@onesi/genesis 0.2.12 → 0.2.13

package/dist/generated/schema.d.ts

@@ -799,23 +799,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/foundry/files/{file_id}/content": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Download tenant file content */
-        get: operations["foundry_downloadFile"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/foundry/fine_tuning/providers": {
         parameters: {
             query?: never;
@@ -2307,41 +2290,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/hives/organizations/{org_id}/sso": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get SSO configuration for an organization */
-        get: operations["hives_get_sso_config"];
-        put?: never;
-        /** Create a new SSO connection */
-        post: operations["hives_create_sso_connection"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/hives/organizations/{org_id}/sso/{connection_id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /** Delete an SSO connection */
-        delete: operations["hives_delete_sso_connection"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/hives/organizations/{org_id}/usage": {
         parameters: {
             query?: never;
@@ -24412,6 +24360,238 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/connections/catalog": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List verified MCP servers in the catalog
+         * @description Scope `connections:read`. Filter by OneOS plugin category (`plugin`, e.g. `scopes`). Suspended servers are listed with their `reason`.
+         */
+        get: operations["connections_listCatalog"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/catalog/{server}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Catalog server id, e.g. linear, neon, sentry */
+                server: components["parameters"]["Connections.Server"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a catalog server with its pinned tool manifest
+         * @description Scope `connections:read`.
+         */
+        get: operations["connections_getCatalogServer"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List your organization's connections
+         * @description Scope `connections:read`. Connections of the selected environment, newest first (at most 200), optionally of one `status`.
+         */
+        get: operations["connections_list"];
+        put?: never;
+        /**
+         * Connect a catalog server
+         * @description Scope `connections:write`. Creates a `pending_auth` connection and returns the `authorize_url` a person opens to consent at the vendor. `tools` picks the tools to enable (default: the manifest's defaults); only their scopes are requested. Unknown fields are refused (422). Enabling any `send`, `spend` or `destructive` tool needs an owner's approval (428). `auto_org` names the Auto org that governs the connection (its authority checks and approvals); a connect carrying `auto_org` always answers `428 APPROVAL_REQUIRED` first, so a person approves binding the connection to that Auto org.
+         */
+        post: operations["connections_connect"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a connection
+         * @description Scope `connections:read`. Status, granted scopes and the pinned manifest hash.
+         */
+        get: operations["connections_get"];
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a connection
+         * @description Scope `connections:write`. Never needs an approval. Blinds deletes the stored tokens and asks the vendor to revoke them (best effort, reported as `vendor_revoked`; `tokens_deleted` is false when Blinds did not confirm, and repeating the DELETE retries). The connection stays listed as `revoked`.
+         */
+        delete: operations["connections_revoke"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}/authorize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Get a new authorize URL for a person to open
+         * @description Scope `connections:write`. Returns a fresh `authorize_url` (its `state` is single use and valid for 10 minutes). Human step: a person opens it in a browser. The hosted MCP refuses this operation for agents (human consent); use the CLI (`genesis connections authorize <id>`) or the Console.
+         */
+        post: operations["connections_authorize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}/tools": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        /**
+         * List a connection's tools with their policy
+         * @description Scope `connections:read`. The pinned manifest's tools, each with its effect, scopes, policy mode and the vendor's description and input schema (untrusted).
+         */
+        get: operations["connections_listTools"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Set tool policies (allow, approve or deny)
+         * @description Scope `connections:write`. `tools` maps tool names to `allow`, `approve` or `deny`; `send`, `spend` and `destructive` tools take `approve` or `deny` only (422 for `allow`). Narrowing never needs an approval; widening (deny to approve or allow, approve to allow) needs an owner's approval (428) and Auto's `connections.widen` check. When the change needs scopes not yet granted, the answer carries `reauthorize`.
+         */
+        patch: operations["connections_setToolPolicy"];
+        trace?: never;
+    };
+    "/v1/connections/{id}/tools/{tool}/call": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+                /** @description The tool's name in the pinned manifest */
+                tool: components["parameters"]["Connections.Tool"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Call a connected tool
+         * @description Scope `connections:write`. Runs Auto's `connections.call` check, then calls the tool through Blinds. The result is third-party content inside the `untrusted` wrapper. A tool whose policy is `approve`, or a write to another connection after this session read untrusted content, answers 428; retry with `OneOS-Approval`.
+         */
+        post: operations["connections_call"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}/activity": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Read a connection's activity ledger
+         * @description Scope `connections:read`. Append-only, hash-chained rows, oldest first; hashes only, never payloads. Page with `after` = `next_after`.
+         */
+        get: operations["connections_activity"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/tools": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Search the connected tools your organization may call
+         * @description Scope `connections:read`. Connected tools of the selected environment whose policy is not `deny`, matched against `q` (at most 100). genesis-mcp's `genesis_search_tools` lists them by `name` (`conn.<connection>.<tool>`). `session_tainted` says whether this principal has read untrusted content.
+         */
+        get: operations["connections_searchTools"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/oauth/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * OAuth redirect target for a person's browser (anonymous)
+         * @description Human browser only; anonymous. The vendor redirects the person here after consent. The gateway forwards it with no identity envelope and no credential; Connections authenticates it only by the single-use `state` (10 minutes, bound to the connection and its PKCE verifier) and hands the code to Blinds. Not an API for agents.
+         */
+        get: operations["connections_oauthCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -25525,16 +25705,6 @@ export interface components {
              */
             ttl_secs?: number;
         };
-        "Hives.CreateSsoConnectionRequest": {
-            /** @description IdP type hint */
-            idp_type?: string | null;
-            /** @description Raw IdP metadata XML (alternative to URL) */
-            metadata_raw?: string | null;
-            /** @description IdP metadata URL (e.g. Okta, Azure AD metadata endpoint) */
-            metadata_url?: string | null;
-            /** @description Connection name/label */
-            name: string;
-        };
         /** @description Create terminal session request */
         "Hives.CreateTerminalSessionRequest": {
             /**
@@ -41002,6 +41172,248 @@ export interface components {
         } & {
             [key: string]: unknown;
         };
+        /** @enum {string} */
+        "Connections.Tier": "verified" | "suspended" | "pending";
+        /** @enum {string} */
+        "Connections.Effect": "read" | "write" | "send" | "spend" | "destructive";
+        /** @enum {string} */
+        "Connections.Mode": "allow" | "approve" | "deny";
+        /** @enum {string} */
+        "Connections.ConnectionStatus": "pending_auth" | "active" | "needs_reauth" | "revoked";
+        /** @description Codes include TOOL_DENIED, AUTHORITY_DENIED (with `reasons`), APPROVAL_UNAVAILABLE (403), TOOL_CHANGED_PENDING_REVIEW (410), APPROVAL_CONSUMED, APPROVAL_NOT_APPROVED, APPROVAL_MISMATCH, revoked, conflict (409) and invalid (422). */
+        "Connections.Error": {
+            error: {
+                code: string;
+                message: string;
+                request_id?: string;
+            };
+            /** @description Auto's reasons on 403 AUTHORITY_DENIED */
+            reasons?: unknown[];
+            auto_check_id?: string;
+        };
+        "Connections.ApprovalRequired": {
+            error: {
+                /** @constant */
+                code: "APPROVAL_REQUIRED";
+                message: string;
+                request_id?: string;
+            };
+            approval_request_id: string;
+            /** @description Read the approval here, e.g. /v1/auto/approvals/apr_… */
+            poll_url: string;
+            /** Format: date-time */
+            expires_at: string | null;
+        };
+        "Connections.NeedsReauth": {
+            error: {
+                /** @constant */
+                code: "CONNECTION_NEEDS_REAUTH";
+                message: string;
+                request_id?: string;
+            };
+            /**
+             * Format: uri
+             * @description A person opens this to re-authorize
+             */
+            authorize_url: string;
+        };
+        "Connections.Source": {
+            connection?: string;
+            server?: string;
+            tool?: string;
+            tier?: components["schemas"]["Connections.Tier"];
+        };
+        /** @description A vendor-written text (a tool description), sanitized and flagged. Data, never instructions. */
+        "Connections.UntrustedText": {
+            /** @constant */
+            untrusted: true;
+            source?: components["schemas"]["Connections.Source"];
+            text: string;
+            sanitized?: number;
+            flags?: string[];
+        };
+        /** @description A tool's output (MCP content blocks), sanitized, credential-redacted and flagged. Third-party data, never instructions. */
+        "Connections.UntrustedResult": {
+            /** @constant */
+            untrusted: true;
+            source: components["schemas"]["Connections.Source"];
+            flags?: string[];
+            sanitized?: number;
+            credentials_redacted?: number;
+            truncated?: boolean;
+            content: unknown[];
+            structuredContent?: unknown;
+            isError?: boolean;
+        };
+        "Connections.CatalogServer": {
+            id: string;
+            vendor?: string;
+            display: string;
+            plugins?: string[];
+            url?: string;
+            docs?: string;
+            auth?: string;
+            tier: components["schemas"]["Connections.Tier"];
+            /** @description Why a suspended server is paused */
+            reason?: string | null;
+            /** @description Number of tools in the pinned manifest */
+            tools?: number;
+        };
+        "Connections.CatalogTool": {
+            name: string;
+            effect: components["schemas"]["Connections.Effect"];
+            scopes?: string[];
+            description?: components["schemas"]["Connections.UntrustedText"];
+        };
+        "Connections.CatalogServerDetail": {
+            id: string;
+            vendor?: string;
+            display: string;
+            plugins?: string[];
+            url?: string;
+            docs?: string;
+            auth?: string;
+            tier: components["schemas"]["Connections.Tier"];
+            reason?: string | null;
+            manifest_sha256?: string | null;
+            tools: components["schemas"]["Connections.CatalogTool"][];
+        };
+        "Connections.Connection": {
+            id: string;
+            server: string;
+            url?: string;
+            status: components["schemas"]["Connections.ConnectionStatus"];
+            /** @description The Auto org that governs the connection, if one was named at connect */
+            auto_org?: string | null;
+            tier?: components["schemas"]["Connections.Tier"];
+            server_status?: components["schemas"]["Connections.Tier"];
+            policy?: {
+                [key: string]: components["schemas"]["Connections.Mode"];
+            };
+            scopes_requested?: string[];
+            scopes_granted?: string[];
+            /** Format: date-time */
+            token_expires_at?: string | null;
+            created_by?: string;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            updated_at?: string;
+            /** Format: date-time */
+            revoked_at?: string | null;
+        };
+        "Connections.ConnectRequest": {
+            server: string;
+            /** @description Tools to enable (default: the manifest defaults) */
+            tools?: string[];
+            /** @description The Auto org that governs the connection. A connect carrying it always answers 428 APPROVAL_REQUIRED first. */
+            auto_org?: string;
+        };
+        "Connections.ConnectResponse": {
+            connection: components["schemas"]["Connections.Connection"];
+            /**
+             * Format: uri
+             * @description A person opens this to consent at the vendor
+             */
+            authorize_url: string;
+            next?: string;
+        };
+        "Connections.AuthorizeResponse": {
+            /** Format: uri */
+            authorize_url: string;
+            next?: string;
+        };
+        "Connections.ConnectionTool": {
+            name: string;
+            effect: components["schemas"]["Connections.Effect"];
+            mode: components["schemas"]["Connections.Mode"];
+            stored_mode?: components["schemas"]["Connections.Mode"];
+            scopes?: string[];
+            description?: components["schemas"]["Connections.UntrustedText"];
+            inputSchema?: unknown;
+            schema_flags?: string[];
+        };
+        "Connections.ToolList": {
+            connection: string;
+            server: string;
+            tier?: components["schemas"]["Connections.Tier"];
+            server_status?: components["schemas"]["Connections.Tier"];
+            manifest_sha256?: string | null;
+            tools: components["schemas"]["Connections.ConnectionTool"][];
+        };
+        "Connections.ToolPolicyRequest": {
+            /** @description Tool name to mode, e.g. {"create_issue": "approve"} */
+            tools: {
+                [key: string]: components["schemas"]["Connections.Mode"];
+            };
+        };
+        "Connections.ToolPolicyResponse": {
+            connection: components["schemas"]["Connections.Connection"];
+            changed: {
+                name?: string;
+                effect?: components["schemas"]["Connections.Effect"];
+                from?: components["schemas"]["Connections.Mode"];
+                to?: components["schemas"]["Connections.Mode"];
+            }[];
+            reauthorize?: {
+                missing_scopes?: string[];
+                /** Format: uri */
+                authorize_url?: string;
+            };
+        };
+        "Connections.CallRequest": {
+            /** @description The tool's arguments, as its inputSchema describes */
+            arguments: {
+                [key: string]: unknown;
+            };
+        };
+        "Connections.CallResult": {
+            call_id: string;
+            /** @enum {string} */
+            outcome: "ok" | "tool_error";
+            result: components["schemas"]["Connections.UntrustedResult"];
+            auto_check_id?: string | null;
+            /** @description Auto's signed receipt (JWS) */
+            auto_receipt?: string | null;
+            approval_id?: string | null;
+        };
+        "Connections.RevokeResponse": {
+            connection: components["schemas"]["Connections.Connection"];
+            vendor_revoked?: boolean;
+            tokens_deleted?: boolean;
+        };
+        "Connections.ActivityRow": {
+            seq: number;
+            /** Format: date-time */
+            at?: string;
+            kind: string;
+            connection_id?: string | null;
+            principal?: string | null;
+            tool?: string | null;
+            args_sha256?: string | null;
+            result_sha256?: string | null;
+            outcome: string;
+            prev_hash?: string;
+            hash: string;
+        } & {
+            [key: string]: unknown;
+        };
+        "Connections.ConnectedTool": {
+            /** @description conn.<connection>.<tool> */
+            name: string;
+            connection: string;
+            server: string;
+            tool: string;
+            effect: components["schemas"]["Connections.Effect"];
+            mode?: components["schemas"]["Connections.Mode"];
+            description?: components["schemas"]["Connections.UntrustedText"];
+            inputSchema?: unknown;
+            schema_flags?: string[];
+        };
+        "Connections.SearchToolsResponse": {
+            data: components["schemas"]["Connections.ConnectedTool"][];
+            session_tainted?: boolean;
+        };
     };
     responses: {
         /** @description Foundry API error. */
@@ -41472,6 +41884,69 @@ export interface components {
                 "application/json": components["schemas"]["Garden.Disbursement"];
             };
         };
+        /** @description Missing scope; `TOOL_DENIED` (policy deny or not in the manifest); `AUTHORITY_DENIED` with `reasons` (Auto denied); `APPROVAL_UNAVAILABLE` (an approval is needed but the org has no Auto org) */
+        "Connections.Forbidden": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description Not found in your organization and environment */
+        "Connections.NotFound": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description `revoked`, `conflict` (the policy changed meanwhile), or an approval refusal: `APPROVAL_CONSUMED`, `APPROVAL_NOT_APPROVED`, `APPROVAL_MISMATCH` */
+        "Connections.Conflict": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description `CONNECTION_NEEDS_REAUTH`: a person opens the fresh `authorize_url` (an approval refusal or `revoked` is also a 409, without it) */
+        "Connections.NeedsReauth": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.NeedsReauth"];
+            };
+        };
+        /** @description `TOOL_CHANGED_PENDING_REVIEW`: the server's live tools differ from its pinned manifest; it is suspended for every organization until re-verified */
+        "Connections.ToolChanged": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description Invalid request body or parameters */
+        "Connections.Invalid": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description `APPROVAL_REQUIRED`: a human approves `approval_request_id` in Auto; then retry the same request with `OneOS-Approval` */
+        "Connections.ApprovalRequired": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.ApprovalRequired"];
+            };
+        };
     };
     parameters: {
         /** @description Zone name, e.g. example.com */
@@ -41662,6 +42137,14 @@ export interface components {
         "Brews.DecisionId": string;
         /** @description Stable key; a retry with it returns the original decision instead of creating another */
         "Brews.RequiredIdempotencyKey": string;
+        /** @description Connection id (conn_ followed by 32 hex) */
+        "Connections.Id": string;
+        /** @description Catalog server id, e.g. linear, neon, sentry */
+        "Connections.Server": string;
+        /** @description The tool's name in the pinned manifest */
+        "Connections.Tool": string;
+        /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+        "Connections.Approval": string;
     };
     requestBodies: never;
     headers: {
@@ -42755,29 +43238,6 @@ export interface operations {
             default: components["responses"]["Foundry.Error"];
         };
     };
-    foundry_downloadFile: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                file_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description File bytes. */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": string;
-                };
-            };
-            default: components["responses"]["Foundry.Error"];
-        };
-    };
     foundry_listFineTuningProviders: {
         parameters: {
             query?: never;
@@ -45403,144 +45863,6 @@ export interface operations {
             };
         };
     };
-    hives_get_sso_config: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Organization ID */
-                org_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description SSO configuration */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>;
-                };
-            };
-            /** @description Unauthorized */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Organization not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description SSO service unavailable */
-            503: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    hives_create_sso_connection: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Organization ID */
-                org_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["Hives.CreateSsoConnectionRequest"];
-            };
-        };
-        responses: {
-            /** @description SSO connection created */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>;
-                };
-            };
-            /** @description Unauthorized */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Organization not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description SSO service unavailable */
-            503: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    hives_delete_sso_connection: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Organization ID */
-                org_id: string;
-                /** @description SSO connection ID */
-                connection_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description SSO connection deleted */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>;
-                };
-            };
-            /** @description Unauthorized */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Organization or connection not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description SSO service unavailable */
-            503: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
     hives_get_org_usage: {
         parameters: {
             query?: never;
@@ -110048,4 +110370,376 @@ export interface operations {
             };
         };
     };
+    connections_listCatalog: {
+        parameters: {
+            query?: {
+                /** @description OneOS plugin category the server competes in, e.g. scopes, silos, traces */
+                plugin?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Catalog servers */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Connections.CatalogServer"][];
+                    };
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+        };
+    };
+    connections_getCatalogServer: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Catalog server id, e.g. linear, neon, sentry */
+                server: components["parameters"]["Connections.Server"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The server and its pinned manifest */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.CatalogServerDetail"];
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_list: {
+        parameters: {
+            query?: {
+                status?: "pending_auth" | "active" | "needs_reauth" | "revoked";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Connections */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Connections.Connection"][];
+                    };
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+        };
+    };
+    connections_connect: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+                "OneOS-Approval"?: components["parameters"]["Connections.Approval"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Connections.ConnectRequest"];
+            };
+        };
+        responses: {
+            /** @description Connection created, waiting for a person to authorize it */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.ConnectResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.Conflict"];
+            410: components["responses"]["Connections.ToolChanged"];
+            422: components["responses"]["Connections.Invalid"];
+            428: components["responses"]["Connections.ApprovalRequired"];
+        };
+    };
+    connections_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The connection */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.Connection"];
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_revoke: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Revoked */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.RevokeResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_authorize: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The URL a person opens to consent at the vendor */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.AuthorizeResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.Conflict"];
+        };
+    };
+    connections_listTools: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Tools */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.ToolList"];
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+            410: components["responses"]["Connections.ToolChanged"];
+        };
+    };
+    connections_setToolPolicy: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+                "OneOS-Approval"?: components["parameters"]["Connections.Approval"];
+            };
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Connections.ToolPolicyRequest"];
+            };
+        };
+        responses: {
+            /** @description The connection with its new policy and the changes made */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.ToolPolicyResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.Conflict"];
+            422: components["responses"]["Connections.Invalid"];
+            428: components["responses"]["Connections.ApprovalRequired"];
+        };
+    };
+    connections_call: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+                "OneOS-Approval"?: components["parameters"]["Connections.Approval"];
+            };
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+                /** @description The tool's name in the pinned manifest */
+                tool: components["parameters"]["Connections.Tool"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Connections.CallRequest"];
+            };
+        };
+        responses: {
+            /** @description The call's outcome and its wrapped result */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.CallResult"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.NeedsReauth"];
+            410: components["responses"]["Connections.ToolChanged"];
+            422: components["responses"]["Connections.Invalid"];
+            428: components["responses"]["Connections.ApprovalRequired"];
+        };
+    };
+    connections_activity: {
+        parameters: {
+            query?: {
+                /** @description Return rows with a larger `seq` (default 0) */
+                after?: number;
+                /** @description Page size, 1-500 (default 100) */
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ledger rows */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Connections.ActivityRow"][];
+                        next_after?: number | null;
+                    };
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_searchTools: {
+        parameters: {
+            query?: {
+                /** @description Keywords */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Matching connected tools */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.SearchToolsResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+        };
+    };
+    connections_oauthCallback: {
+        parameters: {
+            query?: {
+                state?: string;
+                code?: string;
+                iss?: string;
+                error?: string;
+                error_description?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A page telling the person the connection is ready (or what failed) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+            /** @description Unknown, used or expired state */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+        };
+    };
 }