chore(api): sync spec for the spend-policy surface

[senamakel]

Overview

Syncs the generated spec for the backend's spend-policy surface (tinyhumansai/backend#1287).

Changes

Regenerated from the backend branch's own spec via --input, per AGENTS.md. Verified against origin/main — both lists gain entries and neither loses one:

	main	this branch
PUBLIC_ROUTES	215	218
UNEXPOSED_ROUTES	49	50

• Public: GET /spend-policy, PUT /spend-policy, PUT /api-keys/{keyId}/spend-policy
• Denylisted: PATCH /admin/users/{userId}/spend-policy — admin-only, so it adds no public operation and is blocked at the raw transport

Pinned counts updated to match: UNEXPOSED_ROUTES.len() 49 → 50, operationCount 215 → 218, excludedAdminOperationCount 37 → 38.

Testing

• cargo test — 25 suites, 0 failures
• cargo clippy --all-targets -- -D warnings clean
• cargo fmt --check clean
• Diffed both route lists against origin/main programmatically to confirm nothing was dropped

Notes

Depends on tinyhumansai/backend#1287.

Related Issues

Summary by CodeRabbit

• New Features

  • Added spend-policy API endpoints for retrieving and updating spend policies.
  • Added spend-policy routes for API keys, users, and administrative updates.

• API Updates

  • Expanded the public API surface with three additional operations.
  • Updated API route and exclusion totals to reflect the new endpoints.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 41a63fd7-b739-49b2-ad59-c5df1c94bd66

📥 Commits

Reviewing files that changed from the base of the PR and between 83ab7b1 and 5824af2.

📒 Files selected for processing (4)

• api/tinyhumans.backend.json
• src/generated_public_routes.rs
• src/lib.rs
• tests/openapi_sync.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The API manifest adds spend-policy operations. Generated Rust route tables include the matching public and excluded admin routes. Synchronization tests update operation and route-count expectations.

Changes

Spend policy routes

Layer / File(s)	Summary
Manifest spend-policy contract api/tinyhumans.backend.json	The manifest adds PUT /api-keys/{keyId}/spend-policy, adds bearer-authenticated GET and PUT /spend-policy routes, and updates operation totals.
Generated route registration src/generated_public_routes.rs	Generated route tables include the public API-key and user spend-policy routes and the excluded admin update route.
Route synchronization validation src/lib.rs, tests/openapi_sync.rs	Route exclusion and manifest synchronization tests update their expected route and operation counts.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 5824a

The SDK now exposes three spend-policy operations, including two policy mutations, while the administrative route remains blocked from the public surface. The change is mergeable with explicit owner awareness that backend authorization and resource scoping for these operations should be confirmed.

Poem

I’m a rabbit with routes in my hat,
Spend policies hop where they’re at.
The manifest now knows,
The route table grows,
And tests count each endpoint neat.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes synchronizing the API specification for the spend-policy surface, which is the main change.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 126 embedded · openrouter/openai/text-embedding-3-small

[tinysweeper]

How this change flows

0 changed behaviours across 7 relationships. 6 surrounding behaviours are shown (60 graph nodes walked). 29 further behaviours left out to keep the diagram readable.

flowchart LR
  n0["AgentIntegrationsApi"]:::impacted
  n1["Error"]:::impacted
  n2["send"]:::impacted
  n3["HttpClient"]:::impacted
  n4["post_multipart"]:::impacted
  n5["reject_unexposed_route"]:::impacted
  n0 -->|uses| n3
  n2 -->|uses| n1
  n2 -->|calls| n5
  n4 -->|uses| n1
  n4 -->|calls| n2
  n4 -->|calls| n5
  n5 -->|uses| n1
  classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
  classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
  classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
  classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff

Loading

_{Green: changed behaviour. Grey: surrounding behaviour. Arrows name the call, use, implementation, or test relationship. Orange: has findings. Red: has a finding that blocks the merge.}