# Stash PDF metadata client

This slice generates a read-only Stash client for the response contract in
`vernonkeenan/stash` draft PR #16 at provider commit
`b2f5b4a6ae5ff507dfdc86bb7b9ee5a9bb924131`.

The generated surface contains only:

- `GET /v1/pdfs`, with bounded `limit` and `offset`;
- `GET /v1/pdfs/{pdfId}`; and
- response metadata fields `ID`, `Filename`, `Title`, and `URI`.

The provider spec retains a deprecated `POST /v1/pdfs` compatibility route
that always fails closed. Lib deliberately does not generate that operation.
It also narrows the provider's legacy `Document` definition to the four fields
the PR #16 handlers populate, so document bytes, render inputs, tenant IDs, and
legacy ownership fields cannot enter the consumer contract.

Both reads require one caller-supplied `runtime.ClientAuthInfoWriter` that
writes the native service credential to `X-API-Key` and forwards only the
`kvSession` cookie. The generated operations retain that single compound
writer. Callers must not forward the browser's complete cookie header.

`swagger/client/stash-pdf-metadata.yaml` is the reproducible consumer
projection. `scripts/release.sh regen` uses it only for Stash while continuing
to copy the complete provider spec into the normal internal and external
documentation locations.

## Dependency and release gate

This Lib PR may be reviewed while Stash PR #16 is open, but it must not be
released for production consumption before the provider PR is merged and its
deployment gates are satisfied. In particular, Stash deployment remains
blocked on:

1. the governed PDF tenancy migration from `go/db` commit
   `5e3c03d5d52c8328708897032fcc213f548bc667`;
2. the exact `stash:pdf:read` scope grant;
3. canonical Keenan Vision tenant configuration; and
4. the provider's production no-write smoke test.

This client slice applies no database change, grants no scope, changes no
credential, creates no release, and performs no deployment.