuthorsError",
-            '500': "AuthorsError",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def authors_record_deploy_without_preload_content(
-        self,
-        authors_record_deploy_request: AuthorsRecordDeployRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """Record a deploy
-
-        Records a deploy-attribution edge for the caller (the DEPLOYING org). When `repoUrl` matches a verified author repo, the edge is recorded (idempotent per repo+project+org) and becomes eligible for royalty. A deploy of a repo that is not a verified author repo is NOT an error — it returns `recorded: false` so the deploy path can fire this unconditionally. A self-deploy is recorded (provenance) but excluded from accrual. 
-
-        :param authors_record_deploy_request: (required)
-        :type authors_record_deploy_request: AuthorsRecordDeployRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._authors_record_deploy_serialize(
-            authors_record_deploy_request=authors_record_deploy_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AuthorsRecordDeploy200Response",
-            '201': "AuthorsDeployRecorded",
-            '400': "AuthorsError",
-            '403': "AuthorsError",
-            '500': "AuthorsError",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _authors_record_deploy_serialize(
-        self,
-        authors_record_deploy_request,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-        if authors_record_deploy_request is not None:
-            _body_params = authors_record_deploy_request
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-        # set the HTTP header `Content-Type`
-        if _content_type:
-            _header_params['Content-Type'] = _content_type
-        else:
-            _default_content_type = (
-                self.api_client.select_header_content_type(
-                    [
-                        'application/json'
-                    ]
-                )
-            )
-            if _default_content_type is not None:
-                _header_params['Content-Type'] = _default_content_type
-
-        # authentication setting
-        _auth_settings: List[str] = [
-            'bearerAuth'
-        ]
-
-        return self.api_client.param_serialize(
-            method='POST',
-            resource_path='/v1/authors/deploys/record',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-

pkg/hanzoai/cloud/api/dnssec_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/domains_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/dumps_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/edge_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -20,7 +20,7 @@ from typing_extensions import Annotated
 from pydantic import Field, StrictStr
 from typing import Any, Dict, Optional
 from typing_extensions import Annotated
-from hanzoai.cloud.models.zt_list_edge_nodes200_response import ZtListEdgeNodes200Response
+from hanzoai.cloud.models.cloud_edge_node_list import CloudEdgeNodeList
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
@@ -40,6 +40,252 @@ class EdgeApi:
         self.api_client = api_client
 
 
+    @validate_call
+    def cloud_get_v1_edge_nodes(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> CloudEdgeNodeList:
+        """Returns the Zero Trust edge-routers the caller's org owns.
+
+        Returns the Zero Trust edge-routers the caller's org owns.  One row per real ZT edge-router tagged with the org's \"org-<org>\" role attribute, carrying the controller's own health signal: \"online\" when connected, \"disabled\" when administratively disabled, \"offline\" otherwise. region is filled only from a \"region-<slug>\" role attribute and omitted when the router carries none, so the column renders \"—\" rather than a guess.  The read degrades rather than erroring: a deployment with no ZT credential, and a controller that cannot be reached, both answer 200 with an empty list.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_edge_nodes_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudEdgeNodeList",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def cloud_get_v1_edge_nodes_with_http_info(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[CloudEdgeNodeList]:
+        """Returns the Zero Trust edge-routers the caller's org owns.
+
+        Returns the Zero Trust edge-routers the caller's org owns.  One row per real ZT edge-router tagged with the org's \"org-<org>\" role attribute, carrying the controller's own health signal: \"online\" when connected, \"disabled\" when administratively disabled, \"offline\" otherwise. region is filled only from a \"region-<slug>\" role attribute and omitted when the router carries none, so the column renders \"—\" rather than a guess.  The read degrades rather than erroring: a deployment with no ZT credential, and a controller that cannot be reached, both answer 200 with an empty list.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_edge_nodes_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudEdgeNodeList",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def cloud_get_v1_edge_nodes_without_preload_content(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """Returns the Zero Trust edge-routers the caller's org owns.
+
+        Returns the Zero Trust edge-routers the caller's org owns.  One row per real ZT edge-router tagged with the org's \"org-<org>\" role attribute, carrying the controller's own health signal: \"online\" when connected, \"disabled\" when administratively disabled, \"offline\" otherwise. region is filled only from a \"region-<slug>\" role attribute and omitted when the router carries none, so the column renders \"—\" rather than a guess.  The read degrades rather than erroring: a deployment with no ZT credential, and a controller that cannot be reached, both answer 200 with an empty list.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_edge_nodes_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudEdgeNodeList",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _cloud_get_v1_edge_nodes_serialize(
+        self,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+
+
+        # set the HTTP header `Accept`
+        if 'Accept' not in _header_params:
+            _header_params['Accept'] = self.api_client.select_header_accept(
+                [
+                    'application/json'
+                ]
+            )
+
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'bearerAuth'
+        ]
+
+        return self.api_client.param_serialize(
+            method='GET',
+            resource_path='/v1/edge/nodes',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+
+
+
     @validate_call
     def gateway_invoke_edge_function(
         self,
@@ -590,252 +836,3 @@ class EdgeApi:
         )
 
 
-
-
-    @validate_call
-    def zt_list_edge_nodes(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ZtListEdgeNodes200Response:
-        """List the org's ZT edge-routers
-
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._zt_list_edge_nodes_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "ZtListEdgeNodes200Response",
-            '401': "AdminAdminCreatePromo400Response",
-            '503': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def zt_list_edge_nodes_with_http_info(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[ZtListEdgeNodes200Response]:
-        """List the org's ZT edge-routers
-
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._zt_list_edge_nodes_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "ZtListEdgeNodes200Response",
-            '401': "AdminAdminCreatePromo400Response",
-            '503': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def zt_list_edge_nodes_without_preload_content(
-        self,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """List the org's ZT edge-routers
-
-
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._zt_list_edge_nodes_serialize(
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "ZtListEdgeNodes200Response",
-            '401': "AdminAdminCreatePromo400Response",
-            '503': "AdminAdminCreatePromo400Response",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _zt_list_edge_nodes_serialize(
-        self,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-
-        # authentication setting
-        _auth_settings: List[str] = [
-            'bearerAuth'
-        ]
-
-        return self.api_client.param_serialize(
-            method='GET',
-            resource_path='/v1/edge/nodes',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-

pkg/hanzoai/cloud/api/embed_status_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -18,16 +18,16 @@ from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
 from pydantic import Field, StrictStr
-from typing import Any, Dict, List, Optional
+from typing import Optional
 from typing_extensions import Annotated
-from hanzoai.cloud.models.cloud_product_controller_search_docs_request import CloudProductControllerSearchDocsRequest
+from hanzoai.cloud.models.cloud_embed_status_resp import CloudEmbedStatusResp
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class SearchAPIApi:
+class EmbedStatusApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -41,10 +41,9 @@ class SearchAPIApi:
 
 
     @validate_call
-    def cloud_product_controller_search_docs(
+    def cloud_get_v1_embed_status(
         self,
-        cloud_product_controller_search_docs_request: CloudProductControllerSearchDocsRequest,
-        store: Annotated[Optional[StrictStr], Field(description="Optional store/index selector (e.g. bot-docs).")] = None,
+        app: Annotated[Optional[StrictStr], Field(description="App is the embedded app to report on: cms (Content Studio), erp or help.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -57,15 +56,13 @@ class SearchAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> List[object]:
-        """cloud_product_controller_search_docs
+    ) -> CloudEmbedStatusResp:
+        """EmbedStatus reports whether one of this brand's shared embedded apps (cms, erp, help) may be framed by the caller and is actually running, so a console module can choose between the embed and the provision panel.
 
-        Hybrid full-text + vector search over an indexed document store.
+        EmbedStatus reports whether one of this brand's shared embedded apps (cms, erp, help) may be framed by the caller and is actually running, so a console module can choose between the embed and the provision panel.  It answers two questions the browser cannot answer for itself. ENTITLEMENT is server-authoritative: each app is a single shared per-BRAND instance, so only a member of the owning brand org — or a SuperAdmin — is given the embed URL; every other caller gets phase \"not-entitled\" and no URL. REACHABILITY is a probe of that origin, which a cross-origin page cannot read for itself.  The probed host is always <app>.<this deployment's own brand domain>: no part of it comes from the request, so this can never be steered into probing an arbitrary origin.
 
-        :param cloud_product_controller_search_docs_request: (required)
-        :type cloud_product_controller_search_docs_request: CloudProductControllerSearchDocsRequest
-        :param store: Optional store/index selector (e.g. bot-docs).
-        :type store: str
+        :param app: App is the embedded app to report on: cms (Content Studio), erp or help.
+        :type app: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -88,9 +85,8 @@ class SearchAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_product_controller_search_docs_serialize(
-            cloud_product_controller_search_docs_request=cloud_product_controller_search_docs_request,
-            store=store,
+        _param = self._cloud_get_v1_embed_status_serialize(
+            app=app,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -98,7 +94,7 @@ class SearchAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "List[object]",
+            '200': "CloudEmbedStatusResp",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -112,10 +108,9 @@ class SearchAPIApi:
 
 
     @validate_call
-    def cloud_product_controller_search_docs_with_http_info(
+    def cloud_get_v1_embed_status_with_http_info(
         self,
-        cloud_product_controller_search_docs_request: CloudProductControllerSearchDocsRequest,
-        store: Annotated[Optional[StrictStr], Field(description="Optional store/index selector (e.g. bot-docs).")] = None,
+        app: Annotated[Optional[StrictStr], Field(description="App is the embedded app to report on: cms (Content Studio), erp or help.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -128,15 +123,13 @@ class SearchAPIApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[List[object]]:
-        """cloud_product_controller_search_docs
+    ) -> ApiResponse[CloudEmbedStatusResp]:
+        """EmbedStatus reports whether one of this brand's shared embedded apps (cms, erp, help) may be framed by the caller and is actually running, so a console module can choose between the embed and the provision panel.
 
-        Hybrid full-text + vector search over an indexed document store.
+        EmbedStatus reports whether one of this brand's shared embedded apps (cms, erp, help) may be framed by the caller and is actually running, so a console module can choose between the embed and the provision panel.  It answers two questions the browser cannot answer for itself. ENTITLEMENT is server-authoritative: each app is a single shared per-BRAND instance, so only a member of the owning brand org — or a SuperAdmin — is given the embed URL; every other caller gets phase \"not-entitled\" and no URL. REACHABILITY is a probe of that origin, which a cross-origin page cannot read for itself.  The probed host is always <app>.<this deployment's own brand domain>: no part of it comes from the request, so this can never be steered into probing an arbitrary origin.
 
-        :param cloud_product_controller_search_docs_request: (required)
-        :type cloud_product_controller_search_docs_request: CloudProductControllerSearchDocsRequest
-        :param store: Optional store/index selector (e.g. bot-docs).
-        :type store: str
+        :param app: App is the embedded app to report on: cms (Content Studio), erp or help.
+        :type app: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -159,9 +152,8 @@ class SearchAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_product_controller_search_docs_serialize(
-            cloud_product_controller_search_docs_request=cloud_product_controller_search_docs_request,
-            store=store,
+        _param = self._cloud_get_v1_embed_status_serialize(
+            app=app,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -169,7 +161,7 @@ class SearchAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "List[object]",
+            '200': "CloudEmbedStatusResp",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -183,10 +175,9 @@ class SearchAPIApi:
 
 
     @validate_call
-    def cloud_product_controller_search_docs_without_preload_content(
+    def cloud_get_v1_embed_status_without_preload_content(
         self,
-        cloud_product_controller_search_docs_request: CloudProductControllerSearchDocsRequest,
-        store: Annotated[Optional[StrictStr], Field(description="Optional store/index selector (e.g. bot-docs).")] = None,
+        app: Annotated[Optional[StrictStr], Field(description="App is the embedded app to report on: cms (Content Studio), erp or help.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -200,14 +191,12 @@ class SearchAPIApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """cloud_product_controller_search_docs
+        """EmbedStatus reports whether one of this brand's shared embedded apps (cms, erp, help) may be framed by the caller and is actually running, so a console module can choose between the embed and the provision panel.
 
-        Hybrid full-text + vector search over an indexed document store.
+        EmbedStatus reports whether one of this brand's shared embedded apps (cms, erp, help) may be framed by the caller and is actually running, so a console module can choose between the embed and the provision panel.  It answers two questions the browser cannot answer for itself. ENTITLEMENT is server-authoritative: each app is a single shared per-BRAND instance, so only a member of the owning brand org — or a SuperAdmin — is given the embed URL; every other caller gets phase \"not-entitled\" and no URL. REACHABILITY is a probe of that origin, which a cross-origin page cannot read for itself.  The probed host is always <app>.<this deployment's own brand domain>: no part of it comes from the request, so this can never be steered into probing an arbitrary origin.
 
-        :param cloud_product_controller_search_docs_request: (required)
-        :type cloud_product_controller_search_docs_request: CloudProductControllerSearchDocsRequest
-        :param store: Optional store/index selector (e.g. bot-docs).
-        :type store: str
+        :param app: App is the embedded app to report on: cms (Content Studio), erp or help.
+        :type app: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -230,9 +219,8 @@ class SearchAPIApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._cloud_product_controller_search_docs_serialize(
-            cloud_product_controller_search_docs_request=cloud_product_controller_search_docs_request,
-            store=store,
+        _param = self._cloud_get_v1_embed_status_serialize(
+            app=app,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -240,7 +228,7 @@ class SearchAPIApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "List[object]",
+            '200': "CloudEmbedStatusResp",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -249,10 +237,9 @@ class SearchAPIApi:
         return response_data.response
 
 
-    def _cloud_product_controller_search_docs_serialize(
+    def _cloud_get_v1_embed_status_serialize(
         self,
-        cloud_product_controller_search_docs_request,
-        store,
+        app,
         _request_auth,
         _content_type,
         _headers,
@@ -275,15 +262,13 @@ class SearchAPIApi:
 
         # process the path parameters
         # process the query parameters
-        if store is not None:
+        if app is not None:
             
-            _query_params.append(('store', store))
+            _query_params.append(('app', app))
             
         # process the header parameters
         # process the form parameters
         # process the body parameter
-        if cloud_product_controller_search_docs_request is not None:
-            _body_params = cloud_product_controller_search_docs_request
 
 
         # set the HTTP header `Accept`
@@ -294,19 +279,6 @@ class SearchAPIApi:
                 ]
             )
 
-        # set the HTTP header `Content-Type`
-        if _content_type:
-            _header_params['Content-Type'] = _content_type
-        else:
-            _default_content_type = (
-                self.api_client.select_header_content_type(
-                    [
-                        'application/json'
-                    ]
-                )
-            )
-            if _default_content_type is not None:
-                _header_params['Content-Type'] = _default_content_type
 
         # authentication setting
         _auth_settings: List[str] = [
@@ -314,8 +286,8 @@ class SearchAPIApi:
         ]
 
         return self.api_client.param_serialize(
-            method='POST',
-            resource_path='/v1/search-docs',
+            method='GET',
+            resource_path='/v1/embed-status',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/embeddings_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/enablement_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,15 +17,16 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from pydantic import StrictBytes, StrictStr, field_validator
-from typing import Tuple, Union
+from hanzoai.cloud.models.cloud_enablement_board import CloudEnablementBoard
+from hanzoai.cloud.models.cloud_enablement_opt_ref import CloudEnablementOptRef
+from hanzoai.cloud.models.cloud_user_enablement_item import CloudUserEnablementItem
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class SmartHTTPApi:
+class EnablementApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -39,11 +40,8 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_info_refs(
+    def cloud_get_v1_enablement(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        service: StrictStr,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -56,17 +54,11 @@ class SmartHTTPApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> bytearray:
-        """Git smart-HTTP ref advertisement
+    ) -> CloudEnablementBoard:
+        """GetEnablement returns what the caller's org can actually use: every managed item with its global state, whether it is effective here, whether this org is already opted into its beta, and whether it may still opt in.
 
-        The ref-advertisement phase. `?service=` selects git-upload-pack (fetch) or git-receive-pack (push).
+        GetEnablement returns what the caller's org can actually use: every managed item with its global state, whether it is effective here, whether this org is already opted into its beta, and whether it may still opt in. Read-only and safe for any caller — one without a validated principal simply sees the generally-available items and no opt-in affordance, never another org's state.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param service: (required)
-        :type service: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -89,10 +81,7 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_info_refs_serialize(
-            org=org,
-            repo=repo,
-            service=service,
+        _param = self._cloud_get_v1_enablement_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -100,10 +89,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
+            '200': "CloudEnablementBoard",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -117,11 +103,8 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_info_refs_with_http_info(
+    def cloud_get_v1_enablement_with_http_info(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        service: StrictStr,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -134,17 +117,11 @@ class SmartHTTPApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[bytearray]:
-        """Git smart-HTTP ref advertisement
+    ) -> ApiResponse[CloudEnablementBoard]:
+        """GetEnablement returns what the caller's org can actually use: every managed item with its global state, whether it is effective here, whether this org is already opted into its beta, and whether it may still opt in.
 
-        The ref-advertisement phase. `?service=` selects git-upload-pack (fetch) or git-receive-pack (push).
+        GetEnablement returns what the caller's org can actually use: every managed item with its global state, whether it is effective here, whether this org is already opted into its beta, and whether it may still opt in. Read-only and safe for any caller — one without a validated principal simply sees the generally-available items and no opt-in affordance, never another org's state.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param service: (required)
-        :type service: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -167,10 +144,7 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_info_refs_serialize(
-            org=org,
-            repo=repo,
-            service=service,
+        _param = self._cloud_get_v1_enablement_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -178,10 +152,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
+            '200': "CloudEnablementBoard",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -195,11 +166,8 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_info_refs_without_preload_content(
+    def cloud_get_v1_enablement_without_preload_content(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        service: StrictStr,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -213,16 +181,10 @@ class SmartHTTPApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Git smart-HTTP ref advertisement
+        """GetEnablement returns what the caller's org can actually use: every managed item with its global state, whether it is effective here, whether this org is already opted into its beta, and whether it may still opt in.
 
-        The ref-advertisement phase. `?service=` selects git-upload-pack (fetch) or git-receive-pack (push).
+        GetEnablement returns what the caller's org can actually use: every managed item with its global state, whether it is effective here, whether this org is already opted into its beta, and whether it may still opt in. Read-only and safe for any caller — one without a validated principal simply sees the generally-available items and no opt-in affordance, never another org's state.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param service: (required)
-        :type service: str
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -245,10 +207,7 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_info_refs_serialize(
-            org=org,
-            repo=repo,
-            service=service,
+        _param = self._cloud_get_v1_enablement_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -256,10 +215,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
+            '200': "CloudEnablementBoard",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -268,11 +224,8 @@ class SmartHTTPApi:
         return response_data.response
 
 
-    def _git_git_info_refs_serialize(
+    def _cloud_get_v1_enablement_serialize(
         self,
-        org,
-        repo,
-        service,
         _request_auth,
         _content_type,
         _headers,
@@ -294,15 +247,7 @@ class SmartHTTPApi:
         _body_params: Optional[bytes] = None
 
         # process the path parameters
-        if org is not None:
-            _path_params['org'] = org
-        if repo is not None:
-            _path_params['repo'] = repo
         # process the query parameters
-        if service is not None:
-            
-            _query_params.append(('service', service))
-            
         # process the header parameters
         # process the form parameters
         # process the body parameter
@@ -312,8 +257,6 @@ class SmartHTTPApi:
         if 'Accept' not in _header_params:
             _header_params['Accept'] = self.api_client.select_header_accept(
                 [
-                    'application/x-git-upload-pack-advertisement', 
-                    'application/x-git-receive-pack-advertisement', 
                     'application/json'
                 ]
             )
@@ -326,7 +269,7 @@ class SmartHTTPApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/git/{org}/{repo}/info/refs',
+            resource_path='/v1/enablement',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -343,11 +286,9 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_receive_pack(
+    def cloud_post_v1_enablement_optin(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        body: Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]],
+        cloud_enablement_opt_ref: CloudEnablementOptRef,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -360,16 +301,13 @@ class SmartHTTPApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> bytearray:
-        """Git receive-pack (push)
+    ) -> CloudUserEnablementItem:
+        """OptIntoBeta opts the caller's OWN org into a beta item.
 
+        OptIntoBeta opts the caller's OWN org into a beta item. The org is the caller's validated one, so this can never target another org, and the registry refuses anything not in beta — so it can neither re-open an item an operator turned off nor touch one that is already generally available. Requires a signed-in caller with an org.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param body: (required)
-        :type body: bytearray
+        :param cloud_enablement_opt_ref: (required)
+        :type cloud_enablement_opt_ref: CloudEnablementOptRef
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -392,10 +330,8 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_receive_pack_serialize(
-            org=org,
-            repo=repo,
-            body=body,
+        _param = self._cloud_post_v1_enablement_optin_serialize(
+            cloud_enablement_opt_ref=cloud_enablement_opt_ref,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -403,11 +339,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
-            '413': None,
+            '200': "CloudUserEnablementItem",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -421,11 +353,9 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_receive_pack_with_http_info(
+    def cloud_post_v1_enablement_optin_with_http_info(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        body: Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]],
+        cloud_enablement_opt_ref: CloudEnablementOptRef,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -438,16 +368,13 @@ class SmartHTTPApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[bytearray]:
-        """Git receive-pack (push)
+    ) -> ApiResponse[CloudUserEnablementItem]:
+        """OptIntoBeta opts the caller's OWN org into a beta item.
 
+        OptIntoBeta opts the caller's OWN org into a beta item. The org is the caller's validated one, so this can never target another org, and the registry refuses anything not in beta — so it can neither re-open an item an operator turned off nor touch one that is already generally available. Requires a signed-in caller with an org.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param body: (required)
-        :type body: bytearray
+        :param cloud_enablement_opt_ref: (required)
+        :type cloud_enablement_opt_ref: CloudEnablementOptRef
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -470,10 +397,8 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_receive_pack_serialize(
-            org=org,
-            repo=repo,
-            body=body,
+        _param = self._cloud_post_v1_enablement_optin_serialize(
+            cloud_enablement_opt_ref=cloud_enablement_opt_ref,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -481,11 +406,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
-            '413': None,
+            '200': "CloudUserEnablementItem",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -499,11 +420,9 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_receive_pack_without_preload_content(
+    def cloud_post_v1_enablement_optin_without_preload_content(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        body: Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]],
+        cloud_enablement_opt_ref: CloudEnablementOptRef,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -517,15 +436,12 @@ class SmartHTTPApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Git receive-pack (push)
+        """OptIntoBeta opts the caller's OWN org into a beta item.
 
+        OptIntoBeta opts the caller's OWN org into a beta item. The org is the caller's validated one, so this can never target another org, and the registry refuses anything not in beta — so it can neither re-open an item an operator turned off nor touch one that is already generally available. Requires a signed-in caller with an org.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param body: (required)
-        :type body: bytearray
+        :param cloud_enablement_opt_ref: (required)
+        :type cloud_enablement_opt_ref: CloudEnablementOptRef
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -548,10 +464,8 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_receive_pack_serialize(
-            org=org,
-            repo=repo,
-            body=body,
+        _param = self._cloud_post_v1_enablement_optin_serialize(
+            cloud_enablement_opt_ref=cloud_enablement_opt_ref,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -559,11 +473,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
-            '413': None,
+            '200': "CloudUserEnablementItem",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -572,11 +482,9 @@ class SmartHTTPApi:
         return response_data.response
 
 
-    def _git_git_receive_pack_serialize(
+    def _cloud_post_v1_enablement_optin_serialize(
         self,
-        org,
-        repo,
-        body,
+        cloud_enablement_opt_ref,
         _request_auth,
         _content_type,
         _headers,
@@ -598,31 +506,18 @@ class SmartHTTPApi:
         _body_params: Optional[bytes] = None
 
         # process the path parameters
-        if org is not None:
-            _path_params['org'] = org
-        if repo is not None:
-            _path_params['repo'] = repo
         # process the query parameters
         # process the header parameters
         # process the form parameters
         # process the body parameter
-        if body is not None:
-            # convert to byte array if the input is a file name (str)
-            if isinstance(body, str):
-                with open(body, "rb") as _fp:
-                    _body_params = _fp.read()
-            elif isinstance(body, tuple):
-                # drop the filename from the tuple
-                _body_params = body[1]
-            else:
-                _body_params = body
+        if cloud_enablement_opt_ref is not None:
+            _body_params = cloud_enablement_opt_ref
 
 
         # set the HTTP header `Accept`
         if 'Accept' not in _header_params:
             _header_params['Accept'] = self.api_client.select_header_accept(
                 [
-                    'application/x-git-receive-pack-result', 
                     'application/json'
                 ]
             )
@@ -634,7 +529,7 @@ class SmartHTTPApi:
             _default_content_type = (
                 self.api_client.select_header_content_type(
                     [
-                        'application/x-git-receive-pack-request'
+                        'application/json'
                     ]
                 )
             )
@@ -648,7 +543,7 @@ class SmartHTTPApi:
 
         return self.api_client.param_serialize(
             method='POST',
-            resource_path='/v1/git/{org}/{repo}/git-receive-pack',
+            resource_path='/v1/enablement/optin',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,
@@ -665,11 +560,9 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_upload_pack(
+    def cloud_post_v1_enablement_optout(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        body: Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]],
+        cloud_enablement_opt_ref: CloudEnablementOptRef,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -682,16 +575,13 @@ class SmartHTTPApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> bytearray:
-        """Git upload-pack (clone / fetch)
+    ) -> CloudUserEnablementItem:
+        """OptOutOfBeta removes the caller's OWN org from a beta item's grant list, the reverse of OptIntoBeta and idempotent.
 
+        OptOutOfBeta removes the caller's OWN org from a beta item's grant list, the reverse of OptIntoBeta and idempotent. The org is the caller's validated one, so this can never revoke another org's grant. Requires a signed-in caller with an org.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param body: (required)
-        :type body: bytearray
+        :param cloud_enablement_opt_ref: (required)
+        :type cloud_enablement_opt_ref: CloudEnablementOptRef
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -714,10 +604,8 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_upload_pack_serialize(
-            org=org,
-            repo=repo,
-            body=body,
+        _param = self._cloud_post_v1_enablement_optout_serialize(
+            cloud_enablement_opt_ref=cloud_enablement_opt_ref,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -725,11 +613,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
-            '413': None,
+            '200': "CloudUserEnablementItem",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -743,11 +627,9 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_upload_pack_with_http_info(
+    def cloud_post_v1_enablement_optout_with_http_info(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        body: Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]],
+        cloud_enablement_opt_ref: CloudEnablementOptRef,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -760,16 +642,13 @@ class SmartHTTPApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[bytearray]:
-        """Git upload-pack (clone / fetch)
+    ) -> ApiResponse[CloudUserEnablementItem]:
+        """OptOutOfBeta removes the caller's OWN org from a beta item's grant list, the reverse of OptIntoBeta and idempotent.
 
+        OptOutOfBeta removes the caller's OWN org from a beta item's grant list, the reverse of OptIntoBeta and idempotent. The org is the caller's validated one, so this can never revoke another org's grant. Requires a signed-in caller with an org.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param body: (required)
-        :type body: bytearray
+        :param cloud_enablement_opt_ref: (required)
+        :type cloud_enablement_opt_ref: CloudEnablementOptRef
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -792,10 +671,8 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_upload_pack_serialize(
-            org=org,
-            repo=repo,
-            body=body,
+        _param = self._cloud_post_v1_enablement_optout_serialize(
+            cloud_enablement_opt_ref=cloud_enablement_opt_ref,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -803,11 +680,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
-            '413': None,
+            '200': "CloudUserEnablementItem",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -821,11 +694,9 @@ class SmartHTTPApi:
 
 
     @validate_call
-    def git_git_upload_pack_without_preload_content(
+    def cloud_post_v1_enablement_optout_without_preload_content(
         self,
-        org: StrictStr,
-        repo: StrictStr,
-        body: Union[StrictBytes, StrictStr, Tuple[StrictStr, StrictBytes]],
+        cloud_enablement_opt_ref: CloudEnablementOptRef,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -839,15 +710,12 @@ class SmartHTTPApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Git upload-pack (clone / fetch)
+        """OptOutOfBeta removes the caller's OWN org from a beta item's grant list, the reverse of OptIntoBeta and idempotent.
 
+        OptOutOfBeta removes the caller's OWN org from a beta item's grant list, the reverse of OptIntoBeta and idempotent. The org is the caller's validated one, so this can never revoke another org's grant. Requires a signed-in caller with an org.
 
-        :param org: (required)
-        :type org: str
-        :param repo: (required)
-        :type repo: str
-        :param body: (required)
-        :type body: bytearray
+        :param cloud_enablement_opt_ref: (required)
+        :type cloud_enablement_opt_ref: CloudEnablementOptRef
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -870,10 +738,8 @@ class SmartHTTPApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._git_git_upload_pack_serialize(
-            org=org,
-            repo=repo,
-            body=body,
+        _param = self._cloud_post_v1_enablement_optout_serialize(
+            cloud_enablement_opt_ref=cloud_enablement_opt_ref,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -881,11 +747,7 @@ class SmartHTTPApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "bytearray",
-            '400': None,
-            '401': "AdminAdminCreatePromo400Response",
-            '404': None,
-            '413': None,
+            '200': "CloudUserEnablementItem",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -894,11 +756,9 @@ class SmartHTTPApi:
         return response_data.response
 
 
-    def _git_git_upload_pack_serialize(
+    def _cloud_post_v1_enablement_optout_serialize(
         self,
-        org,
-        repo,
-        body,
+        cloud_enablement_opt_ref,
         _request_auth,
         _content_type,
         _headers,
@@ -920,31 +780,18 @@ class SmartHTTPApi:
         _body_params: Optional[bytes] = None
 
         # process the path parameters
-        if org is not None:
-            _path_params['org'] = org
-        if repo is not None:
-            _path_params['repo'] = repo
         # process the query parameters
         # process the header parameters
         # process the form parameters
         # process the body parameter
-        if body is not None:
-            # convert to byte array if the input is a file name (str)
-            if isinstance(body, str):
-                with open(body, "rb") as _fp:
-                    _body_params = _fp.read()
-            elif isinstance(body, tuple):
-                # drop the filename from the tuple
-                _body_params = body[1]
-            else:
-                _body_params = body
+        if cloud_enablement_opt_ref is not None:
+            _body_params = cloud_enablement_opt_ref
 
 
         # set the HTTP header `Accept`
         if 'Accept' not in _header_params:
             _header_params['Accept'] = self.api_client.select_header_accept(
                 [
-                    'application/x-git-upload-pack-result', 
                     'application/json'
                 ]
             )
@@ -956,7 +803,7 @@ class SmartHTTPApi:
             _default_content_type = (
                 self.api_client.select_header_content_type(
                     [
-                        'application/x-git-upload-pack-request'
+                        'application/json'
                     ]
                 )
             )
@@ -970,7 +817,7 @@ class SmartHTTPApi:
 
         return self.api_client.param_serialize(
             method='POST',
-            resource_path='/v1/git/{org}/{repo}/git-upload-pack',
+            resource_path='/v1/enablement/optout',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/encryption_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai

pkg/hanzoai/cloud/api/enforcement_api.py

@@ -1,321 +0,0 @@
-# coding: utf-8
-
-"""
-    Hanzo Cloud — Unified API (V8 · Open Edition)
-
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
-
-    The version of the OpenAPI document: 8.0.0
-    Contact: support@hanzo.ai
-    Generated by OpenAPI Generator (https://openapi-generator.tech)
-
-    Do not edit the class manually.
-"""  # noqa: E501
-
-import warnings
-from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
-from typing import Any, Dict, List, Optional, Tuple, Union
-from typing_extensions import Annotated
-
-from hanzoai.cloud.models.authz_check_response import AuthzCheckResponse
-from hanzoai.cloud.models.authz_enforce_request import AuthzEnforceRequest
-
-from hanzoai.cloud.api_client import ApiClient, RequestSerialized
-from hanzoai.cloud.api_response import ApiResponse
-from hanzoai.cloud.rest import RESTResponseType
-
-
-class EnforcementApi:
-    """NOTE: This class is auto generated by OpenAPI Generator
-    Ref: https://openapi-generator.tech
-
-    Do not edit the class manually.
-    """
-
-    def __init__(self, api_client=None) -> None:
-        if api_client is None:
-            api_client = ApiClient.get_default()
-        self.api_client = api_client
-
-
-    @validate_call
-    def authz_authz_check(
-        self,
-        authz_enforce_request: AuthzEnforceRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> AuthzCheckResponse:
-        """Check a permission
-
-        Evaluates whether subject `sub` may perform action `act` on object `obj` under the calling org's policy set. The org is selected by the gateway-minted `X-Org-Id` header; an unauthenticated request (no org) is rejected. All three fields are required. 
-
-        :param authz_enforce_request: (required)
-        :type authz_enforce_request: AuthzEnforceRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._authz_authz_check_serialize(
-            authz_enforce_request=authz_enforce_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AuthzCheckResponse",
-            '400': "AuthzError",
-            '401': "AuthzError",
-            '500': "AuthzError",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        ).data
-
-
-    @validate_call
-    def authz_authz_check_with_http_info(
-        self,
-        authz_enforce_request: AuthzEnforceRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[AuthzCheckResponse]:
-        """Check a permission
-
-        Evaluates whether subject `sub` may perform action `act` on object `obj` under the calling org's policy set. The org is selected by the gateway-minted `X-Org-Id` header; an unauthenticated request (no org) is rejected. All three fields are required. 
-
-        :param authz_enforce_request: (required)
-        :type authz_enforce_request: AuthzEnforceRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._authz_authz_check_serialize(
-            authz_enforce_request=authz_enforce_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AuthzCheckResponse",
-            '400': "AuthzError",
-            '401': "AuthzError",
-            '500': "AuthzError",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        response_data.read()
-        return self.api_client.response_deserialize(
-            response_data=response_data,
-            response_types_map=_response_types_map,
-        )
-
-
-    @validate_call
-    def authz_authz_check_without_preload_content(
-        self,
-        authz_enforce_request: AuthzEnforceRequest,
-        _request_timeout: Union[
-            None,
-            Annotated[StrictFloat, Field(gt=0)],
-            Tuple[
-                Annotated[StrictFloat, Field(gt=0)],
-                Annotated[StrictFloat, Field(gt=0)]
-            ]
-        ] = None,
-        _request_auth: Optional[Dict[StrictStr, Any]] = None,
-        _content_type: Optional[StrictStr] = None,
-        _headers: Optional[Dict[StrictStr, Any]] = None,
-        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> RESTResponseType:
-        """Check a permission
-
-        Evaluates whether subject `sub` may perform action `act` on object `obj` under the calling org's policy set. The org is selected by the gateway-minted `X-Org-Id` header; an unauthenticated request (no org) is rejected. All three fields are required. 
-
-        :param authz_enforce_request: (required)
-        :type authz_enforce_request: AuthzEnforceRequest
-        :param _request_timeout: timeout setting for this request. If one
-                                 number provided, it will be total request
-                                 timeout. It can also be a pair (tuple) of
-                                 (connection, read) timeouts.
-        :type _request_timeout: int, tuple(int, int), optional
-        :param _request_auth: set to override the auth_settings for an a single
-                              request; this effectively ignores the
-                              authentication in the spec for a single request.
-        :type _request_auth: dict, optional
-        :param _content_type: force content-type for the request.
-        :type _content_type: str, Optional
-        :param _headers: set to override the headers for a single
-                         request; this effectively ignores the headers
-                         in the spec for a single request.
-        :type _headers: dict, optional
-        :param _host_index: set to override the host_index for a single
-                            request; this effectively ignores the host_index
-                            in the spec for a single request.
-        :type _host_index: int, optional
-        :return: Returns the result object.
-        """ # noqa: E501
-
-        _param = self._authz_authz_check_serialize(
-            authz_enforce_request=authz_enforce_request,
-            _request_auth=_request_auth,
-            _content_type=_content_type,
-            _headers=_headers,
-            _host_index=_host_index
-        )
-
-        _response_types_map: Dict[str, Optional[str]] = {
-            '200': "AuthzCheckResponse",
-            '400': "AuthzError",
-            '401': "AuthzError",
-            '500': "AuthzError",
-        }
-        response_data = self.api_client.call_api(
-            *_param,
-            _request_timeout=_request_timeout
-        )
-        return response_data.response
-
-
-    def _authz_authz_check_serialize(
-        self,
-        authz_enforce_request,
-        _request_auth,
-        _content_type,
-        _headers,
-        _host_index,
-    ) -> RequestSerialized:
-
-        _host = None
-
-        _collection_formats: Dict[str, str] = {
-        }
-
-        _path_params: Dict[str, str] = {}
-        _query_params: List[Tuple[str, str]] = []
-        _header_params: Dict[str, Optional[str]] = _headers or {}
-        _form_params: List[Tuple[str, str]] = []
-        _files: Dict[
-            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
-        ] = {}
-        _body_params: Optional[bytes] = None
-
-        # process the path parameters
-        # process the query parameters
-        # process the header parameters
-        # process the form parameters
-        # process the body parameter
-        if authz_enforce_request is not None:
-            _body_params = authz_enforce_request
-
-
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
-
-        # set the HTTP header `Content-Type`
-        if _content_type:
-            _header_params['Content-Type'] = _content_type
-        else:
-            _default_content_type = (
-                self.api_client.select_header_content_type(
-                    [
-                        'application/json'
-                    ]
-                )
-            )
-            if _default_content_type is not None:
-                _header_params['Content-Type'] = _default_content_type
-
-        # authentication setting
-        _auth_settings: List[str] = [
-            'bearerAuth'
-        ]
-
-        return self.api_client.param_serialize(
-            method='POST',
-            resource_path='/v1/authz/check',
-            path_params=_path_params,
-            query_params=_query_params,
-            header_params=_header_params,
-            body=_body_params,
-            post_params=_form_params,
-            files=_files,
-            auth_settings=_auth_settings,
-            collection_formats=_collection_formats,
-            _host=_host,
-            _request_auth=_request_auth
-        )
-
-

pkg/hanzoai/cloud/api/entitlements_api.py

@@ -0,0 +1,283 @@
+# coding: utf-8
+
+"""
+    Hanzo Cloud — Unified API (V8 · Open Edition)
+
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+
+    The version of the OpenAPI document: 8.0.0
+    Contact: support@hanzo.ai
+    Generated by OpenAPI Generator (https://openapi-generator.tech)
+
+    Do not edit the class manually.
+"""  # noqa: E501
+
+import warnings
+from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
+from typing import Any, Dict, List, Optional, Tuple, Union
+from typing_extensions import Annotated
+
+from hanzoai.cloud.models.cloud_projection_view import CloudProjectionView
+
+from hanzoai.cloud.api_client import ApiClient, RequestSerialized
+from hanzoai.cloud.api_response import ApiResponse
+from hanzoai.cloud.rest import RESTResponseType
+
+
+class EntitlementsApi:
+    """NOTE: This class is auto generated by OpenAPI Generator
+    Ref: https://openapi-generator.tech
+
+    Do not edit the class manually.
+    """
+
+    def __init__(self, api_client=None) -> None:
+        if api_client is None:
+            api_client = ApiClient.get_default()
+        self.api_client = api_client
+
+
+    @validate_call
+    def cloud_get_v1_entitlements(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> CloudProjectionView:
+        """Projection reports which console apps the CALLER's org may open, and the plan slug that decides it.
+
+        Projection reports which console apps the CALLER's org may open, and the plan slug that decides it. It is the READ side of the unified paywall: the org's plan tier resolved from commerce, which is a different authority from the enablement store behind GET /v1/orgs/{org}/entitlements (that one is the org's own on/off intent).  It fails SAFE-TO-LOCKED, never 500: an unvalidated principal is a 403, but a commerce outage reports every app locked at 200 rather than breaking the shell. The ENFORCEMENT path still fails open, so functionality survives the same outage even while the UI conservatively shows locked.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_entitlements_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudProjectionView",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        ).data
+
+
+    @validate_call
+    def cloud_get_v1_entitlements_with_http_info(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> ApiResponse[CloudProjectionView]:
+        """Projection reports which console apps the CALLER's org may open, and the plan slug that decides it.
+
+        Projection reports which console apps the CALLER's org may open, and the plan slug that decides it. It is the READ side of the unified paywall: the org's plan tier resolved from commerce, which is a different authority from the enablement store behind GET /v1/orgs/{org}/entitlements (that one is the org's own on/off intent).  It fails SAFE-TO-LOCKED, never 500: an unvalidated principal is a 403, but a commerce outage reports every app locked at 200 rather than breaking the shell. The ENFORCEMENT path still fails open, so functionality survives the same outage even while the UI conservatively shows locked.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_entitlements_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudProjectionView",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        response_data.read()
+        return self.api_client.response_deserialize(
+            response_data=response_data,
+            response_types_map=_response_types_map,
+        )
+
+
+    @validate_call
+    def cloud_get_v1_entitlements_without_preload_content(
+        self,
+        _request_timeout: Union[
+            None,
+            Annotated[StrictFloat, Field(gt=0)],
+            Tuple[
+                Annotated[StrictFloat, Field(gt=0)],
+                Annotated[StrictFloat, Field(gt=0)]
+            ]
+        ] = None,
+        _request_auth: Optional[Dict[StrictStr, Any]] = None,
+        _content_type: Optional[StrictStr] = None,
+        _headers: Optional[Dict[StrictStr, Any]] = None,
+        _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
+    ) -> RESTResponseType:
+        """Projection reports which console apps the CALLER's org may open, and the plan slug that decides it.
+
+        Projection reports which console apps the CALLER's org may open, and the plan slug that decides it. It is the READ side of the unified paywall: the org's plan tier resolved from commerce, which is a different authority from the enablement store behind GET /v1/orgs/{org}/entitlements (that one is the org's own on/off intent).  It fails SAFE-TO-LOCKED, never 500: an unvalidated principal is a 403, but a commerce outage reports every app locked at 200 rather than breaking the shell. The ENFORCEMENT path still fails open, so functionality survives the same outage even while the UI conservatively shows locked.
+
+        :param _request_timeout: timeout setting for this request. If one
+                                 number provided, it will be total request
+                                 timeout. It can also be a pair (tuple) of
+                                 (connection, read) timeouts.
+        :type _request_timeout: int, tuple(int, int), optional
+        :param _request_auth: set to override the auth_settings for an a single
+                              request; this effectively ignores the
+                              authentication in the spec for a single request.
+        :type _request_auth: dict, optional
+        :param _content_type: force content-type for the request.
+        :type _content_type: str, Optional
+        :param _headers: set to override the headers for a single
+                         request; this effectively ignores the headers
+                         in the spec for a single request.
+        :type _headers: dict, optional
+        :param _host_index: set to override the host_index for a single
+                            request; this effectively ignores the host_index
+                            in the spec for a single request.
+        :type _host_index: int, optional
+        :return: Returns the result object.
+        """ # noqa: E501
+
+        _param = self._cloud_get_v1_entitlements_serialize(
+            _request_auth=_request_auth,
+            _content_type=_content_type,
+            _headers=_headers,
+            _host_index=_host_index
+        )
+
+        _response_types_map: Dict[str, Optional[str]] = {
+            '200': "CloudProjectionView",
+        }
+        response_data = self.api_client.call_api(
+            *_param,
+            _request_timeout=_request_timeout
+        )
+        return response_data.response
+
+
+    def _cloud_get_v1_entitlements_serialize(
+        self,
+        _request_auth,
+        _content_type,
+        _headers,
+        _host_index,
+    ) -> RequestSerialized:
+
+        _host = None
+
+        _collection_formats: Dict[str, str] = {
+        }
+
+        _path_params: Dict[str, str] = {}
+        _query_params: List[Tuple[str, str]] = []
+        _header_params: Dict[str, Optional[str]] = _headers or {}
+        _form_params: List[Tuple[str, str]] = []
+        _files: Dict[
+            str, Union[str, bytes, List[str], List[bytes], List[Tuple[str, bytes]]]
+        ] = {}
+        _body_params: Optional[bytes] = None
+
+        # process the path parameters
+        # process the query parameters
+        # process the header parameters
+        # process the form parameters
+        # process the body parameter
+
+
+        # set the HTTP header `Accept`
+        if 'Accept' not in _header_params:
+            _header_params['Accept'] = self.api_client.select_header_accept(
+                [
+                    'application/json'
+                ]
+            )
+
+
+        # authentication setting
+        _auth_settings: List[str] = [
+            'bearerAuth'
+        ]
+
+        return self.api_client.param_serialize(
+            method='GET',
+            resource_path='/v1/entitlements',
+            path_params=_path_params,
+            query_params=_query_params,
+            header_params=_header_params,
+            body=_body_params,
+            post_params=_form_params,
+            files=_files,
+            auth_settings=_auth_settings,
+            collection_formats=_collection_formats,
+            _host=_host,
+            _request_auth=_request_auth
+        )
+
+

pkg/hanzoai/cloud/api/environments_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,14 +17,13 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from hanzoai.cloud.models.crm_summary import CrmSummary
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class SummaryApi:
+class EnvironmentsApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -38,7 +37,7 @@ class SummaryApi:
 
 
     @validate_call
-    def crm_crm_summary(
+    def cloud_get_v1_environments(
         self,
         _request_timeout: Union[
             None,
@@ -52,8 +51,8 @@ class SummaryApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> CrmSummary:
-        """Per-org row counts (companies / contacts / opportunities)
+    ) -> None:
+        """cloud_get_v1_environments
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -78,7 +77,7 @@ class SummaryApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._crm_crm_summary_serialize(
+        _param = self._cloud_get_v1_environments_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -86,8 +85,6 @@ class SummaryApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CrmSummary",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -101,7 +98,7 @@ class SummaryApi:
 
 
     @validate_call
-    def crm_crm_summary_with_http_info(
+    def cloud_get_v1_environments_with_http_info(
         self,
         _request_timeout: Union[
             None,
@@ -115,8 +112,8 @@ class SummaryApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[CrmSummary]:
-        """Per-org row counts (companies / contacts / opportunities)
+    ) -> ApiResponse[None]:
+        """cloud_get_v1_environments
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -141,7 +138,7 @@ class SummaryApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._crm_crm_summary_serialize(
+        _param = self._cloud_get_v1_environments_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -149,8 +146,6 @@ class SummaryApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CrmSummary",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -164,7 +159,7 @@ class SummaryApi:
 
 
     @validate_call
-    def crm_crm_summary_without_preload_content(
+    def cloud_get_v1_environments_without_preload_content(
         self,
         _request_timeout: Union[
             None,
@@ -179,7 +174,7 @@ class SummaryApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Per-org row counts (companies / contacts / opportunities)
+        """cloud_get_v1_environments
 
 
         :param _request_timeout: timeout setting for this request. If one
@@ -204,7 +199,7 @@ class SummaryApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._crm_crm_summary_serialize(
+        _param = self._cloud_get_v1_environments_serialize(
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -212,8 +207,6 @@ class SummaryApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "CrmSummary",
-            '401': "AdminAdminCreatePromo400Response",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -222,7 +215,7 @@ class SummaryApi:
         return response_data.response
 
 
-    def _crm_crm_summary_serialize(
+    def _cloud_get_v1_environments_serialize(
         self,
         _request_auth,
         _content_type,
@@ -251,13 +244,6 @@ class SummaryApi:
         # process the body parameter
 
 
-        # set the HTTP header `Accept`
-        if 'Accept' not in _header_params:
-            _header_params['Accept'] = self.api_client.select_header_accept(
-                [
-                    'application/json'
-                ]
-            )
 
 
         # authentication setting
@@ -267,7 +253,7 @@ class SummaryApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/crm/summary',
+            resource_path='/v1/environments',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,

pkg/hanzoai/cloud/api/errors_api.py

@@ -3,7 +3,7 @@
 """
     Hanzo Cloud — Unified API (V8 · Open Edition)
 
-    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
+    The single unified OpenAPI surface for ALL Hanzo services, aggregated from the per-service specs. Every route is https://api.hanzo.ai/v1/<service>/*. Grouped by the canonical domains in capabilities.yaml (the ONE registry). cloud/openapi.yaml is hanzoai/cloud's own woven document, copied verbatim by sync.py, and it wins wherever it and a hand-written spec describe the same route. Regenerated by merge.py — edit the per-service <svc>/openapi.yaml + capabilities.yaml, not this file.
 
     The version of the OpenAPI document: 8.0.0
     Contact: support@hanzo.ai
@@ -17,16 +17,17 @@ from pydantic import validate_call, Field, StrictFloat, StrictStr, StrictInt
 from typing import Any, Dict, List, Optional, Tuple, Union
 from typing_extensions import Annotated
 
-from pydantic import Field, field_validator
+from pydantic import Field, StrictInt
+from typing import Optional
 from typing_extensions import Annotated
-from hanzoai.cloud.models.observe_status_response import ObserveStatusResponse
+from hanzoai.cloud.models.cloud_error_list import CloudErrorList
 
 from hanzoai.cloud.api_client import ApiClient, RequestSerialized
 from hanzoai.cloud.api_response import ApiResponse
 from hanzoai.cloud.rest import RESTResponseType
 
 
-class StatusApi:
+class ErrorsApi:
     """NOTE: This class is auto generated by OpenAPI Generator
     Ref: https://openapi-generator.tech
 
@@ -40,9 +41,9 @@ class StatusApi:
 
 
     @validate_call
-    def observe_get_status(
+    def cloud_get_v1_errors(
         self,
-        product: Annotated[str, Field(strict=True, description="Console product slug. Must match `^[a-z0-9][a-z0-9._-]{0,62}$`.")],
+        limit: Annotated[Optional[StrictInt], Field(description="Limit is how many rows to return, newest first. Default 50, maximum 200; a value at or below zero, or one that is not a number, takes the default.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -55,13 +56,13 @@ class StatusApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ObserveStatusResponse:
-        """Live health status for a product
+    ) -> CloudErrorList:
+        """Errors returns the caller org's most recently captured errors, newest first.
 
-        Returns a live health signal for a product: an in-cluster health probe (measured latency, `/health` then `/healthz`) corroborated by the VictoriaMetrics `up{service}` scrape gauge. `up` is set by the probe when it succeeds, else by the scrape gauge, else false. Status is infra-level (no per-org data) but still requires a validated principal. 
+        Errors returns the caller org's most recently captured errors, newest first. The error-tracking read view over the same table the capture doors write: only rows stored as type 'error', each with its captured exception lifted out of the property bag as a first-class field.  The org is the validated principal's — never a parameter — and this read requires a real bearer, NEVER the write-only publishable key: pk- can attribute a write and can read nothing. 403 without a validated bearer, 503 when the warehouse is unreachable.
 
-        :param product: Console product slug. Must match `^[a-z0-9][a-z0-9._-]{0,62}$`. (required)
-        :type product: str
+        :param limit: Limit is how many rows to return, newest first. Default 50, maximum 200; a value at or below zero, or one that is not a number, takes the default.
+        :type limit: int
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -84,8 +85,8 @@ class StatusApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._observe_get_status_serialize(
-            product=product,
+        _param = self._cloud_get_v1_errors_serialize(
+            limit=limit,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -93,10 +94,7 @@ class StatusApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "ObserveStatusResponse",
-            '400': "ObserveError",
-            '401': "ObserveError",
-            '403': "ObserveError",
+            '200': "CloudErrorList",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -110,9 +108,9 @@ class StatusApi:
 
 
     @validate_call
-    def observe_get_status_with_http_info(
+    def cloud_get_v1_errors_with_http_info(
         self,
-        product: Annotated[str, Field(strict=True, description="Console product slug. Must match `^[a-z0-9][a-z0-9._-]{0,62}$`.")],
+        limit: Annotated[Optional[StrictInt], Field(description="Limit is how many rows to return, newest first. Default 50, maximum 200; a value at or below zero, or one that is not a number, takes the default.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -125,13 +123,13 @@ class StatusApi:
         _content_type: Optional[StrictStr] = None,
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
-    ) -> ApiResponse[ObserveStatusResponse]:
-        """Live health status for a product
+    ) -> ApiResponse[CloudErrorList]:
+        """Errors returns the caller org's most recently captured errors, newest first.
 
-        Returns a live health signal for a product: an in-cluster health probe (measured latency, `/health` then `/healthz`) corroborated by the VictoriaMetrics `up{service}` scrape gauge. `up` is set by the probe when it succeeds, else by the scrape gauge, else false. Status is infra-level (no per-org data) but still requires a validated principal. 
+        Errors returns the caller org's most recently captured errors, newest first. The error-tracking read view over the same table the capture doors write: only rows stored as type 'error', each with its captured exception lifted out of the property bag as a first-class field.  The org is the validated principal's — never a parameter — and this read requires a real bearer, NEVER the write-only publishable key: pk- can attribute a write and can read nothing. 403 without a validated bearer, 503 when the warehouse is unreachable.
 
-        :param product: Console product slug. Must match `^[a-z0-9][a-z0-9._-]{0,62}$`. (required)
-        :type product: str
+        :param limit: Limit is how many rows to return, newest first. Default 50, maximum 200; a value at or below zero, or one that is not a number, takes the default.
+        :type limit: int
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -154,8 +152,8 @@ class StatusApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._observe_get_status_serialize(
-            product=product,
+        _param = self._cloud_get_v1_errors_serialize(
+            limit=limit,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -163,10 +161,7 @@ class StatusApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "ObserveStatusResponse",
-            '400': "ObserveError",
-            '401': "ObserveError",
-            '403': "ObserveError",
+            '200': "CloudErrorList",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -180,9 +175,9 @@ class StatusApi:
 
 
     @validate_call
-    def observe_get_status_without_preload_content(
+    def cloud_get_v1_errors_without_preload_content(
         self,
-        product: Annotated[str, Field(strict=True, description="Console product slug. Must match `^[a-z0-9][a-z0-9._-]{0,62}$`.")],
+        limit: Annotated[Optional[StrictInt], Field(description="Limit is how many rows to return, newest first. Default 50, maximum 200; a value at or below zero, or one that is not a number, takes the default.")] = None,
         _request_timeout: Union[
             None,
             Annotated[StrictFloat, Field(gt=0)],
@@ -196,12 +191,12 @@ class StatusApi:
         _headers: Optional[Dict[StrictStr, Any]] = None,
         _host_index: Annotated[StrictInt, Field(ge=0, le=0)] = 0,
     ) -> RESTResponseType:
-        """Live health status for a product
+        """Errors returns the caller org's most recently captured errors, newest first.
 
-        Returns a live health signal for a product: an in-cluster health probe (measured latency, `/health` then `/healthz`) corroborated by the VictoriaMetrics `up{service}` scrape gauge. `up` is set by the probe when it succeeds, else by the scrape gauge, else false. Status is infra-level (no per-org data) but still requires a validated principal. 
+        Errors returns the caller org's most recently captured errors, newest first. The error-tracking read view over the same table the capture doors write: only rows stored as type 'error', each with its captured exception lifted out of the property bag as a first-class field.  The org is the validated principal's — never a parameter — and this read requires a real bearer, NEVER the write-only publishable key: pk- can attribute a write and can read nothing. 403 without a validated bearer, 503 when the warehouse is unreachable.
 
-        :param product: Console product slug. Must match `^[a-z0-9][a-z0-9._-]{0,62}$`. (required)
-        :type product: str
+        :param limit: Limit is how many rows to return, newest first. Default 50, maximum 200; a value at or below zero, or one that is not a number, takes the default.
+        :type limit: int
         :param _request_timeout: timeout setting for this request. If one
                                  number provided, it will be total request
                                  timeout. It can also be a pair (tuple) of
@@ -224,8 +219,8 @@ class StatusApi:
         :return: Returns the result object.
         """ # noqa: E501
 
-        _param = self._observe_get_status_serialize(
-            product=product,
+        _param = self._cloud_get_v1_errors_serialize(
+            limit=limit,
             _request_auth=_request_auth,
             _content_type=_content_type,
             _headers=_headers,
@@ -233,10 +228,7 @@ class StatusApi:
         )
 
         _response_types_map: Dict[str, Optional[str]] = {
-            '200': "ObserveStatusResponse",
-            '400': "ObserveError",
-            '401': "ObserveError",
-            '403': "ObserveError",
+            '200': "CloudErrorList",
         }
         response_data = self.api_client.call_api(
             *_param,
@@ -245,9 +237,9 @@ class StatusApi:
         return response_data.response
 
 
-    def _observe_get_status_serialize(
+    def _cloud_get_v1_errors_serialize(
         self,
-        product,
+        limit,
         _request_auth,
         _content_type,
         _headers,
@@ -270,9 +262,9 @@ class StatusApi:
 
         # process the path parameters
         # process the query parameters
-        if product is not None:
+        if limit is not None:
             
-            _query_params.append(('product', product))
+            _query_params.append(('limit', limit))
             
         # process the header parameters
         # process the form parameters
@@ -295,7 +287,7 @@ class StatusApi:
 
         return self.api_client.param_serialize(
             method='GET',
-            resource_path='/v1/o11y/status',
+            resource_path='/v1/errors',
             path_params=_path_params,
             query_params=_query_params,
             header_params=_header_params,