@atlanai/sdk 0.2.2 → 0.2.4

package/dist/raw/agent/models/AgentAgentMeta.js

@@ -19,6 +19,7 @@ exports.AgentAgentMetaFromJSONTyped = AgentAgentMetaFromJSONTyped;
 exports.AgentAgentMetaToJSON = AgentAgentMetaToJSON;
 exports.AgentAgentMetaToJSONTyped = AgentAgentMetaToJSONTyped;
 const GatewayToolRef_1 = require("./GatewayToolRef");
+const AgentSyncState_1 = require("./AgentSyncState");
 /**
  * Check if a given object implements the AgentAgentMeta interface.
  */
@@ -40,6 +41,12 @@ function AgentAgentMetaFromJSONTyped(json, ignoreDiscriminator) {
         'maxStepCount': json['max_step_count'] == null ? undefined : json['max_step_count'],
         'modelId': json['model_id'] === undefined ? undefined : json['model_id'] === null ? null : json['model_id'],
         'publicUrl': json['public_url'] === undefined ? undefined : json['public_url'] === null ? null : json['public_url'],
+        'remoteAgentId': json['remote_agent_id'] === undefined ? undefined : json['remote_agent_id'] === null ? null : json['remote_agent_id'],
+        'remoteVaultId': json['remote_vault_id'] === undefined ? undefined : json['remote_vault_id'] === null ? null : json['remote_vault_id'],
+        'remoteVersionOrdinal': json['remote_version_ordinal'] === undefined ? undefined : json['remote_version_ordinal'] === null ? null : json['remote_version_ordinal'],
+        'syncError': json['sync_error'] === undefined ? undefined : json['sync_error'] === null ? null : json['sync_error'],
+        'syncState': json['sync_state'] === undefined ? undefined : json['sync_state'] === null ? null : (0, AgentSyncState_1.AgentSyncStateFromJSON)(json['sync_state']),
+        'syncedSpecHash': json['synced_spec_hash'] === undefined ? undefined : json['synced_spec_hash'] === null ? null : json['synced_spec_hash'],
         'tools': json['tools'] == null ? undefined : (json['tools'].map(GatewayToolRef_1.GatewayToolRefFromJSON)),
     };
 }
@@ -58,6 +65,12 @@ function AgentAgentMetaToJSONTyped(value, ignoreDiscriminator = false) {
         'max_step_count': value['maxStepCount'],
         'model_id': value['modelId'],
         'public_url': value['publicUrl'],
+        'remote_agent_id': value['remoteAgentId'],
+        'remote_vault_id': value['remoteVaultId'],
+        'remote_version_ordinal': value['remoteVersionOrdinal'],
+        'sync_error': value['syncError'],
+        'sync_state': (0, AgentSyncState_1.AgentSyncStateToJSON)(value['syncState']),
+        'synced_spec_hash': value['syncedSpecHash'],
         'tools': value['tools'] == null ? undefined : (value['tools'].map(GatewayToolRef_1.GatewayToolRefToJSON)),
     };
 }

package/dist/raw/agent/models/AgentAgentProviderArtifactView.d.ts

@@ -254,18 +254,55 @@ export interface AgentAgentProviderArtifactView {
      */
     workspaceId: string;
     /**
-     * The system's API base, for a console to link to and an operator to
-     * recognize. Reference only — never dereferenced server-side.
+     * The `secret` artifact holding the provider's API key.
+     *
+     * A reference, never a value — the `model_provider.secret_ref` pattern. It is
+     * resolved at the run-trigger through `Secret.Reveal` with the caller's own
+     * bearer, so reading it is tenancy-scoped exactly as any other secret read is,
+     * and the value never lands in a column, a log, or this artifact's view.
+     *
+     * Schema-optional but **required on a `claude_managed` row**, and refused on
+     * the others. Schema validation runs before the hook, so a schema-required
+     * declaration would 422 every `local` provider with a message naming a field
+     * that row must not have; the hook can name the field, the type, and why.
+     * @type {string}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    apiKeySecretId?: string | null;
+    /**
+     * The system's API base.
+     *
+     * For a `local`/`custom` row this is reference material a console links to
+     * and an operator recognizes, never dereferenced. For a `claude_managed` row
+     * it is **the address the gateway actually calls**, defaulting to
+     * [`crate::sync::DEFAULT_CMA_BASE`] when unset — which is why the write hook
+     * SSRF-validates it on that type and only scheme-checks it on the others.
+     * The two postures cannot be collapsed: refusing an internal address on a
+     * catalog row would reject a customer correctly recording their own VPC
+     * endpoint, and allowing one on a dialed row would make provider-write an
+     * SSRF primitive against our egress.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
     baseUrl?: string | null;
+    /**
+     *
+     * @type {any}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    bootstrapSkillSync?: any | null;
     /**
      * Documentation URL. Same validation as `logo_url`.
      * @type {string}
      * @memberof AgentAgentProviderArtifactView
      */
     docsUrl?: string | null;
+    /**
+     *
+     * @type {any}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    environmentSync?: any | null;
     /**
      * Homepage. Same validation as `logo_url`.
      * @type {string}
@@ -280,6 +317,22 @@ export interface AgentAgentProviderArtifactView {
      * @memberof AgentAgentProviderArtifactView
      */
     logoUrl?: string | null;
+    /**
+     * The gateway's **public** `/mcp` aggregator URL the remote run connects back
+     * into. Same required-on-`claude_managed`, refused-elsewhere rule as
+     * `api_key_secret_id`.
+     *
+     * It cannot be derived from the internal peer env — the value has to be
+     * reachable from Anthropic's network, not from inside our cluster — so the
+     * provider row carries it. **SSRF-validated at write**, because unlike every
+     * other URL on this kind it is dereferenced: a run we triggered fetches it.
+     * The check is defense-in-depth rather than the control (DNS moves between
+     * write and call, LIMITATIONS L14); what makes the credential safe is that the
+     * vault token is the agent's own machine identity and nothing else.
+     * @type {string}
+     * @memberof AgentAgentProviderArtifactView
+     */
+    mcpUrl?: string | null;
     /**
      *
      * @type {AgentAgentProviderType}

package/dist/raw/agent/models/AgentAgentProviderArtifactView.js

@@ -94,10 +94,14 @@ function AgentAgentProviderArtifactViewFromJSONTyped(json, ignoreDiscriminator)
         'versionLabel': json['version_label'] == null ? undefined : json['version_label'],
         'versionOrdinal': json['version_ordinal'],
         'workspaceId': json['workspace_id'],
+        'apiKeySecretId': json['api_key_secret_id'] === undefined ? undefined : json['api_key_secret_id'] === null ? null : json['api_key_secret_id'],
         'baseUrl': json['base_url'] === undefined ? undefined : json['base_url'] === null ? null : json['base_url'],
+        'bootstrapSkillSync': json['bootstrap_skill_sync'] === undefined ? undefined : json['bootstrap_skill_sync'] === null ? null : json['bootstrap_skill_sync'],
         'docsUrl': json['docs_url'] === undefined ? undefined : json['docs_url'] === null ? null : json['docs_url'],
+        'environmentSync': json['environment_sync'] === undefined ? undefined : json['environment_sync'] === null ? null : json['environment_sync'],
         'homepageUrl': json['homepage_url'] === undefined ? undefined : json['homepage_url'] === null ? null : json['homepage_url'],
         'logoUrl': json['logo_url'] === undefined ? undefined : json['logo_url'] === null ? null : json['logo_url'],
+        'mcpUrl': json['mcp_url'] === undefined ? undefined : json['mcp_url'] === null ? null : json['mcp_url'],
         'providerType': json['provider_type'] == null ? undefined : (0, AgentAgentProviderType_1.AgentAgentProviderTypeFromJSON)(json['provider_type']),
         'permissions': json['permissions'] === undefined ? undefined : json['permissions'] === null ? null : json['permissions'],
         'relationships': json['relationships'] === undefined ? undefined : json['relationships'] === null ? null : (0, RegistryRelationshipsView_1.RegistryRelationshipsViewFromJSON)(json['relationships']),
@@ -144,10 +148,14 @@ function AgentAgentProviderArtifactViewToJSONTyped(value, ignoreDiscriminator =
         'version_label': value['versionLabel'],
         'version_ordinal': value['versionOrdinal'],
         'workspace_id': value['workspaceId'],
+        'api_key_secret_id': value['apiKeySecretId'],
         'base_url': value['baseUrl'],
+        'bootstrap_skill_sync': value['bootstrapSkillSync'],
         'docs_url': value['docsUrl'],
+        'environment_sync': value['environmentSync'],
         'homepage_url': value['homepageUrl'],
         'logo_url': value['logoUrl'],
+        'mcp_url': value['mcpUrl'],
         'provider_type': (0, AgentAgentProviderType_1.AgentAgentProviderTypeToJSON)(value['providerType']),
         'permissions': value['permissions'],
         'relationships': (0, RegistryRelationshipsView_1.RegistryRelationshipsViewToJSON)(value['relationships']),

package/dist/raw/agent/models/AgentAgentProviderCreate.d.ts

@@ -11,8 +11,12 @@
  */
 import type { AgentAgentProviderType } from './AgentAgentProviderType';
 /**
- * The caller-writable surface of a new agent provider. Every field is display or
- * reference material: nothing here is dialed.
+ * The caller-writable surface of a new agent provider.
+ *
+ * `bootstrap_skill_sync` and `environment_sync` are deliberately absent: both are
+ * hook-owned, and a caller
+ * who could write it would make every agent pushed to this provider pin a skill
+ * of their choosing.
  * @export
  * @interface AgentAgentProviderCreate
  */
@@ -132,7 +136,17 @@ export interface AgentAgentProviderCreate {
      */
     workspaceId: string;
     /**
-     * The system's API base, for a console to link to. Reference only.
+     * The `secret` artifact holding the provider's API key. **Required on a
+     * `claude_managed` provider and refused on the others** — a reference, never a
+     * value.
+     * @type {string}
+     * @memberof AgentAgentProviderCreate
+     */
+    apiKeySecretId?: string | null;
+    /**
+     * The system's API base. Reference material for `local`/`custom`; the address
+     * the gateway calls for `claude_managed`, defaulting to the provider's own
+     * public endpoint when unset.
      * @type {string}
      * @memberof AgentAgentProviderCreate
      */
@@ -155,6 +169,13 @@ export interface AgentAgentProviderCreate {
      * @memberof AgentAgentProviderCreate
      */
     logoUrl?: string | null;
+    /**
+     * The gateway's public `/mcp` URL a delegated run connects back into. Same
+     * required-on-`claude_managed`, refused-elsewhere rule as `api_key_secret_id`.
+     * @type {string}
+     * @memberof AgentAgentProviderCreate
+     */
+    mcpUrl?: string | null;
     /**
      *
      * @type {AgentAgentProviderType}

package/dist/raw/agent/models/AgentAgentProviderCreate.js

@@ -56,10 +56,12 @@ function AgentAgentProviderCreateFromJSONTyped(json, ignoreDiscriminator) {
         'projectId': json['project_id'] == null ? undefined : json['project_id'],
         'repoId': json['repo_id'] == null ? undefined : json['repo_id'],
         'workspaceId': json['workspace_id'],
+        'apiKeySecretId': json['api_key_secret_id'] === undefined ? undefined : json['api_key_secret_id'] === null ? null : json['api_key_secret_id'],
         'baseUrl': json['base_url'] === undefined ? undefined : json['base_url'] === null ? null : json['base_url'],
         'docsUrl': json['docs_url'] === undefined ? undefined : json['docs_url'] === null ? null : json['docs_url'],
         'homepageUrl': json['homepage_url'] === undefined ? undefined : json['homepage_url'] === null ? null : json['homepage_url'],
         'logoUrl': json['logo_url'] === undefined ? undefined : json['logo_url'] === null ? null : json['logo_url'],
+        'mcpUrl': json['mcp_url'] === undefined ? undefined : json['mcp_url'] === null ? null : json['mcp_url'],
         'providerType': (0, AgentAgentProviderType_1.AgentAgentProviderTypeFromJSON)(json['provider_type']),
     };
 }
@@ -88,10 +90,12 @@ function AgentAgentProviderCreateToJSONTyped(value, ignoreDiscriminator = false)
         'project_id': value['projectId'],
         'repo_id': value['repoId'],
         'workspace_id': value['workspaceId'],
+        'api_key_secret_id': value['apiKeySecretId'],
         'base_url': value['baseUrl'],
         'docs_url': value['docsUrl'],
         'homepage_url': value['homepageUrl'],
         'logo_url': value['logoUrl'],
+        'mcp_url': value['mcpUrl'],
         'provider_type': (0, AgentAgentProviderType_1.AgentAgentProviderTypeToJSON)(value['providerType']),
     };
 }

package/dist/raw/agent/models/AgentAgentProviderMeta.d.ts

@@ -11,34 +11,61 @@
  */
 import type { AgentAgentProviderType } from './AgentAgentProviderType';
 /**
- * The `agent_provider` kind — a customer-owned entry naming where their agents
- * run, mirroring the secret extension's `secret_provider` and the model
- * extension's `model_provider`.
- *
- * Every field is display or reference material. There is no credential and no
- * callback URL, because nothing here is dialed: the gateway catalogs a provider,
- * the customer runs the agent. That is the whole difference from the
- * `claude_managed` substrate this kind used to describe.
- *
- * Nothing seeds a provider — which system a tenant runs on is tenant policy, not
- * gateway policy — so there is no `system` flag and no system pin.
+ * Published representation of AgentProviderMeta.
  * @export
  * @interface AgentAgentProviderMeta
  */
 export interface AgentAgentProviderMeta {
     /**
-     * The system's API base, for a console to link to and an operator to
-     * recognize. Reference only — never dereferenced server-side.
+     * The `secret` artifact holding the provider's API key.
+     *
+     * A reference, never a value — the `model_provider.secret_ref` pattern. It is
+     * resolved at the run-trigger through `Secret.Reveal` with the caller's own
+     * bearer, so reading it is tenancy-scoped exactly as any other secret read is,
+     * and the value never lands in a column, a log, or this artifact's view.
+     *
+     * Schema-optional but **required on a `claude_managed` row**, and refused on
+     * the others. Schema validation runs before the hook, so a schema-required
+     * declaration would 422 every `local` provider with a message naming a field
+     * that row must not have; the hook can name the field, the type, and why.
+     * @type {string}
+     * @memberof AgentAgentProviderMeta
+     */
+    apiKeySecretId?: string | null;
+    /**
+     * The system's API base.
+     *
+     * For a `local`/`custom` row this is reference material a console links to
+     * and an operator recognizes, never dereferenced. For a `claude_managed` row
+     * it is **the address the gateway actually calls**, defaulting to
+     * [`crate::sync::DEFAULT_CMA_BASE`] when unset — which is why the write hook
+     * SSRF-validates it on that type and only scheme-checks it on the others.
+     * The two postures cannot be collapsed: refusing an internal address on a
+     * catalog row would reject a customer correctly recording their own VPC
+     * endpoint, and allowing one on a dialed row would make provider-write an
+     * SSRF primitive against our egress.
      * @type {string}
      * @memberof AgentAgentProviderMeta
      */
     baseUrl?: string | null;
+    /**
+     *
+     * @type {any}
+     * @memberof AgentAgentProviderMeta
+     */
+    bootstrapSkillSync?: any | null;
     /**
      * Documentation URL. Same validation as `logo_url`.
      * @type {string}
      * @memberof AgentAgentProviderMeta
      */
     docsUrl?: string | null;
+    /**
+     *
+     * @type {any}
+     * @memberof AgentAgentProviderMeta
+     */
+    environmentSync?: any | null;
     /**
      * Homepage. Same validation as `logo_url`.
      * @type {string}
@@ -53,6 +80,22 @@ export interface AgentAgentProviderMeta {
      * @memberof AgentAgentProviderMeta
      */
     logoUrl?: string | null;
+    /**
+     * The gateway's **public** `/mcp` aggregator URL the remote run connects back
+     * into. Same required-on-`claude_managed`, refused-elsewhere rule as
+     * `api_key_secret_id`.
+     *
+     * It cannot be derived from the internal peer env — the value has to be
+     * reachable from Anthropic's network, not from inside our cluster — so the
+     * provider row carries it. **SSRF-validated at write**, because unlike every
+     * other URL on this kind it is dereferenced: a run we triggered fetches it.
+     * The check is defense-in-depth rather than the control (DNS moves between
+     * write and call, LIMITATIONS L14); what makes the credential safe is that the
+     * vault token is the agent's own machine identity and nothing else.
+     * @type {string}
+     * @memberof AgentAgentProviderMeta
+     */
+    mcpUrl?: string | null;
     /**
      *
      * @type {AgentAgentProviderType}

package/dist/raw/agent/models/AgentAgentProviderMeta.js

@@ -35,10 +35,14 @@ function AgentAgentProviderMetaFromJSONTyped(json, ignoreDiscriminator) {
         return json;
     }
     return {
+        'apiKeySecretId': json['api_key_secret_id'] === undefined ? undefined : json['api_key_secret_id'] === null ? null : json['api_key_secret_id'],
         'baseUrl': json['base_url'] === undefined ? undefined : json['base_url'] === null ? null : json['base_url'],
+        'bootstrapSkillSync': json['bootstrap_skill_sync'] === undefined ? undefined : json['bootstrap_skill_sync'] === null ? null : json['bootstrap_skill_sync'],
         'docsUrl': json['docs_url'] === undefined ? undefined : json['docs_url'] === null ? null : json['docs_url'],
+        'environmentSync': json['environment_sync'] === undefined ? undefined : json['environment_sync'] === null ? null : json['environment_sync'],
         'homepageUrl': json['homepage_url'] === undefined ? undefined : json['homepage_url'] === null ? null : json['homepage_url'],
         'logoUrl': json['logo_url'] === undefined ? undefined : json['logo_url'] === null ? null : json['logo_url'],
+        'mcpUrl': json['mcp_url'] === undefined ? undefined : json['mcp_url'] === null ? null : json['mcp_url'],
         'providerType': (0, AgentAgentProviderType_1.AgentAgentProviderTypeFromJSON)(json['provider_type']),
     };
 }
@@ -50,10 +54,14 @@ function AgentAgentProviderMetaToJSONTyped(value, ignoreDiscriminator = false) {
         return value;
     }
     return {
+        'api_key_secret_id': value['apiKeySecretId'],
         'base_url': value['baseUrl'],
+        'bootstrap_skill_sync': value['bootstrapSkillSync'],
         'docs_url': value['docsUrl'],
+        'environment_sync': value['environmentSync'],
         'homepage_url': value['homepageUrl'],
         'logo_url': value['logoUrl'],
+        'mcp_url': value['mcpUrl'],
         'provider_type': (0, AgentAgentProviderType_1.AgentAgentProviderTypeToJSON)(value['providerType']),
     };
 }

package/dist/raw/agent/models/AgentAgentProviderPatch.d.ts

@@ -17,6 +17,13 @@
  * @interface AgentAgentProviderPatch
  */
 export interface AgentAgentProviderPatch {
+    /**
+     * Re-point the provider at a different API-key `secret`. Still refused on a
+     * `local`/`custom` row, whose type cannot change.
+     * @type {string}
+     * @memberof AgentAgentProviderPatch
+     */
+    apiKeySecretId?: string | null;
     /**
      * Value of the `base_url` field.
      * @type {string}
@@ -53,6 +60,12 @@ export interface AgentAgentProviderPatch {
      * @memberof AgentAgentProviderPatch
      */
     logoUrl?: string | null;
+    /**
+     * Update the gateway `/mcp` URL delegated runs connect back into.
+     * @type {string}
+     * @memberof AgentAgentProviderPatch
+     */
+    mcpUrl?: string | null;
     /**
      * Stable machine-readable name.
      * @type {string}

package/dist/raw/agent/models/AgentAgentProviderPatch.js

@@ -32,12 +32,14 @@ function AgentAgentProviderPatchFromJSONTyped(json, ignoreDiscriminator) {
         return json;
     }
     return {
+        'apiKeySecretId': json['api_key_secret_id'] === undefined ? undefined : json['api_key_secret_id'] === null ? null : json['api_key_secret_id'],
         'baseUrl': json['base_url'] === undefined ? undefined : json['base_url'] === null ? null : json['base_url'],
         'description': json['description'] === undefined ? undefined : json['description'] === null ? null : json['description'],
         'displayName': json['display_name'] === undefined ? undefined : json['display_name'] === null ? null : json['display_name'],
         'docsUrl': json['docs_url'] === undefined ? undefined : json['docs_url'] === null ? null : json['docs_url'],
         'homepageUrl': json['homepage_url'] === undefined ? undefined : json['homepage_url'] === null ? null : json['homepage_url'],
         'logoUrl': json['logo_url'] === undefined ? undefined : json['logo_url'] === null ? null : json['logo_url'],
+        'mcpUrl': json['mcp_url'] === undefined ? undefined : json['mcp_url'] === null ? null : json['mcp_url'],
         'name': json['name'] === undefined ? undefined : json['name'] === null ? null : json['name'],
     };
 }
@@ -49,12 +51,14 @@ function AgentAgentProviderPatchToJSONTyped(value, ignoreDiscriminator = false)
         return value;
     }
     return {
+        'api_key_secret_id': value['apiKeySecretId'],
         'base_url': value['baseUrl'],
         'description': value['description'],
         'display_name': value['displayName'],
         'docs_url': value['docsUrl'],
         'homepage_url': value['homepageUrl'],
         'logo_url': value['logoUrl'],
+        'mcp_url': value['mcpUrl'],
         'name': value['name'],
     };
 }

package/dist/raw/agent/models/AgentAgentProviderType.d.ts

@@ -13,21 +13,31 @@
  * Where a customer runs their agents. Promoted to the indexed `provider_type`
  * `CHECK` column; doc-comment-free per variant.
  *
- * Both variants are catalog-only — the gateway records where an agent runs, it
- * does not run one (agent-2026-08-06-customer-owned-providers). They are not
- * redundant with an absent `agent_provider_id`, which means the execution home
- * is simply *unknown*; a `local` row is a named, describable place ("the analyst
- * laptops") a session can point at and a console can group by.
+ * `local` and `custom` are catalog-only — the gateway records where an agent
+ * runs and dials nothing. They are not redundant with an absent
+ * `agent_provider_id`, which means the execution home is simply *unknown*; a
+ * `local` row is a named, describable place ("the analyst laptops") a session
+ * can point at and a console can group by.
  *
- * Widening this list is a free boot `CHECK` reconcile, no migration. Narrowing
- * it aborts the boot if any row still holds the removed value, so the set is
- * effectively append-only.
+ * `claude_managed` is the one variant the gateway *does* dial: Anthropic's
+ * hosted Claude Managed Agents runtime. A row of that type carries the
+ * connection fields the other two refuse to
+ * ([`AgentProviderMeta::api_key_secret_id`], [`AgentProviderMeta::mcp_url`]),
+ * and the gateway pushes the agent spec to it at the run-trigger. The catalog
+ * stance the other two variants encode is unchanged — it is now the *default*
+ * rather than the only option (agent-2026-09-15-claude-managed-restored,
+ * which partially supersedes agent-2026-08-06-customer-owned-providers).
+ *
+ * Widening this list is one `SetEnumValues` migration step. Narrowing it aborts
+ * the boot if any row still holds the removed value, so the set is effectively
+ * append-only.
  * @export
  * @enum {string}
  */
 export declare enum AgentAgentProviderType {
     Local = "local",
-    Custom = "custom"
+    Custom = "custom",
+    ClaudeManaged = "claude_managed"
 }
 export declare function instanceOfAgentAgentProviderType(value: any): boolean;
 export declare function AgentAgentProviderTypeFromJSON(json: any): AgentAgentProviderType;

package/dist/raw/agent/models/AgentAgentProviderType.js

@@ -23,15 +23,24 @@ exports.AgentAgentProviderTypeToJSONTyped = AgentAgentProviderTypeToJSONTyped;
  * Where a customer runs their agents. Promoted to the indexed `provider_type`
  * `CHECK` column; doc-comment-free per variant.
  *
- * Both variants are catalog-only — the gateway records where an agent runs, it
- * does not run one (agent-2026-08-06-customer-owned-providers). They are not
- * redundant with an absent `agent_provider_id`, which means the execution home
- * is simply *unknown*; a `local` row is a named, describable place ("the analyst
- * laptops") a session can point at and a console can group by.
+ * `local` and `custom` are catalog-only — the gateway records where an agent
+ * runs and dials nothing. They are not redundant with an absent
+ * `agent_provider_id`, which means the execution home is simply *unknown*; a
+ * `local` row is a named, describable place ("the analyst laptops") a session
+ * can point at and a console can group by.
  *
- * Widening this list is a free boot `CHECK` reconcile, no migration. Narrowing
- * it aborts the boot if any row still holds the removed value, so the set is
- * effectively append-only.
+ * `claude_managed` is the one variant the gateway *does* dial: Anthropic's
+ * hosted Claude Managed Agents runtime. A row of that type carries the
+ * connection fields the other two refuse to
+ * ([`AgentProviderMeta::api_key_secret_id`], [`AgentProviderMeta::mcp_url`]),
+ * and the gateway pushes the agent spec to it at the run-trigger. The catalog
+ * stance the other two variants encode is unchanged — it is now the *default*
+ * rather than the only option (agent-2026-09-15-claude-managed-restored,
+ * which partially supersedes agent-2026-08-06-customer-owned-providers).
+ *
+ * Widening this list is one `SetEnumValues` migration step. Narrowing it aborts
+ * the boot if any row still holds the removed value, so the set is effectively
+ * append-only.
  * @export
  * @enum {string}
  */
@@ -39,6 +48,7 @@ var AgentAgentProviderType;
 (function (AgentAgentProviderType) {
     AgentAgentProviderType["Local"] = "local";
     AgentAgentProviderType["Custom"] = "custom";
+    AgentAgentProviderType["ClaudeManaged"] = "claude_managed";
 })(AgentAgentProviderType || (exports.AgentAgentProviderType = AgentAgentProviderType = {}));
 function instanceOfAgentAgentProviderType(value) {
     for (const key in AgentAgentProviderType) {

package/dist/raw/agent/models/AgentListAgentFrameworks401Response.d.ts

@@ -65,6 +65,7 @@ export declare enum AgentListAgentFrameworks401ResponseCodeEnum {
     TokenNotYetValid = "token_not_yet_valid",
     TokenRejected = "token_rejected",
     TokenServiceAccountUnbound = "token_service_account_unbound",
+    Unauthorized = "unauthorized",
     UnknownAccount = "unknown_account",
     UnknownKey = "unknown_key",
     UntrustedIssuer = "untrusted_issuer"

package/dist/raw/agent/models/AgentListAgentFrameworks401Response.js

@@ -39,6 +39,7 @@ var AgentListAgentFrameworks401ResponseCodeEnum;
     AgentListAgentFrameworks401ResponseCodeEnum["TokenNotYetValid"] = "token_not_yet_valid";
     AgentListAgentFrameworks401ResponseCodeEnum["TokenRejected"] = "token_rejected";
     AgentListAgentFrameworks401ResponseCodeEnum["TokenServiceAccountUnbound"] = "token_service_account_unbound";
+    AgentListAgentFrameworks401ResponseCodeEnum["Unauthorized"] = "unauthorized";
     AgentListAgentFrameworks401ResponseCodeEnum["UnknownAccount"] = "unknown_account";
     AgentListAgentFrameworks401ResponseCodeEnum["UnknownKey"] = "unknown_key";
     AgentListAgentFrameworks401ResponseCodeEnum["UntrustedIssuer"] = "untrusted_issuer";

package/dist/raw/agent/models/AgentPageSessionEventView.d.ts

@@ -9,7 +9,7 @@
  * https://openapi-generator.tech
  * Do not edit the class manually.
  */
-import type { Box } from './Box';
+import type { AgentSessionEventView } from './AgentSessionEventView';
 import type { GatewayPageMeta } from './GatewayPageMeta';
 /**
  * A page of session events — the `{items, page}` envelope over
@@ -20,10 +20,10 @@ import type { GatewayPageMeta } from './GatewayPageMeta';
 export interface AgentPageSessionEventView {
     /**
      * Items in this result.
-     * @type {Array<Box>}
+     * @type {Array<AgentSessionEventView>}
      * @memberof AgentPageSessionEventView
      */
-    items: Array<Box>;
+    items: Array<AgentSessionEventView>;
     /**
      *
      * @type {GatewayPageMeta}

package/dist/raw/agent/models/AgentPageSessionEventView.js

@@ -18,7 +18,7 @@ exports.AgentPageSessionEventViewFromJSON = AgentPageSessionEventViewFromJSON;
 exports.AgentPageSessionEventViewFromJSONTyped = AgentPageSessionEventViewFromJSONTyped;
 exports.AgentPageSessionEventViewToJSON = AgentPageSessionEventViewToJSON;
 exports.AgentPageSessionEventViewToJSONTyped = AgentPageSessionEventViewToJSONTyped;
-const Box_1 = require("./Box");
+const AgentSessionEventView_1 = require("./AgentSessionEventView");
 const GatewayPageMeta_1 = require("./GatewayPageMeta");
 /**
  * Check if a given object implements the AgentPageSessionEventView interface.
@@ -38,7 +38,7 @@ function AgentPageSessionEventViewFromJSONTyped(json, ignoreDiscriminator) {
         return json;
     }
     return {
-        'items': (json['items'].map(Box_1.BoxFromJSON)),
+        'items': (json['items'].map(AgentSessionEventView_1.AgentSessionEventViewFromJSON)),
         'page': (0, GatewayPageMeta_1.GatewayPageMetaFromJSON)(json['page']),
     };
 }
@@ -50,7 +50,7 @@ function AgentPageSessionEventViewToJSONTyped(value, ignoreDiscriminator = false
         return value;
     }
     return {
-        'items': (value['items'].map(Box_1.BoxToJSON)),
+        'items': (value['items'].map(AgentSessionEventView_1.AgentSessionEventViewToJSON)),
         'page': (0, GatewayPageMeta_1.GatewayPageMetaToJSON)(value['page']),
     };
 }

package/dist/raw/agent/models/AgentRemoteSessionEvent.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Harness and agent catalog
+ * A `harness` is a tool a human drives; an `agent` is built with an `agent_framework` and run on an `agent_provider`. The gateway executes neither. This surface is the typed catalog for both — plus the `agent_framework` and `harness_vendor` catalogs, the `agent_provider` substrate, the `agent_environment` sandbox, and the `session`/`session_message` run history — the one agent run-trigger, live session reads (poll + SSE), and the access-controlled trace facade.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+/**
+ * A provider-native session event preserved without field normalization.
+ * @export
+ * @interface AgentRemoteSessionEvent
+ */
+export interface AgentRemoteSessionEvent {
+    /**
+     * The provider-assigned event identifier.
+     * @type {string}
+     * @memberof AgentRemoteSessionEvent
+     */
+    id?: string;
+    /**
+     * The provider-owned event discriminator.
+     * @type {string}
+     * @memberof AgentRemoteSessionEvent
+     */
+    type?: string;
+}
+/**
+ * Check if a given object implements the AgentRemoteSessionEvent interface.
+ */
+export declare function instanceOfAgentRemoteSessionEvent(value: object): value is AgentRemoteSessionEvent;
+export declare function AgentRemoteSessionEventFromJSON(json: any): AgentRemoteSessionEvent;
+export declare function AgentRemoteSessionEventFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentRemoteSessionEvent;
+export declare function AgentRemoteSessionEventToJSON(json: any): AgentRemoteSessionEvent;
+export declare function AgentRemoteSessionEventToJSONTyped(value?: AgentRemoteSessionEvent | null, ignoreDiscriminator?: boolean): any;