@app-vitals/agent-lib 0.0.1 → 0.1.1

package/admin-types.ts

@@ -0,0 +1,4097 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/agents/reconcile": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reconcile all agents' K8s state
+         * @description Admin-only. Reconciles Kubernetes Deployment state against all managed (non-self-hosted) agents in the DB, returning the recreated/updated deployments plus any orphaned deployments or per-agent failures. In perAgent Anthropic identity mode it also creates the missing identity of each existing agent that has an owner and moves its Deployment off the shared ServiceAccount (`migrated`); agents with no owner are listed in `noOwner` and left alone. Pass `dryRun=true` to only report: nothing is created, saved or patched.
+         */
+        post: {
+            parameters: {
+                query?: {
+                    /** @description Defaults to false (reconcile for real). Pass true to report what would be recreated, updated and moved to per-agent identity without changing anything. */
+                    dryRun?: "true" | "false";
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Reconciliation summary */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ReconcileAgentsResult"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/federation/strip-credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Strip Anthropic credentials from agents' saved env bundles
+         * @description Admin-only, one-off migration (WIF-2.2) for moving a deployment to Anthropic workload identity federation. Deletes CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN from every non-self-hosted agent's stored env bundle. `dryRun` defaults to true: nothing is deleted and the response lists what would be. Only agents holding at least one of the keys are listed, so a second applied call returns an empty list. Values are never returned or logged.
+         */
+        post: {
+            parameters: {
+                query?: {
+                    /** @description Defaults to true (report only). Pass false to delete the keys. */
+                    dryRun?: "true" | "false";
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Agents (and key names) removed, or that would be removed */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["StripCredentialsResult"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/provision": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Provision an agent's K8s workload
+         * @description Admin-only. Provisions or re-provisions the Kubernetes workload for a single managed agent — idempotent, safe to call on an already-provisioned agent. For self-hosted agents, returns `{ skipped: true, reason: "self-hosted" }` with no K8s changes.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Agent provisioned (or already-provisioned — idempotent), or skipped for self-hosted agents */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ProvisionAgentResult"] | components["schemas"]["ProvisionSkippedResult"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an agent
+         * @description Admin-only. Returns the full agent record including `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `typeName`, `accountId` (null for unassigned agents), and `missingRequiredEnv` — required env keys declared by the agent's type manifest with no corresponding AgentEnv row yet (informational only).
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Full agent record */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GetAgentResult"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        /**
+         * Delete an agent
+         * @description Admin-only. Runs the full deleteAgentFully() teardown: deprovisions the K8s workload, removes the agent's per-agent Anthropic identity when it has one (federation rule, then Anthropic service account, then Kubernetes ServiceAccount), revokes task-store and chat-service tokens, deletes chat threads, and — if an `xoxpToken` is supplied — deletes the Slack app. The Agent row (and its cascade-deleted child records) is deleted last, only if every automatable step succeeded; `agentDeleted: false` means the row was preserved and the call is safe to retry.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["DeleteAgentBody"];
+                };
+            };
+            responses: {
+                /** @description Delete outcome — agentDeleted is false when a cleanup step failed; the Agent row is preserved for retry */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["DeleteAgentResult"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        /**
+         * Update an agent
+         * @description Admin-only. Updates `selfHosted`, `repos`, `reviewAuthorAllowlist`, `patchAuthorAllowlist`, `restrictSlackToMembers`, `slackId`, `trialExpiresAt`, and/or `accountId` (platform admin only — 403 for session members; `null` clears it; reconciles the workload of in-cluster agents; does not move historical task-store rows). `typeName` and `trialExpiryWarnedAt` are not updatable via this route. `repos` here REPLACES the whole list; for incremental changes use `POST /agents/{id}/repos` (add) and `DELETE /agents/{id}/repos/{owner}/{name}` (remove). Returns the updated agent, including a `warning` field when `restrictSlackToMembers` is set true on an agent with zero members.
+         */
+        patch: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PatchAgentBody"];
+                };
+            };
+            responses: {
+                /** @description Agent updated */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GetAgentResult"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        trace?: never;
+    };
+    "/agents/{id}/repos": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add repos to an agent
+         * @description Admin, the agent's own key, or platform.ops. Additive alternative to `PATCH /agents/{id}` (which replaces the whole `repos` array): unions the given `org/repo` entries into the agent's current list, preserving the order of existing entries and appending new ones. Idempotent — adding a repo the agent already has is a no-op. 400 when the resulting list has two repos sharing a basename. Returns the full updated agent.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["AddAgentReposBody"];
+                };
+            };
+            responses: {
+                /** @description Repos added (or already present) */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GetAgentResult"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/repos/{owner}/{name}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a repo from an agent
+         * @description Admin, the agent's own key, or platform.ops. Removes one `owner/name` repo from the agent's `repos`, preserving the order of the rest. 404 when the agent does not have that repo. Returns the full updated agent.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    owner: string;
+                    name: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Repo removed */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GetAgentResult"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent or repo not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List all agents
+         * @description Admin-only. Returns every agent's `id`, `name`, `selfHosted`, and `typeName` — used for metrics name resolution.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description List of agents */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentSummary"][];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Create an agent
+         * @description Admin-only. Validates name/typeName, creates the Agent row, seeds AgentTool/AgentPlugin rows from the resolved type manifest, attaches repos/allowlists/members, patches Claude credentials, and provisions Kubernetes when `runtime` is "in-cluster" — the same createAgent() implementation (APA-1.1) the web UI form at /admin/agents/new uses. Transactional: on any failure zero rows persist, and this route never returns a partial-success 200. Returns the created agent in the same shape as GET /agents/:id.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateAgentBody"];
+                };
+            };
+            responses: {
+                /** @description Agent created */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GetAgentResult"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/envs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get env vars
+         * @description Returns the agent's env vars. Non-secret values are decrypted; values flagged secret are masked as `***` and their keys listed in `secretKeys`.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Decrypted env vars */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentEnvResponse"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Replace all env vars
+         * @description Bulk-replaces all env vars for the agent atomically. Values are stored encrypted (AES-256-GCM).
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["AgentEnvBody"];
+                };
+            };
+            responses: {
+                /** @description Env vars replaced */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Ok"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update specific env vars
+         * @description Updates only the specified keys, leaving other existing env vars untouched.
+         */
+        patch: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["AgentEnvPatchBody"];
+                };
+            };
+            responses: {
+                /** @description Env vars updated */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Ok"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        trace?: never;
+    };
+    "/agents/{id}/envs/{key}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete an env var
+         * @description Deletes a single env var by key.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    key: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Key deleted */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/crons": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List agent cron jobs
+         * @description Returns the agent's cron jobs as a plain array (not wrapped), used by the agent harness's scheduler. Returns 404 if the agent doesn't exist.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Array of cron jobs */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentCronJob"][];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["RuntimeError"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["RuntimeError"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Create a cron job
+         * @description Creates a cron job for the agent. `channel` and `user` are mutually exclusive delivery targets. Returns the created job including system-managed read-only fields (`id`, `system`, `parentCronId`, `createdAt`, `updatedAt`) — `parentCronId` is never settable by the caller.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateAgentCronJobBody"];
+                };
+            };
+            responses: {
+                /** @description Cron job created */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/crons/reconcile": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Reconcile system crons
+         * @description Reconciles the agent's system crons against the cron list declared by its Specialty manifest. Runs in three passes within a single transaction: create-or-update matched-by-name system crons (preserving IDs so run history survives), link/unlink parent-child cron relationships, and delete orphaned system crons no longer in the manifest. Called automatically on agent startup; returns created/updated/deleted counts.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Reconciliation summary */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ReconcileCronResult"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/crons/{cronId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete a cron job
+         * @description Deletes a cron job. System crons (`system: true`) cannot be deleted and return 403.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    cronId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Cron job deleted */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        /**
+         * Update a cron job
+         * @description Updates a cron job. `schedule` and `prompt` must be provided together for a content update; `enabled` and `preCheck` are orthogonal and may be sent alone or combined with any other field. At least one field must be present — an empty body returns 400. System crons (`system: true`) reject `schedule`, `prompt`, and/or `preCheck` changes with 403; an enabled-only body is allowed and toggles the cron via the same path used for non-system crons.
+         */
+        patch: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    cronId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PatchAgentCronJobBody"];
+                };
+            };
+            responses: {
+                /** @description Cron job updated */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        trace?: never;
+    };
+    "/agents/{id}/crons/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List cron jobs with run summary
+         * @description Returns each cron job's last-run timestamp, outcome, and today's run count alongside its config — without full prompt text. Useful for dashboards.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description List of cron jobs with run summary */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronsWithSummaryWrapper"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/crons/{cronId}/runs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List cron runs
+         * @description Returns a paginated list of runs for a cron job (`limit` default 20, `offset` default 0). `itemId` and `phaseId` are optional server-side filters that combine with AND when both are supplied.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    limit?: string;
+                    offset?: string;
+                    itemId?: string;
+                    phaseId?: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                    cronId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Paginated list of cron runs */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronRunsList"];
+                    };
+                };
+                /** @description Cron job not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Create a cron run record
+         * @description Records the start of a cron job execution, including optional skip/outcome data and dispatch attribution (`itemType`/`itemId`, write-once at creation).
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    cronId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateAgentCronRunBody"];
+                };
+            };
+            responses: {
+                /** @description Run record created */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronRunWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Cron job not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/crons/{cronId}/runs/{runId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update a cron run record
+         * @description Records completion data after a run finishes — `completedAt`, `outcome`, `error`, `skipped`, `skipReason`, `sessionId`, and `modelBreakdown` (per-model token/cost entries, upserted per `[cronRunId, model]`). At least one field must be provided.
+         */
+        patch: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    cronId: string;
+                    runId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PatchAgentCronRunBody"];
+                };
+            };
+            responses: {
+                /** @description Run record updated */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["PatchCronRunWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Run not found or not owned by agent */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        trace?: never;
+    };
+    "/agents/{id}/tools": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List tool patterns
+         * @description Returns every allowed-tool entry for the agent, each with `id`, `pattern`, and `enabled`.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description List of tool patterns */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ToolsWrapper"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Add a tool pattern
+         * @description Adds an allowed-tool entry — a glob or exact Claude Code tool name (e.g. "Read", "Bash", "mcp__*") the agent can call.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateAgentToolBody"];
+                };
+            };
+            responses: {
+                /** @description Tool added */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ToolWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/tools/{toolId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a tool pattern
+         * @description Deletes a tool entry from the agent's allowed-tools list.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    toolId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Tool removed */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        /**
+         * Enable or disable a tool pattern
+         * @description Updates a tool entry's `pattern` and/or `enabled` state.
+         */
+        patch: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    toolId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PatchAgentToolBody"];
+                };
+            };
+            responses: {
+                /** @description Tool toggled */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ToolWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        trace?: never;
+    };
+    "/agents/{id}/tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List API tokens
+         * @description Returns token metadata (hash excluded) for the agent — raw token values are never returned after creation.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description List of token metadata */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["TokensWrapper"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Create an API token
+         * @description Creates a per-agent bearer token for scoped API access. The raw token value is returned once in this response — only its SHA-256 hash is persisted, so it must be saved immediately.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateAgentTokenBody"];
+                };
+            };
+            responses: {
+                /** @description Token created (raw value returned once) */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CreateAgentTokenResponse"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/tokens/{tokenId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke an API token
+         * @description Soft-deletes the token by setting `revokedAt`.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    tokenId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Token revoked */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/plugins": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List plugins
+         * @description Returns every plugin installed for the agent.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description List of plugins */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["PluginsWrapper"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Install a plugin
+         * @description Adds a Claude Code marketplace plugin for the agent.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateAgentPluginBody"];
+                };
+            };
+            responses: {
+                /** @description Plugin added */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["PluginWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        /**
+         * Remove a plugin
+         * @description Removes the plugin identified by the required `name` query param.
+         */
+        delete: {
+            parameters: {
+                query: {
+                    name: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Plugin removed */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        /**
+         * Update a plugin
+         * @description Re-upserts the plugin identified by the required `name` query param with a new `version` and/or `enabled` state. Uses a query param rather than a path segment because a canonical plugin spec like "my-plugin@org/my-marketplace" can contain a literal "/" that would break path matching.
+         */
+        patch: {
+            parameters: {
+                query: {
+                    name: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PatchAgentPluginBody"];
+                };
+            };
+            responses: {
+                /** @description Plugin version updated */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["PluginWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        trace?: never;
+    };
+    "/agents/{id}/phase-methodology": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List phase-methodology overrides
+         * @description Returns every phase-methodology override configured for the agent — which subagent type handles each pipeline phase (prd, plan-session, review, patch, deploy, dev-task). A phase with no explicit override is simply absent from this list; see GET /agents/:id/config's `phaseMethodology` map for the full six-phase view with defaults filled in.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description List of phase-methodology overrides */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["PhaseMethodologyListWrapper"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/phase-methodology/{phase}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set a phase's subagent-type override
+         * @description Upserts the `subagentType` override for one pipeline phase. Passing `subagentType: null` clears the override (the phase falls back to its default methodology). `phase` must be one of prd, plan-session, review, patch, deploy, dev-task.
+         */
+        put: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    phase: "prd" | "plan-session" | "review" | "patch" | "deploy" | "dev-task";
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PutAgentPhaseMethodologyBody"];
+                };
+            };
+            responses: {
+                /** @description Phase-methodology override upserted */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["PhaseMethodologyWrapper"];
+                    };
+                };
+                /** @description Bad request — invalid phase */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/all/cron-runs/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get aggregated cron-run token stats
+         * @description Admin-only. Returns token usage and cost aggregated across all agents' cron runs, broken down by agent, cron, model, day, and pipeline phase. Optional `from`/`to` ISO datetime query params bound the range.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Aggregated cron-run token stats across all agents */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronRunTokenStats"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden — requires admin scope */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/all/cron-runs/outcomes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get cron-run outcomes per phase and context fingerprint
+         * @description Admin-only. Returns, per (phase, contextFingerprint): run, completed, failed, and skipped counts, a skipReasons histogram, avg and p50 duration, avg turns, avg tool calls, and avg first-turn context tokens. Optional `from`/`to` ISO datetime query params bound the range on startedAt.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Outcome series per (phase, contextFingerprint) */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronRunOutcomes"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden — requires admin scope */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/cron-runs/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get aggregated cron-run token stats for one agent
+         * @description Same shape as GET /agents/all/cron-runs/stats, scoped to the given agent's runs. An agent's own bearer token may read its own stats; other agents' tokens are rejected. Optional `from`/`to` ISO datetime query params bound the range.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Aggregated cron-run token stats for the agent */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronRunTokenStats"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/cron-runs/outcomes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get cron-run outcomes per phase and context fingerprint for one agent
+         * @description Same shape as GET /agents/all/cron-runs/outcomes, scoped to the given agent's runs. An agent's own bearer token may read its own outcomes; other agents' tokens are rejected. Optional `from`/`to` ISO datetime query params bound the range on startedAt.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Outcome series per (phase, contextFingerprint) for the agent */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CronRunOutcomes"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/all/cron-runs/dev-task-adherence": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get dev-task adherence report
+         * @description Admin-only. Per dev-task run, compares skill-usage subagent dispatches against the required-steps table and reports per-step ran/skipped, with per-step adherence rates overall, per variant (contextFingerprint) and per commandVariant (default vs alternate). Rates cover task-bearing runs only (dispatched against a work item); `counts` separates them from silent no-ready-task ticks. A dispatch proves a step started, not that it was done well. Optional `from`/`to` ISO datetime params bound startedAt.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Dev-task adherence report */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            [key: string]: unknown;
+                        };
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden — requires admin scope */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Adherence reporting not configured */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/dev-task-adherence": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get this agent's dev-task adherence report
+         * @description Self-serve variant of the fleet-wide dev-task adherence report, scoped to the agent in the path. Access is gated by the generic agent-route auth (an agent's own bearer token, an admin, or a member session) — no admin scope required. Same report shape and optional `from`/`to` params as GET /agents/all/cron-runs/dev-task-adherence.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Dev-task adherence report for this agent's runs only */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            [key: string]: unknown;
+                        };
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Adherence reporting not configured */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/chat-tokens/daily/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get aggregated chat token daily stats
+         * @description Admin-only. Returns Slack chat token usage aggregated across all agents, broken down by agent, model, and day. Optional `from`/`to` YYYY-MM-DD query params bound the range.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Aggregated chat token daily stats across all agents */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ChatTokenStats"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden — requires admin scope */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/chat-tokens/daily/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get this agent's chat token daily stats
+         * @description Self-serve variant of the fleet-wide chat token daily stats, scoped to the agent in the path. Access is gated by the generic agent-route auth (an agent's own bearer token, an admin, or a member session) — no admin scope required. Same response shape and optional `from`/`to` params as GET /agents/chat-tokens/daily/stats.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    from?: string;
+                    to?: string;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Chat token daily stats for this agent only */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ChatTokenStats"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/chat-tokens/daily": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Record daily chat token usage
+         * @description Atomically accumulates Slack chat token usage into the existing rows for each `(agentId, date, model)` tuple, creating them if absent. Supply a `modelBreakdown` array to split a single day's usage across multiple models. Returns the updated daily rows, one per model.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["UpsertChatTokenDailyBody"];
+                };
+            };
+            responses: {
+                /** @description Updated daily chat token usage rows (one per model) */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentChatTokenUsageDailyByModel"][];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/work-queue": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the latest work-queue snapshot
+         * @description Returns the most recently pushed work-queue snapshot, or 404 if the agent has never pushed one.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Latest work-queue snapshot */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["WorkQueueSnapshotWrapper"];
+                    };
+                };
+                /** @description No snapshot pushed yet */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Push a work-queue snapshot
+         * @description Upserts the agent's single ranked work-queue snapshot (tasks/PRs across pipeline phases), overwriting any prior snapshot — there is no history.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PushWorkQueueSnapshotBody"];
+                };
+            };
+            responses: {
+                /** @description Snapshot upserted (overwrites any prior snapshot for this agent) */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["WorkQueueSnapshotWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/github-installations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the latest GitHub installations snapshot
+         * @description Returns the most recently reported GitHub installations snapshot, or 404 if the agent has never reported one.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Latest GitHub installations snapshot */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GitHubInstallationsSnapshotWrapper"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden — token does not own this agent */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description No snapshot reported yet */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        /**
+         * Replace the agent's GitHub installations snapshot
+         * @description Upserts the agent's single GitHub App installations snapshot (owner, installation id, state, sanitized lastError), replacing the prior list wholesale — an installation absent from the body is dropped. The body schema is closed: unknown fields (e.g. tokens) are rejected with 400.
+         */
+        put: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["PutGitHubInstallationsBody"];
+                };
+            };
+            responses: {
+                /** @description Snapshot replaced */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["GitHubInstallationsSnapshotWrapper"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden — token does not own this agent */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/config": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get agent config bundle
+         * @description Returns the agent's full runtime config bundle — decrypted env vars, allowed-tools patterns, installed plugins (with derived marketplace), scoped repos, review/patch author allowlists, and Slack membership-restriction settings. Polled by the agent harness on startup and during its config sync loop. Returns 404 if the agent doesn't exist.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Agent config bundle */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentConfigResponse"];
+                    };
+                };
+                /** @description Unauthorized */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["RuntimeError"];
+                    };
+                };
+                /** @description Agent not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["RuntimeError"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/chat-credentials": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List chat credentials
+         * @description Lists the chat-service tokens scoped to the agent (id and label only — raw values are never returned). `*` or `platform.ops` callers only.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Chat credential metadata */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ChatCredentialsWrapper"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Not found, or chat-credential minting disabled */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Chat service not configured */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Mint a chat credential
+         * @description Mints a chat-service token scoped to the agent in the path. `*` or `platform.ops` callers only — never the agent's own key. The body is closed: an `agentId` field is rejected with 400, so an unrestricted chat admin token cannot be minted here. The raw token is returned once and is never logged or stored by admin. 404 unless SHIPWRIGHT_CHAT_TOKEN_MINT_ENABLED is `enabled`.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["CreateChatCredentialBody"];
+                };
+            };
+            responses: {
+                /** @description Credential minted (raw token returned once) */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["CreateChatCredentialResponse"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Not found, or chat-credential minting disabled */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Chat service not configured */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/chat-credentials/{tokenId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a chat credential
+         * @description Revokes a chat-service token. 404 when the token is not scoped to the agent in the path. `*` or `platform.ops` callers only.
+         */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                    tokenId: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Credential revoked */
+                204: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Not found, or chat-credential minting disabled */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Chat service not configured */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/ask": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Ask another agent a question
+         * @description Posts `question` from agent `from` into a new `kind: ask` chat thread of agent `{id}` (always created with `askDepth: 1`), then, when `waitMs > 0`, polls once per second until the agent replies or the budget ends. Callers: `*`, `platform.ops`, or the agent key whose id equals `from` (never impersonation). The `from>{id}` pair must be on SHIPWRIGHT_AGENT_ASK_ALLOWLIST. Every ask writes an AgentAsk audit row (no question text). 404 unless SHIPWRIGHT_AGENT_ASK_ENABLED is `enabled`; 503 when the chat service is not configured.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": components["schemas"]["AgentAskBody"];
+                };
+            };
+            responses: {
+                /** @description Ask posted; `replied` with the reply, or `pending` */
+                201: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentAskResponse"];
+                    };
+                };
+                /** @description Bad request (including depth other than 1) */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Caller not allowed, or the pair is not allowlisted */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent not found, or agent ask disabled */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Chat service not configured */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/agents/{id}/asks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List agent asks
+         * @description Lists the AgentAsk audit rows the agent sent or received, newest first. `*`, `platform.read` and `platform.ops` callers only. 404 unless SHIPWRIGHT_AGENT_ASK_ENABLED is `enabled`.
+         */
+        get: {
+            parameters: {
+                query?: {
+                    limit?: number;
+                    offset?: number | null;
+                };
+                header?: never;
+                path: {
+                    id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Audit rows */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["AgentAskList"];
+                    };
+                };
+                /** @description Bad request */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Forbidden */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Agent ask disabled */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        ReconcileAgentsResult: {
+            recreated: string[];
+            updated: string[];
+            orphans: string[];
+            failed: {
+                agentId: string;
+                error: string;
+            }[];
+            /** @description perAgent identity mode: agents moved (or, in a dry run, that would be moved) onto their own newly created identity */
+            migrated: string[];
+            /** @description perAgent identity mode: agents skipped because they have no owner; left unmodified */
+            noOwner: string[];
+            dryRun: boolean;
+        };
+        Error: {
+            /** @example not found */
+            error: string;
+        };
+        StripCredentialsResult: {
+            dryRun: boolean;
+            agents: {
+                agentId: string;
+                keys: string[];
+            }[];
+        };
+        ProvisionAgentResult: {
+            resourceName: string;
+            secretName: string;
+            deploymentName: string;
+        };
+        ProvisionSkippedResult: {
+            /** @enum {boolean} */
+            skipped: true;
+            reason: string;
+        };
+        GetAgentResult: {
+            id: string;
+            name: string;
+            slackId?: string | null;
+            selfHosted: boolean;
+            repos: string[];
+            reviewAuthorAllowlist: string[];
+            patchAuthorAllowlist: string[];
+            restrictSlackToMembers: boolean;
+            typeName: string;
+            accountId: string | null;
+            /** Format: date-time */
+            createdAt: string;
+            /** Format: date-time */
+            updatedAt: string;
+            missingRequiredEnv: string[];
+            warning?: string;
+            /** Format: date-time */
+            trialExpiresAt?: string | null;
+            /** Format: date-time */
+            trialExpiryWarnedAt?: string | null;
+            /** @example true */
+            autoPostReviews: boolean;
+            /** @example false */
+            allowSelfReview: boolean;
+            /** @example 75 */
+            minConfidence: number;
+            /** @example 5 */
+            maxFindings: number;
+            /** @example true */
+            cleanupMergedWorktrees: boolean;
+            /** @example 14 */
+            cleanupAfterDays: number;
+            /** @example jane.doe@example.com */
+            ownerEmail: string | null;
+            /** @example shipwright-my-agent */
+            anthropicIdentityName: string | null;
+            /** @example svac_01ABC */
+            anthropicServiceAccountId: string | null;
+            /** @example fdrl_01XYZ */
+            anthropicFederationRuleId: string | null;
+        };
+        PatchAgentBody: {
+            /** @example U0AALR8M69X */
+            slackId?: string | null;
+            /** @example false */
+            selfHosted?: boolean;
+            /**
+             * @example [
+             *       "my-org/my-repo"
+             *     ]
+             */
+            repos?: string[];
+            /**
+             * @example [
+             *       "octocat"
+             *     ]
+             */
+            reviewAuthorAllowlist?: string[];
+            /**
+             * @example [
+             *       "octocat"
+             *     ]
+             */
+            patchAuthorAllowlist?: string[];
+            /** @example false */
+            restrictSlackToMembers?: boolean;
+            /** @example acct_123 */
+            accountId?: string | null;
+            /**
+             * Format: date-time
+             * @example 2026-12-01T00:00:00.000Z
+             */
+            trialExpiresAt?: string | null;
+            /** @example true */
+            autoPostReviews?: boolean;
+            /** @example false */
+            allowSelfReview?: boolean;
+            /** @example 75 */
+            minConfidence?: number;
+            /** @example 5 */
+            maxFindings?: number;
+            /** @example true */
+            cleanupMergedWorktrees?: boolean;
+            /** @example 14 */
+            cleanupAfterDays?: number;
+        };
+        AddAgentReposBody: {
+            /**
+             * @example [
+             *       "my-org/my-repo"
+             *     ]
+             */
+            repos: string[];
+        };
+        DeleteAgentResult: {
+            /** @example true */
+            agentDeleted: boolean;
+            /**
+             * @example [
+             *       "k8s",
+             *       "task-store-tokens",
+             *       "chat-service-tokens-and-threads"
+             *     ]
+             */
+            completed: string[];
+            failed: components["schemas"]["FailedStep"][];
+            manualStepsRequired: components["schemas"]["ManualStep"][];
+        };
+        FailedStep: {
+            /** @example k8s */
+            step: string;
+            /** @example k8s API timeout */
+            error: string;
+        };
+        ManualStep: {
+            /** @example GH_TOKEN */
+            key: string;
+            /** @example GH_TOKEN was not automatically revoked — rotate or revoke it manually. */
+            message: string;
+        };
+        DeleteAgentBody: {
+            /** @example xoxp-user-token */
+            xoxpToken?: string;
+        };
+        AgentSummary: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example Bodhi */
+            name: string;
+            /** @example false */
+            selfHosted: boolean;
+            /** @example coding */
+            typeName: string;
+        };
+        CreateAgentBody: {
+            /** @example Bodhi */
+            name: string;
+            /** @example coding */
+            typeName: string;
+            /** @example in-cluster */
+            runtime?: string;
+            /** @example my-org/my-repo */
+            reposRaw?: string;
+            /** @example octocat */
+            authorAllowlistRaw?: string;
+            /** @example octocat */
+            patchAuthorAllowlistRaw?: string;
+            /** @example dev@example.com */
+            memberEmailsRaw?: string;
+            /** @example true */
+            restrictSlackToMembersRaw?: string;
+            claudeCodeOauthToken?: string;
+            anthropicApiKey?: string;
+        };
+        Ok: {
+            /** @enum {boolean} */
+            ok: true;
+        };
+        AgentEnvBody: {
+            [key: string]: string;
+        };
+        AgentEnvResponse: {
+            /**
+             * @example {
+             *       "MY_VAR": "value"
+             *     }
+             */
+            env: {
+                [key: string]: string;
+            };
+            /**
+             * @example [
+             *       "MY_SECRET"
+             *     ]
+             */
+            secretKeys: string[];
+        };
+        AgentEnvPatchBody: {
+            /**
+             * @example {
+             *       "MY_VAR": "value"
+             *     }
+             */
+            env: {
+                [key: string]: string;
+            };
+            /**
+             * @example [
+             *       "MY_SECRET"
+             *     ]
+             */
+            secretKeys?: string[];
+        };
+        CronWrapper: {
+            cron: components["schemas"]["AgentCronJob"];
+        };
+        AgentCronJob: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /** @example 0 9 * * 1-5 */
+            schedule: string;
+            /** @example Run the morning brief. */
+            prompt: string;
+            /** @example C01234567 */
+            channel: string | null;
+            /** @example U0AALR8M69X */
+            user: string | null;
+            /** @example false */
+            silent: boolean;
+            /** @example true */
+            enabled: boolean;
+            /** @example shipwright:check-dev-task.ts */
+            preCheck: string | null;
+            /** @example morning-brief */
+            name: string | null;
+            /** @example false */
+            system: boolean;
+            /** @example null */
+            parentCronId: string | null;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            updatedAt: string;
+        };
+        CreateAgentCronJobBody: {
+            /** @example 0 9 * * 1-5 */
+            schedule: string;
+            /** @example Run the morning brief. */
+            prompt: string;
+            /** @example C01234567 */
+            channel?: string | null;
+            /** @example U0AALR8M69X */
+            user?: string | null;
+            /** @example false */
+            silent?: boolean;
+            /** @example true */
+            enabled?: boolean;
+            /** @example shipwright:check-dev-task.ts */
+            preCheck?: string | null;
+            /** @example morning-brief */
+            name?: string | null;
+        };
+        ReconcileCronResult: {
+            created: number;
+            updated: number;
+            deleted: number;
+        };
+        PatchAgentCronJobBody: {
+            /** @example 0 9 * * 1-5 */
+            schedule?: string;
+            /** @example Run the morning brief. */
+            prompt?: string;
+            /** @example C01234567 */
+            channel?: string | null;
+            /** @example U0AALR8M69X */
+            user?: string | null;
+            /** @example false */
+            silent?: boolean;
+            /** @example shipwright:check-dev-task.ts */
+            preCheck?: string | null;
+            /** @example true */
+            enabled?: boolean;
+        };
+        CronsWithSummaryWrapper: {
+            crons: components["schemas"]["AgentCronJobWithRunSummary"][];
+        };
+        AgentCronJobWithRunSummary: components["schemas"]["AgentCronJob"] & {
+            lastRun: components["schemas"]["CronRunLastRun"];
+            /** @example 3 */
+            runCountToday: number;
+        };
+        /** @example null */
+        CronRunLastRun: {
+            /**
+             * Format: date-time
+             * @example 2026-01-01T08:00:00.000Z
+             */
+            startedAt: string;
+            /**
+             * Format: date-time
+             * @example null
+             */
+            completedAt: string | null;
+            /** @example false */
+            skipped: boolean;
+            /** @example success */
+            outcome: string | null;
+        } | null;
+        CronRunWrapper: {
+            run: components["schemas"]["AgentCronRun"];
+        };
+        AgentCronRun: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx0987654321 */
+            cronId: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T08:00:00.000Z
+             */
+            startedAt: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T08:00:05.000Z
+             */
+            completedAt: string | null;
+            /** @example false */
+            skipped: boolean;
+            /** @example pre-check returned false */
+            skipReason: string | null;
+            /** @example success */
+            outcome: string | null;
+            /** @example null */
+            error: string | null;
+            /**
+             * @description Child AgentCronJob id (FK) of the pipeline phase this run served (dev-task/review/patch/deploy). Null for legacy five-job crons or ticks with no phase attribution.
+             * @example clx0987654321
+             */
+            phaseId: string | null;
+            /**
+             * @description Work item type this run was dispatched against ("task" | "pr"). Null when the tick had no dispatch (skipped tick, empty queue).
+             * @example task
+             */
+            itemType: string | null;
+            /**
+             * @description Work item id this run was dispatched against (e.g. "WLS-2.2" or "acme/x#123"). Null when the tick had no dispatch.
+             * @example WLS-2.2
+             */
+            itemId: string | null;
+            /**
+             * @description Slash-command variant this dispatch ran ("default" | "alternate"). Null when the run had no variant attribution.
+             * @example default
+             */
+            commandVariant: string | null;
+            /** @example 1234 */
+            inputTokens: number | null;
+            /** @example 567 */
+            outputTokens: number | null;
+            /** @example 89 */
+            cacheReadTokens: number | null;
+            /** @example 10 */
+            cacheCreationTokens: number | null;
+            /**
+             * @description Agent session id this run was executed under. Null for runs with no recorded session.
+             * @example session-abc-123
+             */
+            sessionId: string | null;
+            /**
+             * Format: date-time
+             * @description Most recent debounced progress-push (recordProgress()) timestamp, sourced from the agent's injected Clock. Null for runs that never reported progress (short/legacy runs).
+             * @example 2026-01-01T08:00:03.000Z
+             */
+            lastHeartbeatAt: string | null;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T08:00:00.000Z
+             */
+            createdAt: string;
+            modelBreakdown?: components["schemas"]["ModelBreakdownEntry"][];
+            /** @description First-turn context baseline (null for resumed sessions and runs from older agent builds). */
+            contextBaseline?: {
+                /** @example claude-sonnet-4-6 */
+                model: string;
+                /** @example 79188 */
+                contextTokens: number;
+                /** @example 2 */
+                inputTokens: number;
+                /** @example 41415 */
+                cacheCreationTokens: number;
+                /** @example 37771 */
+                cacheReadTokens: number;
+            } | null;
+            /** @example 12 */
+            turns?: number | null;
+            /** @example 7 */
+            toolCalls?: number | null;
+            /** @example abc123def456 */
+            contextFingerprint?: string | null;
+            /** @example 1.363.0 */
+            pluginVersion?: string | null;
+            /** @example 2.1.285 */
+            claudeCodeVersion?: string | null;
+        };
+        ModelBreakdownEntry: {
+            /** @example claude-sonnet-4-5 */
+            model: string;
+            /**
+             * @default 0
+             * @example 200
+             */
+            inputTokens: number;
+            /**
+             * @default 0
+             * @example 100
+             */
+            outputTokens: number;
+            /**
+             * @default 0
+             * @example 8
+             */
+            cacheReadTokens: number;
+            /**
+             * @default 0
+             * @example 4
+             */
+            cacheCreationTokens: number;
+            /**
+             * @default 0
+             * @example 0.002
+             */
+            costUsd: number;
+        };
+        CreateAgentCronRunBody: {
+            /**
+             * Format: date-time
+             * @example 2026-01-01T08:00:00.000Z
+             */
+            startedAt: string;
+            /**
+             * Format: date-time
+             * @example null
+             */
+            completedAt?: string | null;
+            /** @example false */
+            skipped?: boolean;
+            /** @example pre-check returned false */
+            skipReason?: string | null;
+            /** @example success */
+            outcome?: string | null;
+            /** @example null */
+            error?: string | null;
+            /**
+             * @description Child AgentCronJob id (FK) of the pipeline phase this run served (dev-task/review/patch/deploy)
+             * @example clx0987654321
+             */
+            phaseId?: string | null;
+            /**
+             * @description Work item type this run was dispatched against ("task" | "pr")
+             * @example task
+             */
+            itemType?: string | null;
+            /**
+             * @description Work item id this run was dispatched against (e.g. "WLS-2.2" or "acme/x#123")
+             * @example WLS-2.2
+             */
+            itemId?: string | null;
+            /**
+             * @description Slash-command variant this dispatch ran ("default" | "alternate")
+             * @example alternate
+             */
+            commandVariant?: string | null;
+        };
+        CronRunsList: {
+            items: components["schemas"]["AgentCronRun"][];
+            /** @example 42 */
+            total: number;
+            /** @example 20 */
+            limit: number;
+            /** @example 0 */
+            offset: number;
+        };
+        PatchCronRunWrapper: {
+            run: components["schemas"]["AgentCronRun"];
+        };
+        PatchAgentCronRunBody: {
+            /**
+             * Format: date-time
+             * @example 2026-01-01T08:05:00.000Z
+             */
+            completedAt?: string | null;
+            /** @example success */
+            outcome?: string | null;
+            /** @example null */
+            error?: string | null;
+            /** @example false */
+            skipped?: boolean;
+            /** @example pre-check returned false */
+            skipReason?: string | null;
+            /** @example 1234 */
+            inputTokens?: number | null;
+            /** @example 567 */
+            outputTokens?: number | null;
+            /** @example 89 */
+            cacheReadTokens?: number | null;
+            /** @example 10 */
+            cacheCreationTokens?: number | null;
+            /**
+             * @description Agent session id this run was executed under.
+             * @example session-abc-123
+             */
+            sessionId?: string | null;
+            /**
+             * Format: date-time
+             * @description Most recent debounced progress-push (recordProgress()) timestamp, sourced from the agent's injected Clock.
+             * @example 2026-01-01T08:00:03.000Z
+             */
+            lastHeartbeatAt?: string | null;
+            /** @description Per-model token breakdown for this run */
+            modelBreakdown?: components["schemas"]["ModelBreakdownEntry"][];
+            contextBaseline?: components["schemas"]["ContextBaselineEntry"];
+            /**
+             * @description Distinct usage-bearing assistant turns in the run.
+             * @example 12
+             */
+            turns?: number | null;
+            /**
+             * @description Distinct tool_use blocks in the run.
+             * @example 7
+             */
+            toolCalls?: number | null;
+            /**
+             * @description sha256[:12] over the workspace's always-loaded markdown (CLAUDE.md, its @imports, no-`paths` rules) + plugin version. Groups runs by what the model was given.
+             * @example abc123def456
+             */
+            contextFingerprint?: string | null;
+            /** @example 1.363.0 */
+            pluginVersion?: string | null;
+            /** @example 2.1.285 */
+            claudeCodeVersion?: string | null;
+            /** @description Per-skill / per-subagent token attribution rows for this run; upserted per [kind, name]. */
+            skillUsage?: components["schemas"]["SkillUsageEntry"][];
+        };
+        /** @description First-turn context baseline: usage of the run's first assistant message. contextTokens = input + cacheCreation + cacheRead — the full always-loaded context independent of cache warmth. Omitted for resumed sessions. */
+        ContextBaselineEntry: {
+            /** @example claude-sonnet-4-6 */
+            model: string;
+            /** @example 79188 */
+            contextTokens: number;
+            /** @example 2 */
+            inputTokens: number;
+            /** @example 41415 */
+            cacheCreationTokens: number;
+            /** @example 37771 */
+            cacheReadTokens: number;
+        };
+        SkillUsageEntry: {
+            /**
+             * @example skill
+             * @enum {string}
+             */
+            kind: "skill" | "agent" | "root";
+            /** @example shipwright:task-store */
+            name: string;
+            /** @example 1 */
+            invocations: number;
+            /** @example 3 */
+            turns: number;
+            /** @example 12 */
+            inputTokens: number;
+            /** @example 100 */
+            outputTokens: number;
+            /** @example 219200 */
+            cacheReadTokens: number;
+            /** @example 9300 */
+            cacheCreationTokens: number;
+            /**
+             * @description input + cacheCreation of the first usage-bearing turn after the skill's first invoke — the new context admitted when its body loaded. Null for root/agent rows.
+             * @example 9103
+             */
+            invokeContextDelta?: number | null;
+        };
+        ToolWrapper: {
+            tool: components["schemas"]["AgentTool"];
+        };
+        AgentTool: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /** @example Read */
+            pattern: string;
+            /** @example true */
+            enabled: boolean;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            createdAt: string;
+        };
+        CreateAgentToolBody: {
+            /** @example Bash */
+            pattern: string;
+        };
+        ToolsWrapper: {
+            tools: components["schemas"]["AgentTool"][];
+        };
+        PatchAgentToolBody: {
+            /** @example false */
+            enabled: boolean;
+        };
+        CreateAgentTokenResponse: {
+            token: components["schemas"]["AgentToken"];
+            /** @example swt_v1_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx */
+            rawToken: string;
+        };
+        AgentToken: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /** @example ci-runner */
+            label?: string | null;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @example null
+             */
+            revokedAt?: string | null;
+        };
+        CreateAgentTokenBody: {
+            /** @example ci-runner */
+            label?: string;
+        };
+        TokensWrapper: {
+            tokens: components["schemas"]["AgentToken"][];
+        };
+        PluginWrapper: {
+            plugin: components["schemas"]["AgentPlugin"];
+        };
+        AgentPlugin: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /** @example @shipwright/plugin */
+            name: string;
+            /** @example 1.2.3 */
+            version?: string | null;
+            /** @example true */
+            enabled: boolean;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            updatedAt: string;
+        };
+        CreateAgentPluginBody: {
+            /** @example @shipwright/plugin */
+            name: string;
+            /** @example 1.2.3 */
+            version?: string | null;
+        };
+        PluginsWrapper: {
+            plugins: components["schemas"]["AgentPlugin"][];
+        };
+        PatchAgentPluginBody: {
+            /** @example 1.3.0 */
+            version?: string | null;
+        };
+        PhaseMethodologyListWrapper: {
+            phaseMethodology: components["schemas"]["AgentPhaseMethodology"][];
+        };
+        AgentPhaseMethodology: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /**
+             * @example review
+             * @enum {string}
+             */
+            phase: "prd" | "plan-session" | "review" | "patch" | "deploy" | "dev-task";
+            /** @example shipwright:code-reviewer */
+            subagentType: string | null;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            updatedAt: string;
+        };
+        PhaseMethodologyWrapper: {
+            phaseMethodology: components["schemas"]["AgentPhaseMethodology"];
+        };
+        PutAgentPhaseMethodologyBody: {
+            /** @example shipwright:code-reviewer */
+            subagentType: string | null;
+        };
+        CronRunTokenStats: {
+            totals: components["schemas"]["TokenAggregate"];
+            byAgent: components["schemas"]["KeyedTokenAggregate"][];
+            byCron: components["schemas"]["DoubleKeyedTokenAggregate"][];
+            byModel: components["schemas"]["DoubleKeyedTokenAggregate"][];
+            daily: components["schemas"]["DailyTokenAggregate"][];
+            byCronModel: components["schemas"]["DoubleKeyedTokenAggregate"][];
+            byPhase: components["schemas"]["KeyedTokenAggregate"][];
+            bySkill?: components["schemas"]["SkillUsageAggregate"][];
+            baselines?: components["schemas"]["ContextBaselineAggregate"][];
+        };
+        TokenAggregate: {
+            /** @example 600 */
+            input: number;
+            /** @example 300 */
+            output: number;
+            /** @example 60 */
+            cacheRead: number;
+            /** @example 30 */
+            cacheCreation: number;
+            /** @example 990 */
+            total: number;
+            /** @example 0.006 */
+            costUsd?: number;
+        };
+        KeyedTokenAggregate: components["schemas"]["TokenAggregate"] & {
+            /** @example agent-id-123 */
+            key: string;
+        };
+        DoubleKeyedTokenAggregate: components["schemas"]["TokenAggregate"] & {
+            /** @example agent-id-123 */
+            key1: string;
+            /** @example morning-brief */
+            key2: string;
+            /** @example dev-task */
+            phase?: string | null;
+        };
+        DailyTokenAggregate: components["schemas"]["TokenAggregate"] & {
+            /** @example 2026-01-10 */
+            period: string;
+        };
+        SkillUsageAggregate: {
+            /** @example skill */
+            kind: string;
+            /** @example shipwright:dev-task */
+            name: string;
+            /** @example 4 */
+            runs: number;
+            /** @example 5 */
+            invocations: number;
+            /** @example 40 */
+            turns: number;
+            /** @example 600 */
+            input: number;
+            /** @example 300 */
+            output: number;
+            /** @example 60 */
+            cacheRead: number;
+            /** @example 30 */
+            cacheCreation: number;
+            /** @example 1200 */
+            avgInvokeContextDelta: number | null;
+        };
+        ContextBaselineAggregate: {
+            /** @example a1b2c3 */
+            contextFingerprint: string | null;
+            /** @example claude-sonnet-5-5 */
+            baselineModel: string | null;
+            /** @example dev-task */
+            phase: string | null;
+            /** @example 12 */
+            runs: number;
+            /** @example 24000 */
+            avgContextTokens: number;
+            /** @example 23000 */
+            minContextTokens: number;
+            /** @example 25000 */
+            maxContextTokens: number;
+            /** @example 30 */
+            avgTurns: number | null;
+            /** @example 55 */
+            avgToolCalls: number | null;
+            /** @example 2026-01-10T09:00:00.000Z */
+            firstSeen: string;
+            /** @example 2026-01-15T09:00:00.000Z */
+            lastSeen: string;
+        };
+        CronRunOutcomes: {
+            series: components["schemas"]["CronRunOutcomeSeries"][];
+        };
+        CronRunOutcomeSeries: {
+            /** @example dev-task */
+            phase: string | null;
+            /** @example a1b2c3d4e5f6 */
+            contextFingerprint: string | null;
+            runs: number;
+            completed: number;
+            failed: number;
+            skipped: number;
+            /**
+             * @example {
+             *       "no-ready-task": 3
+             *     }
+             */
+            skipReasons: {
+                [key: string]: number;
+            };
+            avgDurationMs: number | null;
+            p50DurationMs: number | null;
+            avgTurns: number | null;
+            avgToolCalls: number | null;
+            avgContextTokens: number | null;
+        };
+        ChatTokenStats: {
+            totals: components["schemas"]["TokenAggregate"];
+            byAgent: components["schemas"]["KeyedTokenAggregate"][];
+            byModel: components["schemas"]["DoubleKeyedTokenAggregate"][];
+            daily: components["schemas"]["DailyTokenAggregate"][];
+        };
+        AgentChatTokenUsageDailyByModel: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /** @example 2026-01-15 */
+            date: string;
+            /** @example claude-sonnet-4-5 */
+            model: string;
+            /** @example 100 */
+            inputTokens: number;
+            /** @example 50 */
+            outputTokens: number;
+            /** @example 10 */
+            cacheReadTokens: number;
+            /** @example 5 */
+            cacheCreationTokens: number;
+            /** @example 0.0012 */
+            costUsd: number;
+            /**
+             * Format: date-time
+             * @example 2026-01-15T00:00:00.000Z
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-15T12:00:00.000Z
+             */
+            updatedAt: string;
+        };
+        UpsertChatTokenDailyBody: {
+            /** @example 2026-01-15 */
+            date: string;
+            /** @description Per-model token usage increments */
+            modelBreakdown: components["schemas"]["ChatTokenModelEntry"][];
+        };
+        ChatTokenModelEntry: {
+            /** @example claude-sonnet-4-5 */
+            model: string;
+            /** @example 100 */
+            inputTokens: number;
+            /** @example 50 */
+            outputTokens: number;
+            /** @example 10 */
+            cacheReadTokens: number;
+            /** @example 5 */
+            cacheCreationTokens: number;
+            /** @example 0.0012 */
+            costUsd: number;
+        };
+        WorkQueueSnapshotWrapper: {
+            snapshot: components["schemas"]["AgentWorkQueueSnapshot"];
+        };
+        AgentWorkQueueSnapshot: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            computedAt: string;
+            items: components["schemas"]["RankedWorkItem"][];
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            createdAt: string;
+        };
+        RankedWorkItem: {
+            /**
+             * @example task
+             * @enum {string}
+             */
+            type: "task" | "pr";
+            /** @example WLS-2.2 */
+            id: string;
+            /** @example Add work queue snapshot endpoints */
+            title?: string;
+            /**
+             * @example dev-task
+             * @enum {string}
+             */
+            phase: "dev-task" | "plan" | "review" | "patch" | "deploy";
+            /**
+             * @description ISO timestamp
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            age: string;
+        };
+        PushWorkQueueSnapshotBody: {
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            computedAt: string;
+            items: components["schemas"]["RankedWorkItem"][];
+        };
+        GitHubInstallationsSnapshotWrapper: {
+            snapshot: components["schemas"]["AgentGitHubInstallationsSnapshot"];
+        };
+        AgentGitHubInstallationsSnapshot: {
+            /** @example clx1234567890 */
+            id: string;
+            /** @example clx1234567890 */
+            agentId: string;
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            reportedAt: string;
+            installations: components["schemas"]["GitHubInstallation"][];
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            createdAt: string;
+        };
+        GitHubInstallation: {
+            /** @example app-vitals */
+            owner: string;
+            /** @example 12345678 */
+            installationId: number;
+            /** @example active */
+            state: string;
+            /**
+             * @description Sanitized last error message (max 500 chars). Must not contain credentials.
+             * @example installation suspended
+             */
+            lastError?: string | null;
+        };
+        PutGitHubInstallationsBody: {
+            /**
+             * Format: date-time
+             * @example 2026-01-01T00:00:00.000Z
+             */
+            reportedAt: string;
+            installations: components["schemas"]["GitHubInstallation"][];
+        };
+        AgentConfigResponse: {
+            /**
+             * @example {
+             *       "SLACK_BOT_TOKEN": "xoxb-..."
+             *     }
+             */
+            env: {
+                [key: string]: string;
+            };
+            /**
+             * @example [
+             *       "Read",
+             *       "Write"
+             *     ]
+             */
+            allowedTools: string[];
+            plugins: components["schemas"]["AgentConfigPlugin"][];
+            /**
+             * @example [
+             *       "org/repo1",
+             *       "org/repo2"
+             *     ]
+             */
+            repos: string[];
+            /**
+             * @example [
+             *       "octocat"
+             *     ]
+             */
+            reviewAuthorAllowlist: string[];
+            /**
+             * @example [
+             *       "octocat"
+             *     ]
+             */
+            patchAuthorAllowlist: string[];
+            /** @example true */
+            autoPostReviews: boolean;
+            /** @example false */
+            allowSelfReview: boolean;
+            /** @example 75 */
+            minConfidence: number;
+            /** @example 5 */
+            maxFindings: number;
+            /** @example true */
+            cleanupMergedWorktrees: boolean;
+            /** @example 14 */
+            cleanupAfterDays: number;
+            /** @example false */
+            restrictSlackToMembers: boolean;
+            /**
+             * @example [
+             *       "dev@example.com"
+             *     ]
+             */
+            memberEmails: string[];
+            /**
+             * Format: date-time
+             * @example 2026-12-01T00:00:00.000Z
+             */
+            trialExpiresAt?: string | null;
+            /** @example active */
+            accountStatus?: string | null;
+            /** @example coding */
+            typeName?: string;
+            /**
+             * @example {
+             *       "prd": null,
+             *       "plan-session": null,
+             *       "review": "shipwright:code-reviewer",
+             *       "patch": null,
+             *       "deploy": null,
+             *       "dev-task": null
+             *     }
+             */
+            phaseMethodology: {
+                [key: string]: string | null;
+            };
+        };
+        AgentConfigPlugin: {
+            /** @example shipwright */
+            marketplace: string;
+            /** @example shipwright */
+            plugin: string;
+        };
+        RuntimeError: {
+            /** @example Not found */
+            error: string;
+        };
+        CreateChatCredentialResponse: {
+            /** @example clx0987654321 */
+            tokenId: string;
+            /** @example ct_xxxxxxxxxxxxxxxxxxxxxxxx */
+            rawToken: string;
+            /** @example ask-caller */
+            label: string;
+            /** @example clx1234567890 */
+            agentId: string;
+        };
+        CreateChatCredentialBody: {
+            /** @example ask-caller */
+            label: string;
+        };
+        ChatCredentialsWrapper: {
+            credentials: components["schemas"]["ChatCredential"][];
+        };
+        ChatCredential: {
+            /** @example clx0987654321 */
+            tokenId: string;
+            /** @example ask-caller */
+            label: string | null;
+            /** @example clx1234567890 */
+            agentId: string;
+        };
+        AgentAskResponse: {
+            /** @example clx1111111111 */
+            askId: string;
+            /** @example clx2222222222 */
+            threadId: string;
+            /**
+             * @example pending
+             * @enum {string}
+             */
+            status: "replied" | "pending";
+            /**
+             * @description The agent's reply body; present only when status is `replied`.
+             * @example acme/web is deployed and green.
+             */
+            reply?: string;
+        };
+        AgentAskBody: {
+            /**
+             * @description Id of the asking agent. An agent key may only ask as itself (`from` must equal its own id).
+             * @example clx0987654321
+             */
+            from: string;
+            /**
+             * @description The question, posted as the thread's user message. Never stored or logged by admin.
+             * @example What is the deploy status of acme/web?
+             */
+            question: string;
+            /**
+             * @description How long to wait for the reply, polling once per second. 0 (default) returns `pending` immediately.
+             * @default 0
+             * @example 0
+             */
+            waitMs: number;
+            /**
+             * @description Ask chain depth. Capped at 1: any other value is a 400.
+             * @default 1
+             * @example 1
+             */
+            depth: number;
+            /**
+             * @description How long the ask stays relevant, in seconds. Recorded on the audit row.
+             * @default 600
+             * @example 600
+             */
+            ttlSeconds: number;
+        };
+        AgentAskList: {
+            asks: components["schemas"]["AgentAskRecord"][];
+            /** @example 1 */
+            total: number;
+            /** @example 50 */
+            limit: number;
+            /** @example 0 */
+            offset: number;
+        };
+        AgentAskRecord: {
+            /** @example clx1111111111 */
+            id: string;
+            /** @example clx0987654321 */
+            fromAgentId: string;
+            /** @example clx1234567890 */
+            toAgentId: string;
+            /** @example clx2222222222 */
+            threadId: string | null;
+            /** @example 1 */
+            depth: number;
+            /** @example 0 */
+            waitMs: number;
+            /** @example 600 */
+            ttlSeconds: number;
+            /**
+             * @description created | pending | replied | failed
+             * @example pending
+             */
+            status: string;
+            /** @example ops (platform.ops) [platform-ops] */
+            callerLabel: string;
+            /** @example 2026-10-25T12:00:00.000Z */
+            createdAt: string;
+            /** @example null */
+            repliedAt: string | null;
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export type operations = Record<string, never>;