@atlanai/sdk 0.2.1 → 0.2.3

package/dist/raw/agent/models/AgentAgentEnvironmentArtifactView.d.ts

@@ -20,6 +20,12 @@ import type { AgentEnvironmentType } from './AgentEnvironmentType';
  * @interface AgentAgentEnvironmentArtifactView
  */
 export interface AgentAgentEnvironmentArtifactView {
+    /**
+     * Value of the `app` field.
+     * @type {string}
+     * @memberof AgentAgentEnvironmentArtifactView
+     */
+    app?: string;
     /**
      * Value of the `artifact_status` field.
      * @type {string}
@@ -62,12 +68,6 @@ export interface AgentAgentEnvironmentArtifactView {
      * @memberof AgentAgentEnvironmentArtifactView
      */
     displayName?: string;
-    /**
-     * Value of the `extension` field.
-     * @type {string}
-     * @memberof AgentAgentEnvironmentArtifactView
-     */
-    extension?: string;
     /**
      * Kind-prefixed Crockford-base32 handle (`<kind>_<base32>`).
      * @type {string}
@@ -106,19 +106,28 @@ export interface AgentAgentEnvironmentArtifactView {
      * The Control-Plane OIDC client id this artifact authenticates as
      * (`x-gateway-identity` kinds); absent for every other kind.
      *
-     * **Derived, not stored.** The registry resolves it from the artifact's
-     * `service_principals` row rather than keeping a second copy on the artifact,
-     * so it appears on the create response and on the single-artifact read — the
-     * two paths that make that lookup — and **not** on list, search, or a `PATCH`
-     * response, none of which do a per-row identity read. It is the public half of
-     * the credential pair and is not secret.
+     * **Derived, not stored, and present on the create response only.** The
+     * registry would resolve it from the artifact's `service_principals` row
+     * rather than keep a second copy on the artifact — but only the create path
+     * does that lookup, because it has just provisioned the identity. Every read
+     * shape (single read, list, search, `PATCH`) is built by one constructor that
+     * sets this `None`, so it is absent from all four.
+     *
+     * This block used to name the single-artifact read as a second populated path.
+     * It was never one. Adding it means deciding whether list and search pay a
+     * per-row identity read too; the lookup a future implementation would call is
+     * `registry_server::identity::artifact_principal`. It is the public half of the
+     * credential pair and is not secret.
      * @type {string}
      * @memberof AgentAgentEnvironmentArtifactView
      */
     oidcClientId?: string;
     /**
      * Canonical owner: the `users.user_id` this artifact belongs to, FK-backed.
-     * Absent when unset (legacy rows / system-plane creates).
+     *
+     * Defaulted to the creating principal, so this is normally set. Absent for a row created
+     * before that default landed, for a system-plane write, and for a principal with no directory
+     * row — a service account or a seed has nothing to own anything with.
      * @type {string}
      * @memberof AgentAgentEnvironmentArtifactView
      */
@@ -226,13 +235,16 @@ export interface AgentAgentEnvironmentArtifactView {
      */
     updatedBy: string;
     /**
-     * Optional human version selector (semver); absent when unset.
+     * The free-form label the write set, verbatim. Absent when none was sent, and *not* the name
+     * the version shipped under — that is the release's own `version_label`.
      * @type {string}
      * @memberof AgentAgentEnvironmentArtifactView
      */
     versionLabel?: string;
     /**
-     * Monotonic version coordinate within the artifact line.
+     * This version's position in its line — the write index, 1-based and dense over versions
+     * *written*. Distinct from a release's `version_ordinal`, which counts versions **shipped**;
+     * the two agree under the default `auto` release policy and diverge under `manual`.
      * @type {number}
      * @memberof AgentAgentEnvironmentArtifactView
      */
@@ -292,6 +304,18 @@ export interface AgentAgentEnvironmentArtifactView {
      * @memberof AgentAgentEnvironmentArtifactView
      */
     packages?: AgentEnvironmentPackages;
+    /**
+     * The provider's id for the sandbox template this row was pushed to.
+     * Hook-owned, and set only once a run on a delegating provider has pushed it.
+     *
+     * Environments are **unversioned** on the provider, so there is nothing to
+     * optimistic-lock against: a config change archives the pushed template and
+     * clears this, and the next trigger re-creates one. That is why the column is
+     * nullable rather than a permanent handle.
+     * @type {string}
+     * @memberof AgentAgentEnvironmentArtifactView
+     */
+    remoteEnvironmentId?: string | null;
     /**
      * Value of the `permissions` field.
      * @type {{ [key: string]: boolean; }}

package/dist/raw/agent/models/AgentAgentEnvironmentArtifactView.js

@@ -63,6 +63,7 @@ function AgentAgentEnvironmentArtifactViewFromJSONTyped(json, ignoreDiscriminato
         return json;
     }
     return {
+        'app': json['app'] == null ? undefined : json['app'],
         'artifactStatus': json['artifact_status'],
         'commitTs': json['commit_ts'],
         'contentHashHex': json['content_hash_hex'] == null ? undefined : json['content_hash_hex'],
@@ -70,7 +71,6 @@ function AgentAgentEnvironmentArtifactViewFromJSONTyped(json, ignoreDiscriminato
         'createdBy': json['created_by'],
         'description': json['description'] == null ? undefined : json['description'],
         'displayName': json['display_name'] == null ? undefined : json['display_name'],
-        'extension': json['extension'] == null ? undefined : json['extension'],
         'id': json['id'],
         'identity': json['identity'] == null ? undefined : (0, GatewayArtifactIdentityRevealView_1.GatewayArtifactIdentityRevealViewFromJSON)(json['identity']),
         'isLatest': json['is_latest'],
@@ -104,6 +104,7 @@ function AgentAgentEnvironmentArtifactViewFromJSONTyped(json, ignoreDiscriminato
         'isSystem': json['is_system'] == null ? undefined : json['is_system'],
         'networkMode': json['network_mode'] == null ? undefined : (0, AgentNetworkMode_1.AgentNetworkModeFromJSON)(json['network_mode']),
         'packages': json['packages'] == null ? undefined : (0, AgentEnvironmentPackages_1.AgentEnvironmentPackagesFromJSON)(json['packages']),
+        'remoteEnvironmentId': json['remote_environment_id'] === undefined ? undefined : json['remote_environment_id'] === null ? null : json['remote_environment_id'],
         'permissions': json['permissions'] === undefined ? undefined : json['permissions'] === null ? null : json['permissions'],
         'relationships': json['relationships'] === undefined ? undefined : json['relationships'] === null ? null : (0, RegistryRelationshipsView_1.RegistryRelationshipsViewFromJSON)(json['relationships']),
     };
@@ -116,6 +117,7 @@ function AgentAgentEnvironmentArtifactViewToJSONTyped(value, ignoreDiscriminator
         return value;
     }
     return {
+        'app': value['app'],
         'artifact_status': value['artifactStatus'],
         'commit_ts': value['commitTs'],
         'content_hash_hex': value['contentHashHex'],
@@ -123,7 +125,6 @@ function AgentAgentEnvironmentArtifactViewToJSONTyped(value, ignoreDiscriminator
         'created_by': value['createdBy'],
         'description': value['description'],
         'display_name': value['displayName'],
-        'extension': value['extension'],
         'id': value['id'],
         'identity': (0, GatewayArtifactIdentityRevealView_1.GatewayArtifactIdentityRevealViewToJSON)(value['identity']),
         'is_latest': value['isLatest'],
@@ -157,6 +158,7 @@ function AgentAgentEnvironmentArtifactViewToJSONTyped(value, ignoreDiscriminator
         'is_system': value['isSystem'],
         'network_mode': (0, AgentNetworkMode_1.AgentNetworkModeToJSON)(value['networkMode']),
         'packages': (0, AgentEnvironmentPackages_1.AgentEnvironmentPackagesToJSON)(value['packages']),
+        'remote_environment_id': value['remoteEnvironmentId'],
         'permissions': value['permissions'],
         'relationships': (0, RegistryRelationshipsView_1.RegistryRelationshipsViewToJSON)(value['relationships']),
     };

package/dist/raw/agent/models/AgentAgentEnvironmentMeta.d.ts

@@ -70,6 +70,18 @@ export interface AgentAgentEnvironmentMeta {
      * @memberof AgentAgentEnvironmentMeta
      */
     packages?: AgentEnvironmentPackages;
+    /**
+     * The provider's id for the sandbox template this row was pushed to.
+     * Hook-owned, and set only once a run on a delegating provider has pushed it.
+     *
+     * Environments are **unversioned** on the provider, so there is nothing to
+     * optimistic-lock against: a config change archives the pushed template and
+     * clears this, and the next trigger re-creates one. That is why the column is
+     * nullable rather than a permanent handle.
+     * @type {string}
+     * @memberof AgentAgentEnvironmentMeta
+     */
+    remoteEnvironmentId?: string | null;
 }
 /**
  * Check if a given object implements the AgentAgentEnvironmentMeta interface.

package/dist/raw/agent/models/AgentAgentEnvironmentMeta.js

@@ -47,6 +47,7 @@ function AgentAgentEnvironmentMetaFromJSONTyped(json, ignoreDiscriminator) {
         'isSystem': json['is_system'] == null ? undefined : json['is_system'],
         'networkMode': (0, AgentNetworkMode_1.AgentNetworkModeFromJSON)(json['network_mode']),
         'packages': json['packages'] == null ? undefined : (0, AgentEnvironmentPackages_1.AgentEnvironmentPackagesFromJSON)(json['packages']),
+        'remoteEnvironmentId': json['remote_environment_id'] === undefined ? undefined : json['remote_environment_id'] === null ? null : json['remote_environment_id'],
     };
 }
 function AgentAgentEnvironmentMetaToJSON(json) {
@@ -65,5 +66,6 @@ function AgentAgentEnvironmentMetaToJSONTyped(value, ignoreDiscriminator = false
         'is_system': value['isSystem'],
         'network_mode': (0, AgentNetworkMode_1.AgentNetworkModeToJSON)(value['networkMode']),
         'packages': (0, AgentEnvironmentPackages_1.AgentEnvironmentPackagesToJSON)(value['packages']),
+        'remote_environment_id': value['remoteEnvironmentId'],
     };
 }

package/dist/raw/agent/models/AgentAgentFrameworkArtifactView.d.ts

@@ -17,6 +17,12 @@ import type { RegistryRelationshipsView } from './RegistryRelationshipsView';
  * @interface AgentAgentFrameworkArtifactView
  */
 export interface AgentAgentFrameworkArtifactView {
+    /**
+     * Value of the `app` field.
+     * @type {string}
+     * @memberof AgentAgentFrameworkArtifactView
+     */
+    app?: string;
     /**
      * Value of the `artifact_status` field.
      * @type {string}
@@ -59,12 +65,6 @@ export interface AgentAgentFrameworkArtifactView {
      * @memberof AgentAgentFrameworkArtifactView
      */
     displayName?: string;
-    /**
-     * Value of the `extension` field.
-     * @type {string}
-     * @memberof AgentAgentFrameworkArtifactView
-     */
-    extension?: string;
     /**
      * Kind-prefixed Crockford-base32 handle (`<kind>_<base32>`).
      * @type {string}
@@ -103,19 +103,28 @@ export interface AgentAgentFrameworkArtifactView {
      * The Control-Plane OIDC client id this artifact authenticates as
      * (`x-gateway-identity` kinds); absent for every other kind.
      *
-     * **Derived, not stored.** The registry resolves it from the artifact's
-     * `service_principals` row rather than keeping a second copy on the artifact,
-     * so it appears on the create response and on the single-artifact read — the
-     * two paths that make that lookup — and **not** on list, search, or a `PATCH`
-     * response, none of which do a per-row identity read. It is the public half of
-     * the credential pair and is not secret.
+     * **Derived, not stored, and present on the create response only.** The
+     * registry would resolve it from the artifact's `service_principals` row
+     * rather than keep a second copy on the artifact — but only the create path
+     * does that lookup, because it has just provisioned the identity. Every read
+     * shape (single read, list, search, `PATCH`) is built by one constructor that
+     * sets this `None`, so it is absent from all four.
+     *
+     * This block used to name the single-artifact read as a second populated path.
+     * It was never one. Adding it means deciding whether list and search pay a
+     * per-row identity read too; the lookup a future implementation would call is
+     * `registry_server::identity::artifact_principal`. It is the public half of the
+     * credential pair and is not secret.
      * @type {string}
      * @memberof AgentAgentFrameworkArtifactView
      */
     oidcClientId?: string;
     /**
      * Canonical owner: the `users.user_id` this artifact belongs to, FK-backed.
-     * Absent when unset (legacy rows / system-plane creates).
+     *
+     * Defaulted to the creating principal, so this is normally set. Absent for a row created
+     * before that default landed, for a system-plane write, and for a principal with no directory
+     * row — a service account or a seed has nothing to own anything with.
      * @type {string}
      * @memberof AgentAgentFrameworkArtifactView
      */
@@ -223,13 +232,16 @@ export interface AgentAgentFrameworkArtifactView {
      */
     updatedBy: string;
     /**
-     * Optional human version selector (semver); absent when unset.
+     * The free-form label the write set, verbatim. Absent when none was sent, and *not* the name
+     * the version shipped under — that is the release's own `version_label`.
      * @type {string}
      * @memberof AgentAgentFrameworkArtifactView
      */
     versionLabel?: string;
     /**
-     * Monotonic version coordinate within the artifact line.
+     * This version's position in its line — the write index, 1-based and dense over versions
+     * *written*. Distinct from a release's `version_ordinal`, which counts versions **shipped**;
+     * the two agree under the default `auto` release policy and diverge under `manual`.
      * @type {number}
      * @memberof AgentAgentFrameworkArtifactView
      */

package/dist/raw/agent/models/AgentAgentFrameworkArtifactView.js

@@ -60,6 +60,7 @@ function AgentAgentFrameworkArtifactViewFromJSONTyped(json, ignoreDiscriminator)
         return json;
     }
     return {
+        'app': json['app'] == null ? undefined : json['app'],
         'artifactStatus': json['artifact_status'],
         'commitTs': json['commit_ts'],
         'contentHashHex': json['content_hash_hex'] == null ? undefined : json['content_hash_hex'],
@@ -67,7 +68,6 @@ function AgentAgentFrameworkArtifactViewFromJSONTyped(json, ignoreDiscriminator)
         'createdBy': json['created_by'],
         'description': json['description'] == null ? undefined : json['description'],
         'displayName': json['display_name'] == null ? undefined : json['display_name'],
-        'extension': json['extension'] == null ? undefined : json['extension'],
         'id': json['id'],
         'identity': json['identity'] == null ? undefined : (0, GatewayArtifactIdentityRevealView_1.GatewayArtifactIdentityRevealViewFromJSON)(json['identity']),
         'isLatest': json['is_latest'],
@@ -110,6 +110,7 @@ function AgentAgentFrameworkArtifactViewToJSONTyped(value, ignoreDiscriminator =
         return value;
     }
     return {
+        'app': value['app'],
         'artifact_status': value['artifactStatus'],
         'commit_ts': value['commitTs'],
         'content_hash_hex': value['contentHashHex'],
@@ -117,7 +118,6 @@ function AgentAgentFrameworkArtifactViewToJSONTyped(value, ignoreDiscriminator =
         'created_by': value['createdBy'],
         'description': value['description'],
         'display_name': value['displayName'],
-        'extension': value['extension'],
         'id': value['id'],
         'identity': (0, GatewayArtifactIdentityRevealView_1.GatewayArtifactIdentityRevealViewToJSON)(value['identity']),
         'is_latest': value['isLatest'],

package/dist/raw/agent/models/AgentAgentMeta.d.ts

@@ -10,6 +10,7 @@
  * Do not edit the class manually.
  */
 import type { GatewayToolRef } from './GatewayToolRef';
+import type { AgentSyncState } from './AgentSyncState';
 /**
  * The `agent` artifact kind: something that runs autonomously somewhere, as
  * opposed to a [`HarnessMeta`], which is a tool a human drives.
@@ -114,6 +115,53 @@ export interface AgentAgentMeta {
      * @memberof AgentAgentMeta
      */
     publicUrl?: string | null;
+    /**
+     * The provider's remote agent id this row is synced to. Hook-owned.
+     * @type {string}
+     * @memberof AgentAgentMeta
+     */
+    remoteAgentId?: string | null;
+    /**
+     * The remote vault holding this agent's gateway credential, provisioned
+     * lazily at the first run-trigger. Hook-owned.
+     * @type {string}
+     * @memberof AgentAgentMeta
+     */
+    remoteVaultId?: string | null;
+    /**
+     * The immutable remote agent version the last push minted. Hook-owned.
+     *
+     * Gateway versions map 1:1 onto the provider's immutable agent versions, and
+     * a session pins `{id, version}` — so a spec edit after a run cannot
+     * retroactively change what that run executed.
+     * @type {number}
+     * @memberof AgentAgentMeta
+     */
+    remoteVersionOrdinal?: number | null;
+    /**
+     * The last remote-sync failure's bounded gateway code, so a failed push is
+     * visible on a `GET` without persisting the provider's response text.
+     * Hook-owned.
+     * @type {string}
+     * @memberof AgentAgentMeta
+     */
+    syncError?: string | null;
+    /**
+     * Value of the `sync_state` field.
+     * @type {AgentSyncState}
+     * @memberof AgentAgentMeta
+     */
+    syncState?: AgentSyncState | null;
+    /**
+     * A hash of the spec fields that map onto the remote agent config
+     * (`instructions`, `model_id`, `tools`, `max_step_count`). A re-trigger reuses
+     * the pushed version when it matches and pushes a new one when it does not,
+     * so repeated runs of an unchanged agent do not mint a version each time.
+     * Hook-owned.
+     * @type {string}
+     * @memberof AgentAgentMeta
+     */
+    syncedSpecHash?: string | null;
     /**
      * Declarative tool references the agent may call.
      * @type {Array<GatewayToolRef>}

package/dist/raw/agent/models/AgentAgentMeta.js

@@ -19,6 +19,7 @@ exports.AgentAgentMetaFromJSONTyped = AgentAgentMetaFromJSONTyped;
 exports.AgentAgentMetaToJSON = AgentAgentMetaToJSON;
 exports.AgentAgentMetaToJSONTyped = AgentAgentMetaToJSONTyped;
 const GatewayToolRef_1 = require("./GatewayToolRef");
+const AgentSyncState_1 = require("./AgentSyncState");
 /**
  * Check if a given object implements the AgentAgentMeta interface.
  */
@@ -40,6 +41,12 @@ function AgentAgentMetaFromJSONTyped(json, ignoreDiscriminator) {
         'maxStepCount': json['max_step_count'] == null ? undefined : json['max_step_count'],
         'modelId': json['model_id'] === undefined ? undefined : json['model_id'] === null ? null : json['model_id'],
         'publicUrl': json['public_url'] === undefined ? undefined : json['public_url'] === null ? null : json['public_url'],
+        'remoteAgentId': json['remote_agent_id'] === undefined ? undefined : json['remote_agent_id'] === null ? null : json['remote_agent_id'],
+        'remoteVaultId': json['remote_vault_id'] === undefined ? undefined : json['remote_vault_id'] === null ? null : json['remote_vault_id'],
+        'remoteVersionOrdinal': json['remote_version_ordinal'] === undefined ? undefined : json['remote_version_ordinal'] === null ? null : json['remote_version_ordinal'],
+        'syncError': json['sync_error'] === undefined ? undefined : json['sync_error'] === null ? null : json['sync_error'],
+        'syncState': json['sync_state'] === undefined ? undefined : json['sync_state'] === null ? null : (0, AgentSyncState_1.AgentSyncStateFromJSON)(json['sync_state']),
+        'syncedSpecHash': json['synced_spec_hash'] === undefined ? undefined : json['synced_spec_hash'] === null ? null : json['synced_spec_hash'],
         'tools': json['tools'] == null ? undefined : (json['tools'].map(GatewayToolRef_1.GatewayToolRefFromJSON)),
     };
 }
@@ -58,6 +65,12 @@ function AgentAgentMetaToJSONTyped(value, ignoreDiscriminator = false) {
         'max_step_count': value['maxStepCount'],
         'model_id': value['modelId'],
         'public_url': value['publicUrl'],
+        'remote_agent_id': value['remoteAgentId'],
+        'remote_vault_id': value['remoteVaultId'],
+        'remote_version_ordinal': value['remoteVersionOrdinal'],
+        'sync_error': value['syncError'],
+        'sync_state': (0, AgentSyncState_1.AgentSyncStateToJSON)(value['syncState']),
+        'synced_spec_hash': value['syncedSpecHash'],
         'tools': value['tools'] == null ? undefined : (value['tools'].map(GatewayToolRef_1.GatewayToolRefToJSON)),
     };
 }

package/dist/raw/agent/models/AgentAgentProviderArtifactView.d.ts

@@ -18,6 +18,12 @@ import type { RegistryRelationshipsView } from './RegistryRelationshipsView';
  * @interface AgentAgentProviderArtifactView
  */
 export interface AgentAgentProviderArtifactView {
+    /**
+     * Value of the `app` field.
+     * @type {string}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    app?: string;
     /**
      * Value of the `artifact_status` field.
      * @type {string}
@@ -60,12 +66,6 @@ export interface AgentAgentProviderArtifactView {
      * @memberof AgentAgentProviderArtifactView
      */
     displayName?: string;
-    /**
-     * Value of the `extension` field.
-     * @type {string}
-     * @memberof AgentAgentProviderArtifactView
-     */
-    extension?: string;
     /**
      * Kind-prefixed Crockford-base32 handle (`<kind>_<base32>`).
      * @type {string}
@@ -104,19 +104,28 @@ export interface AgentAgentProviderArtifactView {
      * The Control-Plane OIDC client id this artifact authenticates as
      * (`x-gateway-identity` kinds); absent for every other kind.
      *
-     * **Derived, not stored.** The registry resolves it from the artifact's
-     * `service_principals` row rather than keeping a second copy on the artifact,
-     * so it appears on the create response and on the single-artifact read — the
-     * two paths that make that lookup — and **not** on list, search, or a `PATCH`
-     * response, none of which do a per-row identity read. It is the public half of
-     * the credential pair and is not secret.
+     * **Derived, not stored, and present on the create response only.** The
+     * registry would resolve it from the artifact's `service_principals` row
+     * rather than keep a second copy on the artifact — but only the create path
+     * does that lookup, because it has just provisioned the identity. Every read
+     * shape (single read, list, search, `PATCH`) is built by one constructor that
+     * sets this `None`, so it is absent from all four.
+     *
+     * This block used to name the single-artifact read as a second populated path.
+     * It was never one. Adding it means deciding whether list and search pay a
+     * per-row identity read too; the lookup a future implementation would call is
+     * `registry_server::identity::artifact_principal`. It is the public half of the
+     * credential pair and is not secret.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
     oidcClientId?: string;
     /**
      * Canonical owner: the `users.user_id` this artifact belongs to, FK-backed.
-     * Absent when unset (legacy rows / system-plane creates).
+     *
+     * Defaulted to the creating principal, so this is normally set. Absent for a row created
+     * before that default landed, for a system-plane write, and for a principal with no directory
+     * row — a service account or a seed has nothing to own anything with.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
@@ -224,13 +233,16 @@ export interface AgentAgentProviderArtifactView {
      */
     updatedBy: string;
     /**
-     * Optional human version selector (semver); absent when unset.
+     * The free-form label the write set, verbatim. Absent when none was sent, and *not* the name
+     * the version shipped under — that is the release's own `version_label`.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
     versionLabel?: string;
     /**
-     * Monotonic version coordinate within the artifact line.
+     * This version's position in its line — the write index, 1-based and dense over versions
+     * *written*. Distinct from a release's `version_ordinal`, which counts versions **shipped**;
+     * the two agree under the default `auto` release policy and diverge under `manual`.
      * @type {number}
      * @memberof AgentAgentProviderArtifactView
      */
@@ -242,18 +254,55 @@ export interface AgentAgentProviderArtifactView {
      */
     workspaceId: string;
     /**
-     * The system's API base, for a console to link to and an operator to
-     * recognize. Reference only — never dereferenced server-side.
+     * The `secret` artifact holding the provider's API key.
+     *
+     * A reference, never a value — the `model_provider.secret_ref` pattern. It is
+     * resolved at the run-trigger through `Secret.Reveal` with the caller's own
+     * bearer, so reading it is tenancy-scoped exactly as any other secret read is,
+     * and the value never lands in a column, a log, or this artifact's view.
+     *
+     * Schema-optional but **required on a `claude_managed` row**, and refused on
+     * the others. Schema validation runs before the hook, so a schema-required
+     * declaration would 422 every `local` provider with a message naming a field
+     * that row must not have; the hook can name the field, the type, and why.
+     * @type {string}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    apiKeySecretId?: string | null;
+    /**
+     * The system's API base.
+     *
+     * For a `local`/`custom` row this is reference material a console links to
+     * and an operator recognizes, never dereferenced. For a `claude_managed` row
+     * it is **the address the gateway actually calls**, defaulting to
+     * [`crate::sync::DEFAULT_CMA_BASE`] when unset — which is why the write hook
+     * SSRF-validates it on that type and only scheme-checks it on the others.
+     * The two postures cannot be collapsed: refusing an internal address on a
+     * catalog row would reject a customer correctly recording their own VPC
+     * endpoint, and allowing one on a dialed row would make provider-write an
+     * SSRF primitive against our egress.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
     baseUrl?: string | null;
+    /**
+     *
+     * @type {any}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    bootstrapSkillSync?: any | null;
     /**
      * Documentation URL. Same validation as `logo_url`.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
     docsUrl?: string | null;
+    /**
+     *
+     * @type {any}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    environmentSync?: any | null;
     /**
      * Homepage. Same validation as `logo_url`.
      * @type {string}
@@ -268,6 +317,22 @@ export interface AgentAgentProviderArtifactView {
      * @memberof AgentAgentProviderArtifactView
      */
     logoUrl?: string | null;
+    /**
+     * The gateway's **public** `/mcp` aggregator URL the remote run connects back
+     * into. Same required-on-`claude_managed`, refused-elsewhere rule as
+     * `api_key_secret_id`.
+     *
+     * It cannot be derived from the internal peer env — the value has to be
+     * reachable from Anthropic's network, not from inside our cluster — so the
+     * provider row carries it. **SSRF-validated at write**, because unlike every
+     * other URL on this kind it is dereferenced: a run we triggered fetches it.
+     * The check is defense-in-depth rather than the control (DNS moves between
+     * write and call, LIMITATIONS L14); what makes the credential safe is that the
+     * vault token is the agent's own machine identity and nothing else.
+     * @type {string}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    mcpUrl?: string | null;
     /**
      *
      * @type {AgentAgentProviderType}

package/dist/raw/agent/models/AgentAgentProviderArtifactView.js

@@ -61,6 +61,7 @@ function AgentAgentProviderArtifactViewFromJSONTyped(json, ignoreDiscriminator)
         return json;
     }
     return {
+        'app': json['app'] == null ? undefined : json['app'],
         'artifactStatus': json['artifact_status'],
         'commitTs': json['commit_ts'],
         'contentHashHex': json['content_hash_hex'] == null ? undefined : json['content_hash_hex'],
@@ -68,7 +69,6 @@ function AgentAgentProviderArtifactViewFromJSONTyped(json, ignoreDiscriminator)
         'createdBy': json['created_by'],
         'description': json['description'] == null ? undefined : json['description'],
         'displayName': json['display_name'] == null ? undefined : json['display_name'],
-        'extension': json['extension'] == null ? undefined : json['extension'],
         'id': json['id'],
         'identity': json['identity'] == null ? undefined : (0, GatewayArtifactIdentityRevealView_1.GatewayArtifactIdentityRevealViewFromJSON)(json['identity']),
         'isLatest': json['is_latest'],
@@ -94,10 +94,14 @@ function AgentAgentProviderArtifactViewFromJSONTyped(json, ignoreDiscriminator)
         'versionLabel': json['version_label'] == null ? undefined : json['version_label'],
         'versionOrdinal': json['version_ordinal'],
         'workspaceId': json['workspace_id'],
+        'apiKeySecretId': json['api_key_secret_id'] === undefined ? undefined : json['api_key_secret_id'] === null ? null : json['api_key_secret_id'],
         'baseUrl': json['base_url'] === undefined ? undefined : json['base_url'] === null ? null : json['base_url'],
+        'bootstrapSkillSync': json['bootstrap_skill_sync'] === undefined ? undefined : json['bootstrap_skill_sync'] === null ? null : json['bootstrap_skill_sync'],
         'docsUrl': json['docs_url'] === undefined ? undefined : json['docs_url'] === null ? null : json['docs_url'],
+        'environmentSync': json['environment_sync'] === undefined ? undefined : json['environment_sync'] === null ? null : json['environment_sync'],
         'homepageUrl': json['homepage_url'] === undefined ? undefined : json['homepage_url'] === null ? null : json['homepage_url'],
         'logoUrl': json['logo_url'] === undefined ? undefined : json['logo_url'] === null ? null : json['logo_url'],
+        'mcpUrl': json['mcp_url'] === undefined ? undefined : json['mcp_url'] === null ? null : json['mcp_url'],
         'providerType': json['provider_type'] == null ? undefined : (0, AgentAgentProviderType_1.AgentAgentProviderTypeFromJSON)(json['provider_type']),
         'permissions': json['permissions'] === undefined ? undefined : json['permissions'] === null ? null : json['permissions'],
         'relationships': json['relationships'] === undefined ? undefined : json['relationships'] === null ? null : (0, RegistryRelationshipsView_1.RegistryRelationshipsViewFromJSON)(json['relationships']),
@@ -111,6 +115,7 @@ function AgentAgentProviderArtifactViewToJSONTyped(value, ignoreDiscriminator =
         return value;
     }
     return {
+        'app': value['app'],
         'artifact_status': value['artifactStatus'],
         'commit_ts': value['commitTs'],
         'content_hash_hex': value['contentHashHex'],
@@ -118,7 +123,6 @@ function AgentAgentProviderArtifactViewToJSONTyped(value, ignoreDiscriminator =
         'created_by': value['createdBy'],
         'description': value['description'],
         'display_name': value['displayName'],
-        'extension': value['extension'],
         'id': value['id'],
         'identity': (0, GatewayArtifactIdentityRevealView_1.GatewayArtifactIdentityRevealViewToJSON)(value['identity']),
         'is_latest': value['isLatest'],
@@ -144,10 +148,14 @@ function AgentAgentProviderArtifactViewToJSONTyped(value, ignoreDiscriminator =
         'version_label': value['versionLabel'],
         'version_ordinal': value['versionOrdinal'],
         'workspace_id': value['workspaceId'],
+        'api_key_secret_id': value['apiKeySecretId'],
         'base_url': value['baseUrl'],
+        'bootstrap_skill_sync': value['bootstrapSkillSync'],
         'docs_url': value['docsUrl'],
+        'environment_sync': value['environmentSync'],
         'homepage_url': value['homepageUrl'],
         'logo_url': value['logoUrl'],
+        'mcp_url': value['mcpUrl'],
         'provider_type': (0, AgentAgentProviderType_1.AgentAgentProviderTypeToJSON)(value['providerType']),
         'permissions': value['permissions'],
         'relationships': (0, RegistryRelationshipsView_1.RegistryRelationshipsViewToJSON)(value['relationships']),