@barndoor-ai/sdk 2.2.0 → 2.12.0

package/dist/esm/apis/PolicyApi.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
@@ -26,6 +26,7 @@ import { PolicyRevisionCompareResponseFromJSON, } from '../models/PolicyRevision
 import { PolicyRevisionDetailResponseFromJSON, } from '../models/PolicyRevisionDetailResponse.js';
 import { PolicyRuleInputToJSON, } from '../models/PolicyRuleInput.js';
 import { PolicySummaryResponseFromJSON, } from '../models/PolicySummaryResponse.js';
+import { ServerPolicyRevisionsPageFromJSON, } from '../models/ServerPolicyRevisionsPage.js';
 import { UpdatePolicyToJSON, } from '../models/UpdatePolicy.js';
 import { ValidatePolicyRequestToJSON, } from '../models/ValidatePolicyRequest.js';
 import { ValidatePolicyResponseFromJSON, } from '../models/ValidatePolicyResponse.js';
@@ -983,6 +984,73 @@ export class PolicyApi extends runtime.BaseAPI {
         const response = await this.listPolicyRevisionsRaw(requestParameters, initOverrides);
         return await response.value();
     }
+    /**
+     * Creates request options for listServerPolicyRevisions without sending the request
+     */
+    async listServerPolicyRevisionsRequestOpts(requestParameters) {
+        if (requestParameters['mcpServerId'] == null) {
+            throw new runtime.RequiredError('mcpServerId', 'Required parameter "mcpServerId" was null or undefined when calling listServerPolicyRevisions().');
+        }
+        const queryParameters = {};
+        if (requestParameters['mcpServerId'] != null) {
+            queryParameters['mcp_server_id'] = requestParameters['mcpServerId'];
+        }
+        if (requestParameters['limit'] != null) {
+            queryParameters['limit'] = requestParameters['limit'];
+        }
+        if (requestParameters['cursor'] != null) {
+            queryParameters['cursor'] = requestParameters['cursor'];
+        }
+        if (requestParameters['since'] != null) {
+            queryParameters['since'] = runtime.serializeDateTime(requestParameters['since']);
+        }
+        const headerParameters = {};
+        if (this.configuration && this.configuration.accessToken) {
+            // oauth required
+            const oauthToken = await this.configuration.accessToken("OAuth2", ["openid", "profile", "email"]);
+            if (oauthToken) {
+                headerParameters["Authorization"] = oauthToken.startsWith("Bearer ") ? oauthToken : `Bearer ${oauthToken}`;
+            }
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            // oauth required
+            const oauthToken = await this.configuration.accessToken("OAuth2", ["openid", "profile", "email"]);
+            if (oauthToken) {
+                headerParameters["Authorization"] = oauthToken.startsWith("Bearer ") ? oauthToken : `Bearer ${oauthToken}`;
+            }
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("ApiKey", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/policy/v2/policy-revisions`;
+        return {
+            path: urlPath,
+            method: 'GET',
+            headers: headerParameters,
+            query: queryParameters,
+        };
+    }
+    /**
+     * List policy revisions across every policy scoped to `mcp_server_id` in the caller\'s organization, newest first, cursor-paginated (BCP-4458).  Replaces the client\'s old per-policy revisions fan-out (one call per policy, capped at 20 policies): this is one server-scoped call whose `version_number` values are computed over each policy\'s whole revision history before `since`/`cursor` filtering, so they stay stable across pages.
+     * List Server Policy Revisions
+     */
+    async listServerPolicyRevisionsRaw(requestParameters, initOverrides) {
+        const requestOptions = await this.listServerPolicyRevisionsRequestOpts(requestParameters);
+        const response = await this.request(requestOptions, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => ServerPolicyRevisionsPageFromJSON(jsonValue));
+    }
+    /**
+     * List policy revisions across every policy scoped to `mcp_server_id` in the caller\'s organization, newest first, cursor-paginated (BCP-4458).  Replaces the client\'s old per-policy revisions fan-out (one call per policy, capped at 20 policies): this is one server-scoped call whose `version_number` values are computed over each policy\'s whole revision history before `since`/`cursor` filtering, so they stay stable across pages.
+     * List Server Policy Revisions
+     */
+    async listServerPolicyRevisions(requestParameters, initOverrides) {
+        const response = await this.listServerPolicyRevisionsRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
     /**
      * Creates request options for updatePolicy without sending the request
      */

package/dist/esm/apis/RegistryApi.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
@@ -90,6 +90,10 @@ export interface GetMcpServerRequest {
      * Include connection_status computation (requires Bao calls). Set to false for better performance when connection_status is not needed.
      */
     includeConnectionStatus?: boolean;
+    /**
+     * BCP-4300: allow servers that run locally through the Barndoor CLI (embedded and local catalogs). Omitted, the registry resolves it from the org's `local-cli-mcp-tooling` flag (fail-closed); an explicit value is always honoured. An excluded server is left out of the result, and a single-server read of one returns 404.
+     */
+    includeLocal?: boolean | null;
 }
 export interface GetMcpServerBySlugRequest {
     /**
@@ -104,6 +108,10 @@ export interface GetMcpServerBySlugRequest {
      * Include connection_status computation (requires Bao calls). Set to false for better performance when connection_status is not needed.
      */
     includeConnectionStatus?: boolean;
+    /**
+     * BCP-4300: allow servers that run locally through the Barndoor CLI (embedded and local catalogs). Omitted, the registry resolves it from the org's `local-cli-mcp-tooling` flag (fail-closed); an explicit value is always honoured. An excluded server is left out of the result, and a single-server read of one returns 404.
+     */
+    includeLocal?: boolean | null;
 }
 export interface GetMcpServerConnectionRequest {
     /**
@@ -127,13 +135,17 @@ export interface GetMcpServerDirectoryEntryRequest {
 }
 export interface ListActiveMcpServerIdsRequest {
     /**
-     * When omitted, returns all alive (non-soft-deleted) server IDs for the org. True returns only available servers (with the publishing flag on — BCP-3039 — published AND still operationally sound; else operationally available); False returns the complement. Uncapped — no pagination.
+     * When omitted, returns all alive (non-soft-deleted) server IDs for the org (local servers only per `include_local`). True returns only available servers (with the publishing flag on — BCP-3039 — published AND still operationally sound; else operationally available); False returns the complement. Uncapped — no pagination.
      */
     availabilityStatus?: boolean | null;
     /**
-     * BCP-3735: restrict the returned IDs to servers this user may discover — published AND named by an active allow rule on one of the server's ACTIVE policies (same semantics as GET /servers?audience_scoped=true). Opt-in: the default keeps existing callers (audit-history deleted tagging, dashboard denominators) seeing every server. Fails closed with HTTP 503 when the visible set cannot be resolved.
+     * BCP-3735: restrict the returned IDs to servers this user may discover — published AND named by an active allow rule on one of the server's ACTIVE policies (same semantics as GET /servers?audience_scoped=true). Opt-in: the default keeps existing callers (audit-history deleted tagging, dashboard denominators) seeing every server the `include_local` gate allows. Fails closed with HTTP 503 when the visible set cannot be resolved.
      */
     audienceScoped?: boolean;
+    /**
+     * BCP-4300: allow servers that run locally through the Barndoor CLI (embedded and local catalogs). Omitted, the registry resolves it from the org's `local-cli-mcp-tooling` flag (fail-closed); an explicit value is always honoured. An excluded server is left out of the result, and a single-server read of one returns 404.
+     */
+    includeLocal?: boolean | null;
 }
 export interface ListAgentDirectoryRequest {
     /**
@@ -188,6 +200,10 @@ export interface ListMcpServerDirectoryRequest {
      * Include server instances for the current user's organization
      */
     includeServers?: boolean;
+    /**
+     * BCP-4300: false drops catalogs that run locally through the Barndoor CLI (embedded and local sources) before pagination, so page counts match what an org without the `local-cli-mcp-tooling` flag is shown. Defaults to true (unchanged listing).
+     */
+    includeLocal?: boolean;
     /**
      * Page number (1-based)
      */
@@ -230,6 +246,10 @@ export interface ListMcpServersRequest {
      * BCP-3661: restrict the listing to servers this user may discover — published AND named by an active allow rule on one of the server's ACTIVE policies. Opt-in, because this same endpoint serves admin surfaces (policy authoring, connector pickers) that must keep seeing every server; filtering those would make a new server impossible to write its first policy for. Set it on end-user surfaces (My Apps) only. NOT gated by the mcp-server-publishing flag — an explicit request is always honoured (a flag-eval outage must not silently serve the unfiltered listing); the rollout gate is whether a surface sends the parameter at all (BCP-3735). Fails closed with HTTP 503 when the visible set cannot be resolved.
      */
     audienceScoped?: boolean;
+    /**
+     * BCP-4300: include servers that run locally through the Barndoor CLI (embedded and local catalogs). Omitted, the registry resolves it from the org's `local-cli-mcp-tooling` flag (fail-closed); an explicit value is always honoured.
+     */
+    includeLocal?: boolean | null;
     /**
      * Page number (1-based)
      */
@@ -304,12 +324,12 @@ export declare class RegistryApi extends runtime.BaseAPI {
      */
     connectMcpServerRequestOpts(requestParameters: ConnectMcpServerRequest): Promise<runtime.RequestOpts>;
     /**
-     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published.
+     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published, and requires an organization admin.
      * Authenticate an already-registered server
      */
     connectMcpServerRaw(requestParameters: ConnectMcpServerRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConnectionInitiateResponse>>;
     /**
-     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published.
+     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published, and requires an organization admin.
      * Authenticate an already-registered server
      */
     connectMcpServer(requestParameters: ConnectMcpServerRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConnectionInitiateResponse>;
@@ -546,12 +566,12 @@ export declare class RegistryApi extends runtime.BaseAPI {
      */
     reportMcpConnectionAuthErrorRequestOpts(requestParameters: ReportMcpConnectionAuthErrorRequest): Promise<runtime.RequestOpts>;
     /**
-     * Mark the calling user\'s connection as needing re-authorization.  Called by tool-router when the upstream provider rejects the stored OAuth token mid-use (e.g. a Salesforce session revoked out-of-band while the recorded expiry is still in the future), so the UI flips to a reconnect prompt instead of continuing to show \"connected\".  Scoped to the caller\'s own connection on this server — it cannot affect other users\' connections or the server configuration, so the worst a misbehaving caller can do is force themselves to reconnect.
+     * Report that the provider rejected the stored credential for the calling user\'s connection.  Called by tool-router when an upstream provider rejects a served OAuth token mid-use.  The service first forces one refresh; if it succeeds the connection stays connected. The caller\'s connection flips to a reconnect prompt only when the provider refuses that refresh (the authorization is then dead for every connection using it), or when no refresh token exists and the token is older than the service\'s cooldown, which changes only the caller\'s own connection. A caller-supplied ``rejected_fingerprint`` matching the stored token on a credential with no refresh token skips the cooldown and retires the shared authorization, which also affects service-account connections that borrow it.  A report that cannot be acted on (a just-issued token, a lost refresh race, a transient failure) changes nothing. The response is always 204 once the connection is found and never says which outcome occurred.
      * Report Connection Auth Error
      */
     reportMcpConnectionAuthErrorRaw(requestParameters: ReportMcpConnectionAuthErrorRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
     /**
-     * Mark the calling user\'s connection as needing re-authorization.  Called by tool-router when the upstream provider rejects the stored OAuth token mid-use (e.g. a Salesforce session revoked out-of-band while the recorded expiry is still in the future), so the UI flips to a reconnect prompt instead of continuing to show \"connected\".  Scoped to the caller\'s own connection on this server — it cannot affect other users\' connections or the server configuration, so the worst a misbehaving caller can do is force themselves to reconnect.
+     * Report that the provider rejected the stored credential for the calling user\'s connection.  Called by tool-router when an upstream provider rejects a served OAuth token mid-use.  The service first forces one refresh; if it succeeds the connection stays connected. The caller\'s connection flips to a reconnect prompt only when the provider refuses that refresh (the authorization is then dead for every connection using it), or when no refresh token exists and the token is older than the service\'s cooldown, which changes only the caller\'s own connection. A caller-supplied ``rejected_fingerprint`` matching the stored token on a credential with no refresh token skips the cooldown and retires the shared authorization, which also affects service-account connections that borrow it.  A report that cannot be acted on (a just-issued token, a lost refresh race, a transient failure) changes nothing. The response is always 204 once the connection is found and never says which outcome occurred.
      * Report Connection Auth Error
      */
     reportMcpConnectionAuthError(requestParameters: ReportMcpConnectionAuthErrorRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;

package/dist/esm/apis/RegistryApi.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
@@ -84,7 +84,7 @@ export class RegistryApi extends runtime.BaseAPI {
         };
     }
     /**
-     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published.
+     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published, and requires an organization admin.
      * Authenticate an already-registered server
      */
     async connectMcpServerRaw(requestParameters, initOverrides) {
@@ -93,7 +93,7 @@ export class RegistryApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => ConnectionInitiateResponseFromJSON(jsonValue));
     }
     /**
-     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published.
+     * Authenticates the caller against an MCP server that is ALREADY registered in this organization. It does not add a server: a `server_id` that is not yet registered returns 404, and a catalog (directory) id is never valid here — that ordering is the usual reason this endpoint 404s. Registering a server is not available as a tool; an operator adds it in the console first.  For OAuth providers it returns an authorization URL for the user to visit. For non-OAuth providers (api_key, bearer_token, basic_auth, generic) credentials go in the request body — prefer a server registered with managed credentials so no secret passes through the caller at all, and never solicit one in a chat transcript.  `as_service: true` connects the tenant\'s shared service account rather than the calling user, which is what a server needs before it can be published, and requires an organization admin.
      * Authenticate an already-registered server
      */
     async connectMcpServer(requestParameters, initOverrides) {
@@ -335,6 +335,9 @@ export class RegistryApi extends runtime.BaseAPI {
         if (requestParameters['includeConnectionStatus'] != null) {
             queryParameters['include_connection_status'] = requestParameters['includeConnectionStatus'];
         }
+        if (requestParameters['includeLocal'] != null) {
+            queryParameters['include_local'] = requestParameters['includeLocal'];
+        }
         const headerParameters = {};
         if (this.configuration && this.configuration.accessToken) {
             // oauth required
@@ -397,6 +400,9 @@ export class RegistryApi extends runtime.BaseAPI {
         if (requestParameters['includeConnectionStatus'] != null) {
             queryParameters['include_connection_status'] = requestParameters['includeConnectionStatus'];
         }
+        if (requestParameters['includeLocal'] != null) {
+            queryParameters['include_local'] = requestParameters['includeLocal'];
+        }
         const headerParameters = {};
         if (this.configuration && this.configuration.accessToken) {
             // oauth required
@@ -676,6 +682,9 @@ export class RegistryApi extends runtime.BaseAPI {
         if (requestParameters['audienceScoped'] != null) {
             queryParameters['audience_scoped'] = requestParameters['audienceScoped'];
         }
+        if (requestParameters['includeLocal'] != null) {
+            queryParameters['include_local'] = requestParameters['includeLocal'];
+        }
         const headerParameters = {};
         if (this.configuration && this.configuration.accessToken) {
             // oauth required
@@ -868,6 +877,9 @@ export class RegistryApi extends runtime.BaseAPI {
         if (requestParameters['includeServers'] != null) {
             queryParameters['include_servers'] = requestParameters['includeServers'];
         }
+        if (requestParameters['includeLocal'] != null) {
+            queryParameters['include_local'] = requestParameters['includeLocal'];
+        }
         if (requestParameters['page'] != null) {
             queryParameters['page'] = requestParameters['page'];
         }
@@ -950,6 +962,9 @@ export class RegistryApi extends runtime.BaseAPI {
         if (requestParameters['audienceScoped'] != null) {
             queryParameters['audience_scoped'] = requestParameters['audienceScoped'];
         }
+        if (requestParameters['includeLocal'] != null) {
+            queryParameters['include_local'] = requestParameters['includeLocal'];
+        }
         if (requestParameters['page'] != null) {
             queryParameters['page'] = requestParameters['page'];
         }
@@ -1161,7 +1176,7 @@ export class RegistryApi extends runtime.BaseAPI {
         };
     }
     /**
-     * Mark the calling user\'s connection as needing re-authorization.  Called by tool-router when the upstream provider rejects the stored OAuth token mid-use (e.g. a Salesforce session revoked out-of-band while the recorded expiry is still in the future), so the UI flips to a reconnect prompt instead of continuing to show \"connected\".  Scoped to the caller\'s own connection on this server — it cannot affect other users\' connections or the server configuration, so the worst a misbehaving caller can do is force themselves to reconnect.
+     * Report that the provider rejected the stored credential for the calling user\'s connection.  Called by tool-router when an upstream provider rejects a served OAuth token mid-use.  The service first forces one refresh; if it succeeds the connection stays connected. The caller\'s connection flips to a reconnect prompt only when the provider refuses that refresh (the authorization is then dead for every connection using it), or when no refresh token exists and the token is older than the service\'s cooldown, which changes only the caller\'s own connection. A caller-supplied ``rejected_fingerprint`` matching the stored token on a credential with no refresh token skips the cooldown and retires the shared authorization, which also affects service-account connections that borrow it.  A report that cannot be acted on (a just-issued token, a lost refresh race, a transient failure) changes nothing. The response is always 204 once the connection is found and never says which outcome occurred.
      * Report Connection Auth Error
      */
     async reportMcpConnectionAuthErrorRaw(requestParameters, initOverrides) {
@@ -1170,7 +1185,7 @@ export class RegistryApi extends runtime.BaseAPI {
         return new runtime.VoidApiResponse(response);
     }
     /**
-     * Mark the calling user\'s connection as needing re-authorization.  Called by tool-router when the upstream provider rejects the stored OAuth token mid-use (e.g. a Salesforce session revoked out-of-band while the recorded expiry is still in the future), so the UI flips to a reconnect prompt instead of continuing to show \"connected\".  Scoped to the caller\'s own connection on this server — it cannot affect other users\' connections or the server configuration, so the worst a misbehaving caller can do is force themselves to reconnect.
+     * Report that the provider rejected the stored credential for the calling user\'s connection.  Called by tool-router when an upstream provider rejects a served OAuth token mid-use.  The service first forces one refresh; if it succeeds the connection stays connected. The caller\'s connection flips to a reconnect prompt only when the provider refuses that refresh (the authorization is then dead for every connection using it), or when no refresh token exists and the token is older than the service\'s cooldown, which changes only the caller\'s own connection. A caller-supplied ``rejected_fingerprint`` matching the stored token on a credential with no refresh token skips the cooldown and retires the shared authorization, which also affects service-account connections that borrow it.  A report that cannot be acted on (a just-issued token, a lost refresh race, a transient failure) changes nothing. The response is always 204 once the connection is found and never says which outcome occurred.
      * Report Connection Auth Error
      */
     async reportMcpConnectionAuthError(requestParameters, initOverrides) {

package/dist/esm/apis/SystemManagementApi.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/apis/SystemManagementApi.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AWSTrustInfoResponse.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AWSTrustInfoResponse.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AddRouteGroupMembersRequest.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AddRouteGroupMembersRequest.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AdminModelPricing.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AdminModelPricing.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AffectedPoliciesResponse.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AffectedPoliciesResponse.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AffectedPolicyPreview.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AffectedPolicyPreview.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AgentPolicyCounts.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AgentPolicyCounts.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AgentRuntimeCapabilities.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AgentRuntimeCapabilities.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).

package/dist/esm/models/AgentRuntimeProfile.d.ts

@@ -2,7 +2,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
@@ -17,9 +17,14 @@ import type { AgentRuntimeCapabilities } from './AgentRuntimeCapabilities.js';
  */
 export interface AgentRuntimeProfile {
     /**
-     *
+     * True for the client's settings; false for an archived former profile.
      */
     active: boolean;
+    /**
+     * When this former launch profile was archived; null for the client's
+     * settings.
+     */
+    archivedAt?: Date | null;
     /**
      *
      */
@@ -29,7 +34,9 @@ export interface AgentRuntimeProfile {
      */
     client: string;
     /**
-     *
+     * Stored model route per client slot (the settings' `preferences`).
+     * Kept, but not read by a launch: every slot is derived from the models
+     * Model Access allows the person.
      */
     config: {
         [key: string]: string;
@@ -47,7 +54,7 @@ export interface AgentRuntimeProfile {
      */
     id: string;
     /**
-     *
+     * True for the client's settings; false for an archived former profile.
      */
     isOrgDefault: boolean;
     /**
@@ -63,7 +70,7 @@ export interface AgentRuntimeProfile {
      */
     updatedAt: Date;
     /**
-     * The immutable version whose `config` is loaded below.
+     * The immutable version whose preferences are loaded below.
      */
     version: number;
 }

package/dist/esm/models/AgentRuntimeProfile.js

@@ -4,7 +4,7 @@
  * Barndoor.ai Public API
  * Unified public API specification for Barndoor.ai platform
  *
- * The version of the OpenAPI document: 2.2.0
+ * The version of the OpenAPI document: 2.12.0
  *
  *
  * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
@@ -52,6 +52,7 @@ export function AgentRuntimeProfileFromJSONTyped(json, ignoreDiscriminator) {
     }
     return {
         'active': json['active'],
+        'archivedAt': json['archived_at'] === undefined ? undefined : json['archived_at'] === null ? null : (parseDateTime(json['archived_at'])),
         'capabilities': AgentRuntimeCapabilitiesFromJSON(json['capabilities']),
         'client': json['client'],
         'config': json['config'],
@@ -74,6 +75,7 @@ export function AgentRuntimeProfileToJSONTyped(value, ignoreDiscriminator = fals
     }
     return {
         'active': value['active'],
+        'archived_at': value['archivedAt'] == null ? value['archivedAt'] : serializeDateTime(value['archivedAt']),
         'capabilities': AgentRuntimeCapabilitiesToJSON(value['capabilities']),
         'client': value['client'],
         'config': value['config'],

package/dist/esm/models/AgentScopeRequest.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Barndoor.ai Public API
+ * Unified public API specification for Barndoor.ai platform
+ *
+ * The version of the OpenAPI document: 2.12.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+/**
+ * Which AI agents a policy applies to, ANDed with its principals.
+ * @export
+ * @interface AgentScopeRequest
+ */
+export interface AgentScopeRequest {
+    /**
+     * Registry agent (application) ids: 1 to 200 unique UUIDs when `mode` is `SELECTED`, empty for `ALL`.
+     */
+    agentIds?: Array<string>;
+    /**
+     * `ALL` (every agent, including agents created later) or `SELECTED`.
+     */
+    mode: string;
+}
+/**
+ * Check if a given object implements the AgentScopeRequest interface.
+ */
+export declare function instanceOfAgentScopeRequest(value: object): value is AgentScopeRequest;
+export declare function AgentScopeRequestFromJSON(json: any): AgentScopeRequest;
+export declare function AgentScopeRequestFromJSONTyped(json: any, ignoreDiscriminator: boolean): AgentScopeRequest;
+export declare function AgentScopeRequestToJSON(json: any): AgentScopeRequest;
+export declare function AgentScopeRequestToJSONTyped(value?: AgentScopeRequest | null, ignoreDiscriminator?: boolean): any;

package/dist/esm/models/AgentScopeRequest.js

@@ -0,0 +1,45 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Barndoor.ai Public API
+ * Unified public API specification for Barndoor.ai platform
+ *
+ * The version of the OpenAPI document: 2.12.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+/**
+ * Check if a given object implements the AgentScopeRequest interface.
+ */
+export function instanceOfAgentScopeRequest(value) {
+    if (!('mode' in value) || value['mode'] === undefined)
+        return false;
+    return true;
+}
+export function AgentScopeRequestFromJSON(json) {
+    return AgentScopeRequestFromJSONTyped(json, false);
+}
+export function AgentScopeRequestFromJSONTyped(json, ignoreDiscriminator) {
+    if (json == null) {
+        return json;
+    }
+    return {
+        'agentIds': json['agent_ids'] == null ? undefined : json['agent_ids'],
+        'mode': json['mode'],
+    };
+}
+export function AgentScopeRequestToJSON(json) {
+    return AgentScopeRequestToJSONTyped(json, false);
+}
+export function AgentScopeRequestToJSONTyped(value, ignoreDiscriminator = false) {
+    if (value == null) {
+        return value;
+    }
+    return {
+        'agent_ids': value['agentIds'],
+        'mode': value['mode'],
+    };
+}