@atlanai/sdk 0.2.2 → 0.2.4

package/dist/raw/mcp/models/McpConnectionState.d.ts

@@ -10,13 +10,14 @@
  * Do not edit the class manually.
  */
 /**
- * How the last connection attempt to a downstream went. `pending` — registered, not yet contacted; `connected` — handshake and tool listing both succeeded; `unreachable` — could not be reached. Set when the server is registered and refreshed by an explicit connectivity test.
+ * How the last connection attempt to a downstream went. `pending` — registered, not yet contacted; `connected` — handshake and tool listing both succeeded; `auth_required` — the downstream answered but refused the credential, so a connected account or linked secret is what it is waiting for; `unreachable` — could not be reached at all. Set when the server is registered and refreshed by an explicit connectivity test.
  * @export
  * @enum {string}
  */
 export declare enum McpConnectionState {
     Pending = "pending",
     Connected = "connected",
+    AuthRequired = "auth_required",
     Unreachable = "unreachable"
 }
 export declare function instanceOfMcpConnectionState(value: any): boolean;

package/dist/raw/mcp/models/McpConnectionState.js

@@ -20,7 +20,7 @@ exports.McpConnectionStateFromJSONTyped = McpConnectionStateFromJSONTyped;
 exports.McpConnectionStateToJSON = McpConnectionStateToJSON;
 exports.McpConnectionStateToJSONTyped = McpConnectionStateToJSONTyped;
 /**
- * How the last connection attempt to a downstream went. `pending` — registered, not yet contacted; `connected` — handshake and tool listing both succeeded; `unreachable` — could not be reached. Set when the server is registered and refreshed by an explicit connectivity test.
+ * How the last connection attempt to a downstream went. `pending` — registered, not yet contacted; `connected` — handshake and tool listing both succeeded; `auth_required` — the downstream answered but refused the credential, so a connected account or linked secret is what it is waiting for; `unreachable` — could not be reached at all. Set when the server is registered and refreshed by an explicit connectivity test.
  * @export
  * @enum {string}
  */
@@ -28,6 +28,7 @@ var McpConnectionState;
 (function (McpConnectionState) {
     McpConnectionState["Pending"] = "pending";
     McpConnectionState["Connected"] = "connected";
+    McpConnectionState["AuthRequired"] = "auth_required";
     McpConnectionState["Unreachable"] = "unreachable";
 })(McpConnectionState || (exports.McpConnectionState = McpConnectionState = {}));
 function instanceOfMcpConnectionState(value) {

package/dist/raw/mcp/models/McpListServers401Response.d.ts

@@ -65,6 +65,7 @@ export declare enum McpListServers401ResponseCodeEnum {
     TokenNotYetValid = "token_not_yet_valid",
     TokenRejected = "token_rejected",
     TokenServiceAccountUnbound = "token_service_account_unbound",
+    Unauthorized = "unauthorized",
     UnknownAccount = "unknown_account",
     UnknownKey = "unknown_key",
     UntrustedIssuer = "untrusted_issuer"

package/dist/raw/mcp/models/McpListServers401Response.js

@@ -39,6 +39,7 @@ var McpListServers401ResponseCodeEnum;
     McpListServers401ResponseCodeEnum["TokenNotYetValid"] = "token_not_yet_valid";
     McpListServers401ResponseCodeEnum["TokenRejected"] = "token_rejected";
     McpListServers401ResponseCodeEnum["TokenServiceAccountUnbound"] = "token_service_account_unbound";
+    McpListServers401ResponseCodeEnum["Unauthorized"] = "unauthorized";
     McpListServers401ResponseCodeEnum["UnknownAccount"] = "unknown_account";
     McpListServers401ResponseCodeEnum["UnknownKey"] = "unknown_key";
     McpListServers401ResponseCodeEnum["UntrustedIssuer"] = "untrusted_issuer";

package/dist/raw/mcp/models/McpServerTestResponse.d.ts

@@ -16,8 +16,19 @@
  */
 export interface McpServerTestResponse {
     /**
-     * `connected` when `initialize` + `tools/list` succeeded under the resolved
-     * credential; `unreachable` when the downstream could not be reached.
+     * One of the `mcp_server` kind's `connection_state` values, and the probe
+     * persists whichever it reports:
+     *
+     * * `connected` — handshake and `tools/list` both succeeded under the
+     *   resolved credential;
+     * * `auth_required` — the downstream answered and refused the credential
+     *   (`401`/`403`), so it is reachable and waiting for a connected account
+     *   or a linked secret;
+     * * `unreachable` — it could not be reached at all, or it handshook and
+     *   then failed to list.
+     *
+     * `auth_required` used to be reported as `unreachable`, which pointed
+     * operators at their network when the problem was a credential.
      * @type {string}
      * @memberof McpServerTestResponse
      */

package/dist/raw/model/models/ModelListProviders401Response.d.ts

@@ -65,6 +65,7 @@ export declare enum ModelListProviders401ResponseCodeEnum {
     TokenNotYetValid = "token_not_yet_valid",
     TokenRejected = "token_rejected",
     TokenServiceAccountUnbound = "token_service_account_unbound",
+    Unauthorized = "unauthorized",
     UnknownAccount = "unknown_account",
     UnknownKey = "unknown_key",
     UntrustedIssuer = "untrusted_issuer"

package/dist/raw/model/models/ModelListProviders401Response.js

@@ -39,6 +39,7 @@ var ModelListProviders401ResponseCodeEnum;
     ModelListProviders401ResponseCodeEnum["TokenNotYetValid"] = "token_not_yet_valid";
     ModelListProviders401ResponseCodeEnum["TokenRejected"] = "token_rejected";
     ModelListProviders401ResponseCodeEnum["TokenServiceAccountUnbound"] = "token_service_account_unbound";
+    ModelListProviders401ResponseCodeEnum["Unauthorized"] = "unauthorized";
     ModelListProviders401ResponseCodeEnum["UnknownAccount"] = "unknown_account";
     ModelListProviders401ResponseCodeEnum["UnknownKey"] = "unknown_key";
     ModelListProviders401ResponseCodeEnum["UntrustedIssuer"] = "untrusted_issuer";

package/dist/raw/registry/apis/WorkspacesApi.d.ts

@@ -13,6 +13,7 @@ import * as runtime from '../runtime';
 import { type CreateWorkspaceBody } from '../models/CreateWorkspaceBody';
 import { type PatchWorkspaceBody } from '../models/PatchWorkspaceBody';
 import { type RegistryWorkspaceView } from '../models/RegistryWorkspaceView';
+import { type SetVisibilityBody } from '../models/SetVisibilityBody';
 import { type WorkspaceArchiveAck } from '../models/WorkspaceArchiveAck';
 import { type WorkspaceBulkCreateRequest } from '../models/WorkspaceBulkCreateRequest';
 import { type WorkspaceExport } from '../models/WorkspaceExport';
@@ -49,6 +50,11 @@ export interface RegistryListWorkspacesRequest {
     include?: string;
     xAtlanConsistencyToken?: string | null;
 }
+export interface RegistrySetWorkspaceVisibilityRequest {
+    workspaceId: string;
+    setVisibilityBody: SetVisibilityBody;
+    contentEncoding?: RegistrySetWorkspaceVisibilityContentEncodingEnum;
+}
 export interface RegistryUpdateWorkspaceRequest {
     workspaceId: string;
     patchWorkspaceBody: PatchWorkspaceBody;
@@ -170,6 +176,20 @@ export declare class WorkspacesApi extends runtime.BaseAPI {
      * List workspaces
      */
     registryListWorkspaces(requestParameters?: RegistryListWorkspacesRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<WorkspacesPage>;
+    /**
+     * Creates request options for registrySetWorkspaceVisibility without sending the request
+     */
+    registrySetWorkspaceVisibilityRequestOpts(requestParameters: RegistrySetWorkspaceVisibilityRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Set a shared-tree workspace to `public` (the account can list and self-join it) or `private` (invisible to non-members, invite-only). The receipt is `manage` — an admin\'s — because visibility is a property of the workspace, like its roster, not of the content in it.  **The funnel holds both ways.** Widening to `public` is refused if the parent is less open (a `422`): a child is never more open than its parent. Restricting to `private` is refused while any immediate child is still `public` (a `422` naming the child); make the children private first, bottom-up.  Refused for a singleton (`org_default` is always public, `user_default` always private) and for a personal-tree workspace, which is private by tree and has no shared-tree visibility to set — both a `409`. Setting the visibility a workspace already has is a no-op `200`.
+     * Change a workspace\'s visibility
+     */
+    registrySetWorkspaceVisibilityRaw(requestParameters: RegistrySetWorkspaceVisibilityRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<RegistryWorkspaceView>>;
+    /**
+     * Set a shared-tree workspace to `public` (the account can list and self-join it) or `private` (invisible to non-members, invite-only). The receipt is `manage` — an admin\'s — because visibility is a property of the workspace, like its roster, not of the content in it.  **The funnel holds both ways.** Widening to `public` is refused if the parent is less open (a `422`): a child is never more open than its parent. Restricting to `private` is refused while any immediate child is still `public` (a `422` naming the child); make the children private first, bottom-up.  Refused for a singleton (`org_default` is always public, `user_default` always private) and for a personal-tree workspace, which is private by tree and has no shared-tree visibility to set — both a `409`. Setting the visibility a workspace already has is a no-op `200`.
+     * Change a workspace\'s visibility
+     */
+    registrySetWorkspaceVisibility(requestParameters: RegistrySetWorkspaceVisibilityRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<RegistryWorkspaceView>;
     /**
      * Creates request options for registryUpdateWorkspace without sending the request
      */
@@ -201,6 +221,14 @@ export declare enum RegistryCreateWorkspaceContentEncodingEnum {
     Base64 = "base64",
     GzipBase64 = "gzip, base64"
 }
+/**
+  * @export
+  * @enum {string}
+  */
+export declare enum RegistrySetWorkspaceVisibilityContentEncodingEnum {
+    Base64 = "base64",
+    GzipBase64 = "gzip, base64"
+}
 /**
   * @export
   * @enum {string}

package/dist/raw/registry/apis/WorkspacesApi.js

@@ -46,11 +46,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RegistryUpdateWorkspaceContentEncodingEnum = exports.RegistryCreateWorkspaceContentEncodingEnum = exports.RegistryBulkCreateWorkspacesContentEncodingEnum = exports.WorkspacesApi = void 0;
+exports.RegistryUpdateWorkspaceContentEncodingEnum = exports.RegistrySetWorkspaceVisibilityContentEncodingEnum = exports.RegistryCreateWorkspaceContentEncodingEnum = exports.RegistryBulkCreateWorkspacesContentEncodingEnum = exports.WorkspacesApi = void 0;
 const runtime = __importStar(require("../runtime"));
 const CreateWorkspaceBody_1 = require("../models/CreateWorkspaceBody");
 const PatchWorkspaceBody_1 = require("../models/PatchWorkspaceBody");
 const RegistryWorkspaceView_1 = require("../models/RegistryWorkspaceView");
+const SetVisibilityBody_1 = require("../models/SetVisibilityBody");
 const WorkspaceArchiveAck_1 = require("../models/WorkspaceArchiveAck");
 const WorkspaceBulkCreateRequest_1 = require("../models/WorkspaceBulkCreateRequest");
 const WorkspaceExport_1 = require("../models/WorkspaceExport");
@@ -414,6 +415,56 @@ class WorkspacesApi extends runtime.BaseAPI {
         const response = await this.registryListWorkspacesRaw(requestParameters, initOverrides);
         return await response.value();
     }
+    /**
+     * Creates request options for registrySetWorkspaceVisibility without sending the request
+     */
+    async registrySetWorkspaceVisibilityRequestOpts(requestParameters) {
+        if (requestParameters['workspaceId'] == null) {
+            throw new runtime.RequiredError('workspaceId', 'Required parameter "workspaceId" was null or undefined when calling registrySetWorkspaceVisibility().');
+        }
+        if (requestParameters['setVisibilityBody'] == null) {
+            throw new runtime.RequiredError('setVisibilityBody', 'Required parameter "setVisibilityBody" was null or undefined when calling registrySetWorkspaceVisibility().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        headerParameters['Content-Type'] = 'application/json';
+        if (requestParameters['contentEncoding'] != null) {
+            headerParameters['Content-Encoding'] = String(requestParameters['contentEncoding']);
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("bearer", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/workspaces/{workspace_id}/visibility`;
+        urlPath = urlPath.replace('{workspace_id}', encodeURIComponent(String(requestParameters['workspaceId'])));
+        return {
+            path: urlPath,
+            method: 'PATCH',
+            headers: headerParameters,
+            query: queryParameters,
+            body: (0, SetVisibilityBody_1.SetVisibilityBodyToJSON)(requestParameters['setVisibilityBody']),
+        };
+    }
+    /**
+     * Set a shared-tree workspace to `public` (the account can list and self-join it) or `private` (invisible to non-members, invite-only). The receipt is `manage` — an admin\'s — because visibility is a property of the workspace, like its roster, not of the content in it.  **The funnel holds both ways.** Widening to `public` is refused if the parent is less open (a `422`): a child is never more open than its parent. Restricting to `private` is refused while any immediate child is still `public` (a `422` naming the child); make the children private first, bottom-up.  Refused for a singleton (`org_default` is always public, `user_default` always private) and for a personal-tree workspace, which is private by tree and has no shared-tree visibility to set — both a `409`. Setting the visibility a workspace already has is a no-op `200`.
+     * Change a workspace\'s visibility
+     */
+    async registrySetWorkspaceVisibilityRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.registrySetWorkspaceVisibilityRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, RegistryWorkspaceView_1.RegistryWorkspaceViewFromJSON)(jsonValue));
+    }
+    /**
+     * Set a shared-tree workspace to `public` (the account can list and self-join it) or `private` (invisible to non-members, invite-only). The receipt is `manage` — an admin\'s — because visibility is a property of the workspace, like its roster, not of the content in it.  **The funnel holds both ways.** Widening to `public` is refused if the parent is less open (a `422`): a child is never more open than its parent. Restricting to `private` is refused while any immediate child is still `public` (a `422` naming the child); make the children private first, bottom-up.  Refused for a singleton (`org_default` is always public, `user_default` always private) and for a personal-tree workspace, which is private by tree and has no shared-tree visibility to set — both a `409`. Setting the visibility a workspace already has is a no-op `200`.
+     * Change a workspace\'s visibility
+     */
+    async registrySetWorkspaceVisibility(requestParameters, initOverrides) {
+        const response = await this.registrySetWorkspaceVisibilityRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
     /**
      * Creates request options for registryUpdateWorkspace without sending the request
      */
@@ -484,6 +535,15 @@ var RegistryCreateWorkspaceContentEncodingEnum;
     RegistryCreateWorkspaceContentEncodingEnum["Base64"] = "base64";
     RegistryCreateWorkspaceContentEncodingEnum["GzipBase64"] = "gzip, base64";
 })(RegistryCreateWorkspaceContentEncodingEnum || (exports.RegistryCreateWorkspaceContentEncodingEnum = RegistryCreateWorkspaceContentEncodingEnum = {}));
+/**
+  * @export
+  * @enum {string}
+  */
+var RegistrySetWorkspaceVisibilityContentEncodingEnum;
+(function (RegistrySetWorkspaceVisibilityContentEncodingEnum) {
+    RegistrySetWorkspaceVisibilityContentEncodingEnum["Base64"] = "base64";
+    RegistrySetWorkspaceVisibilityContentEncodingEnum["GzipBase64"] = "gzip, base64";
+})(RegistrySetWorkspaceVisibilityContentEncodingEnum || (exports.RegistrySetWorkspaceVisibilityContentEncodingEnum = RegistrySetWorkspaceVisibilityContentEncodingEnum = {}));
 /**
   * @export
   * @enum {string}

package/dist/raw/registry/models/CreateWorkspaceBody.d.ts

@@ -41,6 +41,15 @@ export interface CreateWorkspaceBody {
      * @memberof CreateWorkspaceBody
      */
     parentId?: string | null;
+    /**
+     * `public` or `private`. Omitted inherits the parent's visibility — a child of
+     * a public parent defaults public, a child of a private parent defaults
+     * private. An explicit value more open than the parent is a `422`: a child is
+     * never more open than its parent.
+     * @type {string}
+     * @memberof CreateWorkspaceBody
+     */
+    visibility?: string | null;
 }
 /**
  * Check if a given object implements the CreateWorkspaceBody interface.

package/dist/raw/registry/models/CreateWorkspaceBody.js

@@ -38,6 +38,7 @@ function CreateWorkspaceBodyFromJSONTyped(json, ignoreDiscriminator) {
         'displayName': json['display_name'] === undefined ? undefined : json['display_name'] === null ? null : json['display_name'],
         'name': json['name'],
         'parentId': json['parent_id'] === undefined ? undefined : json['parent_id'] === null ? null : json['parent_id'],
+        'visibility': json['visibility'] === undefined ? undefined : json['visibility'] === null ? null : json['visibility'],
     };
 }
 function CreateWorkspaceBodyToJSON(json) {
@@ -52,5 +53,6 @@ function CreateWorkspaceBodyToJSONTyped(value, ignoreDiscriminator = false) {
         'display_name': value['displayName'],
         'name': value['name'],
         'parent_id': value['parentId'],
+        'visibility': value['visibility'],
     };
 }

package/dist/raw/registry/models/RegistryAggregate401Response.d.ts

@@ -65,6 +65,7 @@ export declare enum RegistryAggregate401ResponseCodeEnum {
     TokenNotYetValid = "token_not_yet_valid",
     TokenRejected = "token_rejected",
     TokenServiceAccountUnbound = "token_service_account_unbound",
+    Unauthorized = "unauthorized",
     UnknownAccount = "unknown_account",
     UnknownKey = "unknown_key",
     UntrustedIssuer = "untrusted_issuer"

package/dist/raw/registry/models/RegistryAggregate401Response.js

@@ -39,6 +39,7 @@ var RegistryAggregate401ResponseCodeEnum;
     RegistryAggregate401ResponseCodeEnum["TokenNotYetValid"] = "token_not_yet_valid";
     RegistryAggregate401ResponseCodeEnum["TokenRejected"] = "token_rejected";
     RegistryAggregate401ResponseCodeEnum["TokenServiceAccountUnbound"] = "token_service_account_unbound";
+    RegistryAggregate401ResponseCodeEnum["Unauthorized"] = "unauthorized";
     RegistryAggregate401ResponseCodeEnum["UnknownAccount"] = "unknown_account";
     RegistryAggregate401ResponseCodeEnum["UnknownKey"] = "unknown_key";
     RegistryAggregate401ResponseCodeEnum["UntrustedIssuer"] = "untrusted_issuer";

package/dist/raw/registry/models/RegistryWorkspaceView.d.ts

@@ -147,6 +147,15 @@ export interface RegistryWorkspaceView {
      * @memberof RegistryWorkspaceView
      */
     updatedBy: string;
+    /**
+     * `public` or `private` — how open this shared-tree workspace is: whether the
+     * account can list it and self-join it. Meaningful only when `org_wide` is
+     * true; a personal-tree workspace is always `private`. Set on create (inherits
+     * the parent when omitted) and changed by `PATCH /workspaces/{id}/visibility`.
+     * @type {string}
+     * @memberof RegistryWorkspaceView
+     */
+    visibility: string;
     /**
      * The lifecycle state.
      *

package/dist/raw/registry/models/RegistryWorkspaceView.js

@@ -43,6 +43,8 @@ function instanceOfRegistryWorkspaceView(value) {
         return false;
     if ((!('updatedBy' in value) && !('updated_by' in value)) || (value['updatedBy'] === undefined && value['updated_by'] === undefined))
         return false;
+    if (!('visibility' in value) || value['visibility'] === undefined)
+        return false;
     if ((!('workspaceStatus' in value) && !('workspace_status' in value)) || (value['workspaceStatus'] === undefined && value['workspace_status'] === undefined))
         return false;
     return true;
@@ -72,6 +74,7 @@ function RegistryWorkspaceViewFromJSONTyped(json, ignoreDiscriminator) {
         'rootWorkspaceId': json['root_workspace_id'],
         'updatedAt': json['updated_at'],
         'updatedBy': json['updated_by'],
+        'visibility': json['visibility'],
         'workspaceStatus': json['workspace_status'],
     };
 }
@@ -100,6 +103,7 @@ function RegistryWorkspaceViewToJSONTyped(value, ignoreDiscriminator = false) {
         'root_workspace_id': value['rootWorkspaceId'],
         'updated_at': value['updatedAt'],
         'updated_by': value['updatedBy'],
+        'visibility': value['visibility'],
         'workspace_status': value['workspaceStatus'],
     };
 }

package/dist/raw/registry/models/SearchRequest.d.ts

@@ -133,7 +133,7 @@ export interface SearchRequest {
      */
     queryVector?: Array<number> | null;
     /**
-     * Narrow to one provenance: `git` | `atlan` | `local`.
+     * Narrow to one provenance: `git` | `atlan` | `local` | `external`.
      * @type {string}
      * @memberof SearchRequest
      */

package/dist/raw/registry/models/SetVisibilityBody.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+/**
+ * `PATCH /workspaces/{id}/visibility` body.
+ * @export
+ * @interface SetVisibilityBody
+ */
+export interface SetVisibilityBody {
+    /**
+     * `public` or `private`. Required — this endpoint sets the value outright, so
+     * there is no absent-means-unchanged case a `PATCH` body would otherwise carry.
+     * @type {string}
+     * @memberof SetVisibilityBody
+     */
+    visibility: string;
+}
+/**
+ * Check if a given object implements the SetVisibilityBody interface.
+ */
+export declare function instanceOfSetVisibilityBody(value: object): value is SetVisibilityBody;
+export declare function SetVisibilityBodyFromJSON(json: any): SetVisibilityBody;
+export declare function SetVisibilityBodyFromJSONTyped(json: any, ignoreDiscriminator: boolean): SetVisibilityBody;
+export declare function SetVisibilityBodyToJSON(json: any): SetVisibilityBody;
+export declare function SetVisibilityBodyToJSONTyped(value?: SetVisibilityBody | null, ignoreDiscriminator?: boolean): any;

package/dist/raw/registry/models/SetVisibilityBody.js

@@ -0,0 +1,50 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Atlan Agent Gateway — registry
+ * The platform core: identity, tenancy, the artifact plane, discovery and the policy plane.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceOfSetVisibilityBody = instanceOfSetVisibilityBody;
+exports.SetVisibilityBodyFromJSON = SetVisibilityBodyFromJSON;
+exports.SetVisibilityBodyFromJSONTyped = SetVisibilityBodyFromJSONTyped;
+exports.SetVisibilityBodyToJSON = SetVisibilityBodyToJSON;
+exports.SetVisibilityBodyToJSONTyped = SetVisibilityBodyToJSONTyped;
+/**
+ * Check if a given object implements the SetVisibilityBody interface.
+ */
+function instanceOfSetVisibilityBody(value) {
+    if (!('visibility' in value) || value['visibility'] === undefined)
+        return false;
+    return true;
+}
+function SetVisibilityBodyFromJSON(json) {
+    return SetVisibilityBodyFromJSONTyped(json, false);
+}
+function SetVisibilityBodyFromJSONTyped(json, ignoreDiscriminator) {
+    if (json == null) {
+        return json;
+    }
+    return {
+        'visibility': json['visibility'],
+    };
+}
+function SetVisibilityBodyToJSON(json) {
+    return SetVisibilityBodyToJSONTyped(json, false);
+}
+function SetVisibilityBodyToJSONTyped(value, ignoreDiscriminator = false) {
+    if (value == null) {
+        return value;
+    }
+    return {
+        'visibility': value['visibility'],
+    };
+}

package/dist/raw/registry/models/index.d.ts

@@ -88,6 +88,7 @@ export * from './ServiceAccountDto';
 export * from './ServiceAccountsPage';
 export * from './SetReleasePolicyBody';
 export * from './SetTraceContentPolicyDto';
+export * from './SetVisibilityBody';
 export * from './SlotError';
 export * from './SpanListEnvelope';
 export * from './SpanViewDto';

package/dist/raw/registry/models/index.js

@@ -106,6 +106,7 @@ __exportStar(require("./ServiceAccountDto"), exports);
 __exportStar(require("./ServiceAccountsPage"), exports);
 __exportStar(require("./SetReleasePolicyBody"), exports);
 __exportStar(require("./SetTraceContentPolicyDto"), exports);
+__exportStar(require("./SetVisibilityBody"), exports);
 __exportStar(require("./SlotError"), exports);
 __exportStar(require("./SpanListEnvelope"), exports);
 __exportStar(require("./SpanViewDto"), exports);

package/dist/raw/secret/apis/OauthApi.d.ts

@@ -0,0 +1,143 @@
+/**
+ * secret
+ * Operations provided by secret.
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+import * as runtime from '../runtime';
+import { type GatewayOauthCompleteRequest } from '../models/GatewayOauthCompleteRequest';
+import { type GatewayOauthCompletion } from '../models/GatewayOauthCompletion';
+import { type GatewayOauthConnection } from '../models/GatewayOauthConnection';
+import { type GatewayOauthProviderView } from '../models/GatewayOauthProviderView';
+import { type GatewayOauthStartRequest } from '../models/GatewayOauthStartRequest';
+import { type GatewayOauthStarted } from '../models/GatewayOauthStarted';
+export interface SecretCompleteOauthRequest {
+    gatewayOauthCompleteRequest: GatewayOauthCompleteRequest;
+    contentEncoding?: SecretCompleteOauthContentEncodingEnum;
+}
+export interface SecretDisconnectOauthRequest {
+    secretId: string;
+}
+export interface SecretListOauthConnectionsRequest {
+    provider?: string;
+}
+export interface SecretOauthCallbackRequest {
+    provider: string;
+    code?: string;
+    state?: string;
+    error?: string;
+}
+export interface SecretStartOauthRequest {
+    gatewayOauthStartRequest: GatewayOauthStartRequest;
+    contentEncoding?: SecretStartOauthContentEncodingEnum;
+}
+/**
+ *
+ */
+export declare class OauthApi extends runtime.BaseAPI {
+    /**
+     * Creates request options for secretCompleteOauth without sending the request
+     */
+    secretCompleteOauthRequestOpts(requestParameters: SecretCompleteOauthRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to `POST /<ext>/v1/oauth/complete` — polled until it answers `connected`.
+     * `POST /<ext>/v1/oauth/complete` — polled until it answers `connected`.
+     */
+    secretCompleteOauthRaw(requestParameters: SecretCompleteOauthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GatewayOauthCompletion>>;
+    /**
+     * Use this operation to `POST /<ext>/v1/oauth/complete` — polled until it answers `connected`.
+     * `POST /<ext>/v1/oauth/complete` — polled until it answers `connected`.
+     */
+    secretCompleteOauth(requestParameters: SecretCompleteOauthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GatewayOauthCompletion>;
+    /**
+     * Creates request options for secretDisconnectOauth without sending the request
+     */
+    secretDisconnectOauthRequestOpts(requestParameters: SecretDisconnectOauthRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to `DELETE /<ext>/v1/oauth/connections/{secret_id}`.
+     * `DELETE /<ext>/v1/oauth/connections/{secret_id}`.
+     */
+    secretDisconnectOauthRaw(requestParameters: SecretDisconnectOauthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * Use this operation to `DELETE /<ext>/v1/oauth/connections/{secret_id}`.
+     * `DELETE /<ext>/v1/oauth/connections/{secret_id}`.
+     */
+    secretDisconnectOauth(requestParameters: SecretDisconnectOauthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Creates request options for secretListOauthConnections without sending the request
+     */
+    secretListOauthConnectionsRequestOpts(requestParameters: SecretListOauthConnectionsRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to `GET /<ext>/v1/oauth/connections`.
+     * `GET /<ext>/v1/oauth/connections`.
+     */
+    secretListOauthConnectionsRaw(requestParameters: SecretListOauthConnectionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<GatewayOauthConnection>>>;
+    /**
+     * Use this operation to `GET /<ext>/v1/oauth/connections`.
+     * `GET /<ext>/v1/oauth/connections`.
+     */
+    secretListOauthConnections(requestParameters?: SecretListOauthConnectionsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<GatewayOauthConnection>>;
+    /**
+     * Creates request options for secretListOauthProviders without sending the request
+     */
+    secretListOauthProvidersRequestOpts(): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to `GET /<ext>/v1/oauth/providers` — what can be connected, and the callback URL to register for each.
+     * `GET /<ext>/v1/oauth/providers` — what can be connected, and the callback URL to register for each.
+     */
+    secretListOauthProvidersRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<Array<GatewayOauthProviderView>>>;
+    /**
+     * Use this operation to `GET /<ext>/v1/oauth/providers` — what can be connected, and the callback URL to register for each.
+     * `GET /<ext>/v1/oauth/providers` — what can be connected, and the callback URL to register for each.
+     */
+    secretListOauthProviders(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<Array<GatewayOauthProviderView>>;
+    /**
+     * Creates request options for secretOauthCallback without sending the request
+     */
+    secretOauthCallbackRequestOpts(requestParameters: SecretOauthCallbackRequest): Promise<runtime.RequestOpts>;
+    /**
+     * # Why this one route has no bearer, and what authenticates it instead  The caller here is the user\'s **browser**, arriving from the provider. It carries no Atlan credential and cannot be made to: the redirect target is registered with the provider months earlier and is followed by a plain navigation.  The authenticator is the `state` parameter. It is 32 bytes of system entropy minted by [`crate::flow::random_token`], stored only as its `sha256`, bound at `start` to one org, one subject and one workspace, single-use, and valid for ten minutes. Presenting it proves possession of something only the browser that began this consent received.  **And it is deliberately not sufficient on its own.** This handler does one thing: park the code against the attempt. Every decision that matters — whether the caller may write to that workspace, whose grant this becomes — happens in `complete`, under a verified Atlan bearer that must match the subject recorded at `start`. So a stolen `state` gets an attacker exactly as far as making the legitimate user\'s own connection succeed.  This is the compensating control the anonymous-tail entry needs. The five pre-existing anonymous tails were justified on the grounds that they \"carry no secret: the assets are bytes compiled into the binary, with no data plane behind the handler\" — which is not true here, so the justification has to be this instead, and it has to be the SDK\'s rather than any extension\'s.  The response is a static page: no artifact content, no token, no reflection of any query parameter, and `no-store` so a shared browser does not keep it.
+     * `GET /<ext>/v1/oauth/callback/{provider}` — the provider\'s redirect target.
+     */
+    secretOauthCallbackRaw(requestParameters: SecretOauthCallbackRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
+    /**
+     * # Why this one route has no bearer, and what authenticates it instead  The caller here is the user\'s **browser**, arriving from the provider. It carries no Atlan credential and cannot be made to: the redirect target is registered with the provider months earlier and is followed by a plain navigation.  The authenticator is the `state` parameter. It is 32 bytes of system entropy minted by [`crate::flow::random_token`], stored only as its `sha256`, bound at `start` to one org, one subject and one workspace, single-use, and valid for ten minutes. Presenting it proves possession of something only the browser that began this consent received.  **And it is deliberately not sufficient on its own.** This handler does one thing: park the code against the attempt. Every decision that matters — whether the caller may write to that workspace, whose grant this becomes — happens in `complete`, under a verified Atlan bearer that must match the subject recorded at `start`. So a stolen `state` gets an attacker exactly as far as making the legitimate user\'s own connection succeed.  This is the compensating control the anonymous-tail entry needs. The five pre-existing anonymous tails were justified on the grounds that they \"carry no secret: the assets are bytes compiled into the binary, with no data plane behind the handler\" — which is not true here, so the justification has to be this instead, and it has to be the SDK\'s rather than any extension\'s.  The response is a static page: no artifact content, no token, no reflection of any query parameter, and `no-store` so a shared browser does not keep it.
+     * `GET /<ext>/v1/oauth/callback/{provider}` — the provider\'s redirect target.
+     */
+    secretOauthCallback(requestParameters: SecretOauthCallbackRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
+    /**
+     * Creates request options for secretStartOauth without sending the request
+     */
+    secretStartOauthRequestOpts(requestParameters: SecretStartOauthRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Use this operation to `POST /<ext>/v1/oauth/start`.
+     * `POST /<ext>/v1/oauth/start`.
+     */
+    secretStartOauthRaw(requestParameters: SecretStartOauthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<GatewayOauthStarted>>;
+    /**
+     * Use this operation to `POST /<ext>/v1/oauth/start`.
+     * `POST /<ext>/v1/oauth/start`.
+     */
+    secretStartOauth(requestParameters: SecretStartOauthRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<GatewayOauthStarted>;
+}
+/**
+  * @export
+  * @enum {string}
+  */
+export declare enum SecretCompleteOauthContentEncodingEnum {
+    Base64 = "base64",
+    GzipBase64 = "gzip, base64"
+}
+/**
+  * @export
+  * @enum {string}
+  */
+export declare enum SecretStartOauthContentEncodingEnum {
+    Base64 = "base64",
+    GzipBase64 = "gzip, base64"
+}