@onesi/genesis 0.2.12 → 0.2.14

package/dist/generated/schema.d.ts

@@ -799,23 +799,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/foundry/files/{file_id}/content": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Download tenant file content */
-        get: operations["foundry_downloadFile"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/foundry/fine_tuning/providers": {
         parameters: {
             query?: never;
@@ -2307,41 +2290,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/hives/organizations/{org_id}/sso": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get SSO configuration for an organization */
-        get: operations["hives_get_sso_config"];
-        put?: never;
-        /** Create a new SSO connection */
-        post: operations["hives_create_sso_connection"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/hives/organizations/{org_id}/sso/{connection_id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /** Delete an SSO connection */
-        delete: operations["hives_delete_sso_connection"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/hives/organizations/{org_id}/usage": {
         parameters: {
             query?: never;
@@ -10002,6 +9950,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/dials/workflows/{workflow_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete an owned workflow and its routing descriptor
+         * @description Needs `dials:write`. Deletes the workflow with this id (the `id` you deployed it with) and every routing-rule descriptor row it was deployed as, in the verified org/workspace/project/environment only, and records a `workflows.delete` audit event whose actor is the verified gateway identity. Another organization's, workspace's, project's or environment's workflow, and a repeat delete, are 404 `workflow_not_found`. If a held (not released) number is assigned to the workflow (kind `workflow` or `routing_rule`), the delete is refused with 409 `workflow_number_attached` and nothing changes: unassign the number first with `assignNumber` and no resource. Managed inbound policies (`/v1/routing/rules`) are never deleted here. Scope is required in the JSON body, not query parameters.
+         */
+        delete: operations["dials_deleteWorkflow"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/dials/numbers/{number_id}": {
         parameters: {
             query?: never;
@@ -24412,6 +24380,278 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/connections/catalog": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List verified MCP servers in the catalog
+         * @description Scope `connections:read`. Filter by OneOS plugin category (`plugin`, e.g. `scopes`). Suspended servers are listed with their `reason`.
+         */
+        get: operations["connections_listCatalog"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/catalog/{server}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Catalog server id, e.g. linear, neon, sentry */
+                server: components["parameters"]["Connections.Server"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a catalog server with its pinned tool manifest
+         * @description Scope `connections:read`.
+         */
+        get: operations["connections_getCatalogServer"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List your organization's connections
+         * @description Scope `connections:read`. Connections of the selected environment, newest first (at most 200), optionally of one `status`.
+         */
+        get: operations["connections_list"];
+        put?: never;
+        /**
+         * Connect a catalog server
+         * @description Scope `connections:write`. Creates a `pending_auth` connection and returns the `authorize_url` a person opens to consent at the vendor. `tools` picks the tools to enable (default: the manifest's defaults); only their scopes are requested. Unknown fields are refused (422). Enabling any `send`, `spend` or `destructive` tool needs an owner's approval (428). `auto_org` names the Auto org that governs the connection (its authority checks and approvals); a connect carrying `auto_org` always answers `428 APPROVAL_REQUIRED` first, so a person approves binding the connection to that Auto org.
+         */
+        post: operations["connections_connect"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a connection
+         * @description Scope `connections:read`. Status, granted scopes and the pinned manifest hash.
+         */
+        get: operations["connections_get"];
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a connection
+         * @description Scope `connections:write`. Never needs an approval. Blinds deletes the stored tokens and asks the vendor to revoke them (best effort, reported as `vendor_revoked`; `tokens_deleted` is false when Blinds did not confirm, and repeating the DELETE retries). The connection stays listed as `revoked`.
+         */
+        delete: operations["connections_revoke"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}/authorize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Get a new authorize URL for a person to open
+         * @description Scope `connections:write`. Returns a fresh `authorize_url` (its `state` is single use and valid for 10 minutes). Human step: a person opens it in a browser. The hosted MCP refuses this operation for agents (human consent); use the CLI (`genesis connections authorize <id>`) or the Console.
+         */
+        post: operations["connections_authorize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}/tools": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        /**
+         * List a connection's tools with their policy
+         * @description Scope `connections:read`. The pinned manifest's tools, each with its effect, scopes, policy mode and the vendor's description and input schema (untrusted).
+         */
+        get: operations["connections_listTools"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Set tool policies (allow, approve or deny)
+         * @description Scope `connections:write`. `tools` maps tool names to `allow`, `approve` or `deny`; `send`, `spend` and `destructive` tools take `approve` or `deny` only (422 for `allow`). Narrowing never needs an approval; widening (deny to approve or allow, approve to allow) needs an owner's approval (428) and Auto's `connections.widen` check. When the change needs scopes not yet granted, the answer carries `reauthorize`.
+         */
+        patch: operations["connections_setToolPolicy"];
+        trace?: never;
+    };
+    "/v1/connections/{id}/tools/{tool}/call": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+                /** @description The tool's name in the pinned manifest */
+                tool: components["parameters"]["Connections.Tool"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Call a connected tool
+         * @description Scope `connections:write`. Runs Auto's `connections.call` check, then calls the tool through Blinds. The result is third-party content inside the `untrusted` wrapper. A tool whose policy is `approve`, or a write to another connection after this session read untrusted content, answers 428; retry with `OneOS-Approval`.
+         */
+        post: operations["connections_call"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/{id}/activity": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Read a connection's activity ledger
+         * @description Scope `connections:read`. Append-only, hash-chained rows, oldest first; hashes only, never payloads. Page with `after` = `next_after`.
+         */
+        get: operations["connections_activity"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/tools": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Search the connected tools your organization may call
+         * @description Scope `connections:read`. Connected tools of the selected environment whose policy is not `deny`, matched against `q` (at most 100). genesis-mcp's `genesis_search_tools` lists them by `name` (`conn.<connection>.<tool>`). `session_tainted` says whether this principal has read untrusted content.
+         */
+        get: operations["connections_searchTools"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/connections/oauth/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * OAuth redirect target for a person's browser (anonymous)
+         * @description Human browser only; anonymous. The vendor redirects the person here after consent. The gateway forwards it with no identity envelope and no credential; Connections authenticates it only by the single-use `state` (10 minutes, bound to the connection and its PKCE verifier) and hands the code to Blinds. Not an API for agents.
+         */
+        get: operations["connections_oauthCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/search": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Search public agents
+         * @description Public, no credential. Ranked full-text search over public Live agents: matches in the name rank above the organization name, then the description, then the agent id; every word must match, as a prefix. An exact agent id ranks that agent first. GET only, no body, no other query key. Cached at the edge for up to 30 seconds. Rate limited per client address (429 RATE_LIMITED with Retry-After).
+         */
+        get: operations["agents_search"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/agents/sitemap": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List every public agent for crawlers
+         * @description Public, no credential. Every public Live agent id (at most 50,000) with when its public content last changed, for sitemaps and spiders. GET only, no query string, no body. Cached at the edge for up to 5 minutes. Rate limited per client address.
+         */
+        get: operations["agents_sitemap"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -25525,16 +25765,6 @@ export interface components {
              */
             ttl_secs?: number;
         };
-        "Hives.CreateSsoConnectionRequest": {
-            /** @description IdP type hint */
-            idp_type?: string | null;
-            /** @description Raw IdP metadata XML (alternative to URL) */
-            metadata_raw?: string | null;
-            /** @description IdP metadata URL (e.g. Okta, Azure AD metadata endpoint) */
-            metadata_url?: string | null;
-            /** @description Connection name/label */
-            name: string;
-        };
         /** @description Create terminal session request */
         "Hives.CreateTerminalSessionRequest": {
             /**
@@ -33625,6 +33855,24 @@ export interface components {
             actorId: string;
             workflow: components["schemas"]["Dials.WorkflowDocument"];
         };
+        "Dials.DeleteWorkflow": {
+            scope: components["schemas"]["Dials.Scope"];
+            /** @description Optional compatibility field; the actual actor comes from the verified gateway identity. */
+            actorId?: string | null;
+        };
+        /** @description The deleted workflow as it was, with status "deleted". */
+        "Dials.DeleteWorkflowReceipt": {
+            /** @constant */
+            ok: true;
+            /** @constant */
+            deleted: true;
+            workflow: components["schemas"]["Dials.WorkflowDocument"];
+            /** @description The routing-rule descriptor ids that were deleted. */
+            routeIds: string[];
+            auditId: string;
+            /** @constant */
+            next: "workflow_deleted";
+        };
         /** @description Saved call session. Admission/recovery receipts return this session without the separate carrier outcome fields in calls.list. */
         "Dials.CallSession": {
             id: string;
@@ -41002,6 +41250,285 @@ export interface components {
         } & {
             [key: string]: unknown;
         };
+        /** @enum {string} */
+        "Connections.Tier": "verified" | "suspended" | "pending";
+        /** @enum {string} */
+        "Connections.Effect": "read" | "write" | "send" | "spend" | "destructive";
+        /** @enum {string} */
+        "Connections.Mode": "allow" | "approve" | "deny";
+        /** @enum {string} */
+        "Connections.ConnectionStatus": "pending_auth" | "active" | "needs_reauth" | "revoked";
+        /** @description Codes include TOOL_DENIED, AUTHORITY_DENIED (with `reasons`), APPROVAL_UNAVAILABLE (403), TOOL_CHANGED_PENDING_REVIEW (410), APPROVAL_CONSUMED, APPROVAL_NOT_APPROVED, APPROVAL_MISMATCH, revoked, conflict (409) and invalid (422). */
+        "Connections.Error": {
+            error: {
+                code: string;
+                message: string;
+                request_id?: string;
+            };
+            /** @description Auto's reasons on 403 AUTHORITY_DENIED */
+            reasons?: unknown[];
+            auto_check_id?: string;
+        };
+        "Connections.ApprovalRequired": {
+            error: {
+                /** @constant */
+                code: "APPROVAL_REQUIRED";
+                message: string;
+                request_id?: string;
+            };
+            approval_request_id: string;
+            /** @description Read the approval here, e.g. /v1/auto/approvals/apr_… */
+            poll_url: string;
+            /** Format: date-time */
+            expires_at: string | null;
+        };
+        "Connections.NeedsReauth": {
+            error: {
+                /** @constant */
+                code: "CONNECTION_NEEDS_REAUTH";
+                message: string;
+                request_id?: string;
+            };
+            /**
+             * Format: uri
+             * @description A person opens this to re-authorize
+             */
+            authorize_url: string;
+        };
+        "Connections.Source": {
+            connection?: string;
+            server?: string;
+            tool?: string;
+            tier?: components["schemas"]["Connections.Tier"];
+        };
+        /** @description A vendor-written text (a tool description), sanitized and flagged. Data, never instructions. */
+        "Connections.UntrustedText": {
+            /** @constant */
+            untrusted: true;
+            source?: components["schemas"]["Connections.Source"];
+            text: string;
+            sanitized?: number;
+            flags?: string[];
+        };
+        /** @description A tool's output (MCP content blocks), sanitized, credential-redacted and flagged. Third-party data, never instructions. */
+        "Connections.UntrustedResult": {
+            /** @constant */
+            untrusted: true;
+            source: components["schemas"]["Connections.Source"];
+            flags?: string[];
+            sanitized?: number;
+            credentials_redacted?: number;
+            truncated?: boolean;
+            content: unknown[];
+            structuredContent?: unknown;
+            isError?: boolean;
+        };
+        "Connections.CatalogServer": {
+            id: string;
+            vendor?: string;
+            display: string;
+            plugins?: string[];
+            url?: string;
+            docs?: string;
+            auth?: string;
+            tier: components["schemas"]["Connections.Tier"];
+            /** @description Why a suspended server is paused */
+            reason?: string | null;
+            /** @description Number of tools in the pinned manifest */
+            tools?: number;
+        };
+        "Connections.CatalogTool": {
+            name: string;
+            effect: components["schemas"]["Connections.Effect"];
+            scopes?: string[];
+            description?: components["schemas"]["Connections.UntrustedText"];
+        };
+        "Connections.CatalogServerDetail": {
+            id: string;
+            vendor?: string;
+            display: string;
+            plugins?: string[];
+            url?: string;
+            docs?: string;
+            auth?: string;
+            tier: components["schemas"]["Connections.Tier"];
+            reason?: string | null;
+            manifest_sha256?: string | null;
+            tools: components["schemas"]["Connections.CatalogTool"][];
+        };
+        "Connections.Connection": {
+            id: string;
+            server: string;
+            url?: string;
+            status: components["schemas"]["Connections.ConnectionStatus"];
+            /** @description The Auto org that governs the connection, if one was named at connect */
+            auto_org?: string | null;
+            tier?: components["schemas"]["Connections.Tier"];
+            server_status?: components["schemas"]["Connections.Tier"];
+            policy?: {
+                [key: string]: components["schemas"]["Connections.Mode"];
+            };
+            scopes_requested?: string[];
+            scopes_granted?: string[];
+            /** Format: date-time */
+            token_expires_at?: string | null;
+            created_by?: string;
+            /** Format: date-time */
+            created_at?: string;
+            /** Format: date-time */
+            updated_at?: string;
+            /** Format: date-time */
+            revoked_at?: string | null;
+        };
+        "Connections.ConnectRequest": {
+            server: string;
+            /** @description Tools to enable (default: the manifest defaults) */
+            tools?: string[];
+            /** @description The Auto org that governs the connection. A connect carrying it always answers 428 APPROVAL_REQUIRED first. */
+            auto_org?: string;
+        };
+        "Connections.ConnectResponse": {
+            connection: components["schemas"]["Connections.Connection"];
+            /**
+             * Format: uri
+             * @description A person opens this to consent at the vendor
+             */
+            authorize_url: string;
+            next?: string;
+        };
+        "Connections.AuthorizeResponse": {
+            /** Format: uri */
+            authorize_url: string;
+            next?: string;
+        };
+        "Connections.ConnectionTool": {
+            name: string;
+            effect: components["schemas"]["Connections.Effect"];
+            mode: components["schemas"]["Connections.Mode"];
+            stored_mode?: components["schemas"]["Connections.Mode"];
+            scopes?: string[];
+            description?: components["schemas"]["Connections.UntrustedText"];
+            inputSchema?: unknown;
+            schema_flags?: string[];
+        };
+        "Connections.ToolList": {
+            connection: string;
+            server: string;
+            tier?: components["schemas"]["Connections.Tier"];
+            server_status?: components["schemas"]["Connections.Tier"];
+            manifest_sha256?: string | null;
+            tools: components["schemas"]["Connections.ConnectionTool"][];
+        };
+        "Connections.ToolPolicyRequest": {
+            /** @description Tool name to mode, e.g. {"create_issue": "approve"} */
+            tools: {
+                [key: string]: components["schemas"]["Connections.Mode"];
+            };
+        };
+        "Connections.ToolPolicyResponse": {
+            connection: components["schemas"]["Connections.Connection"];
+            changed: {
+                name?: string;
+                effect?: components["schemas"]["Connections.Effect"];
+                from?: components["schemas"]["Connections.Mode"];
+                to?: components["schemas"]["Connections.Mode"];
+            }[];
+            reauthorize?: {
+                missing_scopes?: string[];
+                /** Format: uri */
+                authorize_url?: string;
+            };
+        };
+        "Connections.CallRequest": {
+            /** @description The tool's arguments, as its inputSchema describes */
+            arguments: {
+                [key: string]: unknown;
+            };
+        };
+        "Connections.CallResult": {
+            call_id: string;
+            /** @enum {string} */
+            outcome: "ok" | "tool_error";
+            result: components["schemas"]["Connections.UntrustedResult"];
+            auto_check_id?: string | null;
+            /** @description Auto's signed receipt (JWS) */
+            auto_receipt?: string | null;
+            approval_id?: string | null;
+        };
+        "Connections.RevokeResponse": {
+            connection: components["schemas"]["Connections.Connection"];
+            vendor_revoked?: boolean;
+            tokens_deleted?: boolean;
+        };
+        "Connections.ActivityRow": {
+            seq: number;
+            /** Format: date-time */
+            at?: string;
+            kind: string;
+            connection_id?: string | null;
+            principal?: string | null;
+            tool?: string | null;
+            args_sha256?: string | null;
+            result_sha256?: string | null;
+            outcome: string;
+            prev_hash?: string;
+            hash: string;
+        } & {
+            [key: string]: unknown;
+        };
+        "Connections.ConnectedTool": {
+            /** @description conn.<connection>.<tool> */
+            name: string;
+            connection: string;
+            server: string;
+            tool: string;
+            effect: components["schemas"]["Connections.Effect"];
+            mode?: components["schemas"]["Connections.Mode"];
+            description?: components["schemas"]["Connections.UntrustedText"];
+            inputSchema?: unknown;
+            schema_flags?: string[];
+        };
+        "Connections.SearchToolsResponse": {
+            data: components["schemas"]["Connections.ConnectedTool"][];
+            session_tainted?: boolean;
+        };
+        "Agents.AgentSearchResults": {
+            results: components["schemas"]["Agents.AgentSearchHit"][];
+        };
+        /** @description One public agent. Optional keys are omitted when the owner did not disclose them. */
+        "Agents.AgentSearchHit": {
+            /** @description The agent's IAM id (a_...) */
+            agentId: string;
+            /** @description The agent's canonical DID (did:oas:agent:...) */
+            did: string;
+            /**
+             * @description IAM vouches for this public identity
+             * @constant
+             */
+            verified: true;
+            /**
+             * @description Always live; Sandbox agents are never indexed
+             * @constant
+             */
+            environment: "live";
+            /** @description The agent's name (when disclosed) */
+            name?: string;
+            /** @description The owning organization (when its name is disclosed). Never a person. */
+            owner?: {
+                name: string;
+            };
+            /** @description The owner's public description (when disclosed) */
+            description?: string;
+            /** @description When the agent was created */
+            createdAt?: number;
+        };
+        "Agents.AgentSitemap": {
+            agents: {
+                agentId: string;
+                /** @description When the agent's public content last changed */
+                updatedAt: number;
+            }[];
+        };
     };
     responses: {
         /** @description Foundry API error. */
@@ -41472,6 +41999,69 @@ export interface components {
                 "application/json": components["schemas"]["Garden.Disbursement"];
             };
         };
+        /** @description Missing scope; `TOOL_DENIED` (policy deny or not in the manifest); `AUTHORITY_DENIED` with `reasons` (Auto denied); `APPROVAL_UNAVAILABLE` (an approval is needed but the org has no Auto org) */
+        "Connections.Forbidden": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description Not found in your organization and environment */
+        "Connections.NotFound": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description `revoked`, `conflict` (the policy changed meanwhile), or an approval refusal: `APPROVAL_CONSUMED`, `APPROVAL_NOT_APPROVED`, `APPROVAL_MISMATCH` */
+        "Connections.Conflict": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description `CONNECTION_NEEDS_REAUTH`: a person opens the fresh `authorize_url` (an approval refusal or `revoked` is also a 409, without it) */
+        "Connections.NeedsReauth": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.NeedsReauth"];
+            };
+        };
+        /** @description `TOOL_CHANGED_PENDING_REVIEW`: the server's live tools differ from its pinned manifest; it is suspended for every organization until re-verified */
+        "Connections.ToolChanged": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description Invalid request body or parameters */
+        "Connections.Invalid": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.Error"];
+            };
+        };
+        /** @description `APPROVAL_REQUIRED`: a human approves `approval_request_id` in Auto; then retry the same request with `OneOS-Approval` */
+        "Connections.ApprovalRequired": {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Connections.ApprovalRequired"];
+            };
+        };
     };
     parameters: {
         /** @description Zone name, e.g. example.com */
@@ -41662,6 +42252,14 @@ export interface components {
         "Brews.DecisionId": string;
         /** @description Stable key; a retry with it returns the original decision instead of creating another */
         "Brews.RequiredIdempotencyKey": string;
+        /** @description Connection id (conn_ followed by 32 hex) */
+        "Connections.Id": string;
+        /** @description Catalog server id, e.g. linear, neon, sentry */
+        "Connections.Server": string;
+        /** @description The tool's name in the pinned manifest */
+        "Connections.Tool": string;
+        /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+        "Connections.Approval": string;
     };
     requestBodies: never;
     headers: {
@@ -42755,29 +43353,6 @@ export interface operations {
             default: components["responses"]["Foundry.Error"];
         };
     };
-    foundry_downloadFile: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                file_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description File bytes. */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": string;
-                };
-            };
-            default: components["responses"]["Foundry.Error"];
-        };
-    };
     foundry_listFineTuningProviders: {
         parameters: {
             query?: never;
@@ -45403,7 +45978,7 @@ export interface operations {
             };
         };
     };
-    hives_get_sso_config: {
+    hives_get_org_usage: {
         parameters: {
             query?: never;
             header?: never;
@@ -45415,7 +45990,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description SSO configuration */
+            /** @description Organization usage summary */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -45438,7 +46013,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description SSO service unavailable */
+            /** @description Billing service unavailable */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -45447,69 +46022,20 @@ export interface operations {
             };
         };
     };
-    hives_create_sso_connection: {
+    hives_create_checkout: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                /** @description Organization ID */
-                org_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["Hives.CreateSsoConnectionRequest"];
-            };
-        };
-        responses: {
-            /** @description SSO connection created */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>;
-                };
-            };
-            /** @description Unauthorized */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Organization not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description SSO service unavailable */
-            503: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    hives_delete_sso_connection: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Organization ID */
-                org_id: string;
-                /** @description SSO connection ID */
-                connection_id: string;
+                "application/json": components["schemas"]["Hives.CreateCheckoutRequest"];
             };
-            cookie?: never;
         };
-        requestBody?: never;
         responses: {
-            /** @description SSO connection deleted */
+            /** @description Checkout session created */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -45525,14 +46051,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Organization or connection not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description SSO service unavailable */
+            /** @description Payments service unavailable */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -45541,19 +46060,16 @@ export interface operations {
             };
         };
     };
-    hives_get_org_usage: {
+    hives_list_payment_methods: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                /** @description Organization ID */
-                org_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Organization usage summary */
+            /** @description Payment methods */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -45569,14 +46085,7 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Organization not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Billing service unavailable */
+            /** @description Payments service unavailable */
             503: {
                 headers: {
                     [name: string]: unknown;
@@ -45585,7 +46094,7 @@ export interface operations {
             };
         };
     };
-    hives_create_checkout: {
+    hives_add_payment_method: {
         parameters: {
             query?: never;
             header?: never;
@@ -45594,83 +46103,11 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["Hives.CreateCheckoutRequest"];
+                "application/json": components["schemas"]["Hives.AddPaymentMethodRequest"];
             };
         };
         responses: {
-            /** @description Checkout session created */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>;
-                };
-            };
-            /** @description Unauthorized */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Payments service unavailable */
-            503: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    hives_list_payment_methods: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Payment methods */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>;
-                };
-            };
-            /** @description Unauthorized */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Payments service unavailable */
-            503: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    hives_add_payment_method: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["Hives.AddPaymentMethodRequest"];
-            };
-        };
-        responses: {
-            /** @description Payment method added */
+            /** @description Payment method added */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -70399,6 +70836,95 @@ export interface operations {
             };
         };
     };
+    dials_deleteWorkflow: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workflow_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Dials.DeleteWorkflow"];
+            };
+        };
+        responses: {
+            /** @description Deleted. The descriptor rows are gone; audit records are kept. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.DeleteWorkflowReceipt"];
+                };
+            };
+            /** @description Invalid scope or request shape. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+            /** @description Missing or invalid verified identity. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+            /** @description Selected scope is not authorized by signed identity or lacks the required Dials grant. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+            /** @description No workflow with this id in the authorized scope (workflow_not_found). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+            /** @description A held number is assigned to this workflow (workflow_number_attached); unassign it first. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+            /** @description Durable store failed. */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+            /** @description Backend is not ready. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Dials.CustomerError"];
+                };
+            };
+        };
+    };
     dials_deleteNumber: {
         parameters: {
             query: {
@@ -110048,4 +110574,491 @@ export interface operations {
             };
         };
     };
+    connections_listCatalog: {
+        parameters: {
+            query?: {
+                /** @description OneOS plugin category the server competes in, e.g. scopes, silos, traces */
+                plugin?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Catalog servers */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Connections.CatalogServer"][];
+                    };
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+        };
+    };
+    connections_getCatalogServer: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Catalog server id, e.g. linear, neon, sentry */
+                server: components["parameters"]["Connections.Server"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The server and its pinned manifest */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.CatalogServerDetail"];
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_list: {
+        parameters: {
+            query?: {
+                status?: "pending_auth" | "active" | "needs_reauth" | "revoked";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Connections */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Connections.Connection"][];
+                    };
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+        };
+    };
+    connections_connect: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+                "OneOS-Approval"?: components["parameters"]["Connections.Approval"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Connections.ConnectRequest"];
+            };
+        };
+        responses: {
+            /** @description Connection created, waiting for a person to authorize it */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.ConnectResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.Conflict"];
+            410: components["responses"]["Connections.ToolChanged"];
+            422: components["responses"]["Connections.Invalid"];
+            428: components["responses"]["Connections.ApprovalRequired"];
+        };
+    };
+    connections_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The connection */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.Connection"];
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_revoke: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Revoked */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.RevokeResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_authorize: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The URL a person opens to consent at the vendor */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.AuthorizeResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.Conflict"];
+        };
+    };
+    connections_listTools: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Tools */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.ToolList"];
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+            410: components["responses"]["Connections.ToolChanged"];
+        };
+    };
+    connections_setToolPolicy: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+                "OneOS-Approval"?: components["parameters"]["Connections.Approval"];
+            };
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Connections.ToolPolicyRequest"];
+            };
+        };
+        responses: {
+            /** @description The connection with its new policy and the changes made */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.ToolPolicyResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.Conflict"];
+            422: components["responses"]["Connections.Invalid"];
+            428: components["responses"]["Connections.ApprovalRequired"];
+        };
+    };
+    connections_call: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description An approved approval id (`apr_…`) from an earlier 428, to retry the same request */
+                "OneOS-Approval"?: components["parameters"]["Connections.Approval"];
+            };
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+                /** @description The tool's name in the pinned manifest */
+                tool: components["parameters"]["Connections.Tool"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["Connections.CallRequest"];
+            };
+        };
+        responses: {
+            /** @description The call's outcome and its wrapped result */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.CallResult"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+            404: components["responses"]["Connections.NotFound"];
+            409: components["responses"]["Connections.NeedsReauth"];
+            410: components["responses"]["Connections.ToolChanged"];
+            422: components["responses"]["Connections.Invalid"];
+            428: components["responses"]["Connections.ApprovalRequired"];
+        };
+    };
+    connections_activity: {
+        parameters: {
+            query?: {
+                /** @description Return rows with a larger `seq` (default 0) */
+                after?: number;
+                /** @description Page size, 1-500 (default 100) */
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                /** @description Connection id (conn_ followed by 32 hex) */
+                id: components["parameters"]["Connections.Id"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ledger rows */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Connections.ActivityRow"][];
+                        next_after?: number | null;
+                    };
+                };
+            };
+            404: components["responses"]["Connections.NotFound"];
+        };
+    };
+    connections_searchTools: {
+        parameters: {
+            query?: {
+                /** @description Keywords */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Matching connected tools */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Connections.SearchToolsResponse"];
+                };
+            };
+            403: components["responses"]["Connections.Forbidden"];
+        };
+    };
+    connections_oauthCallback: {
+        parameters: {
+            query?: {
+                state?: string;
+                code?: string;
+                iss?: string;
+                error?: string;
+                error_description?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description A page telling the person the connection is ready (or what failed) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+            /** @description Unknown, used or expired state */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+        };
+    };
+    agents_search: {
+        parameters: {
+            query: {
+                /** @description What to search for, 1 to 200 characters. */
+                q: string;
+                /** @description Most results to return, 1 to 20 (default 20). */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Matching public agents, best first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Agents.AgentSearchResults"];
+                };
+            };
+            /** @description INVALID_QUERY (q or limit out of range) or INVALID_REQUEST (another query key */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description METHOD_NOT_ALLOWED (after a credential verifies; without one */
+            405: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description RATE_LIMITED */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description BAD_GATEWAY (the index answered outside its contract; nothing is passed through) */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description AGENT_INDEX_UNAVAILABLE or SERVICE_DISABLED */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    agents_sitemap: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Public agent ids */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Agents.AgentSitemap"];
+                };
+            };
+            /** @description INVALID_REQUEST (a query string or a body) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description METHOD_NOT_ALLOWED (after a credential verifies; without one */
+            405: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description RATE_LIMITED */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description BAD_GATEWAY */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description AGENT_INDEX_UNAVAILABLE or SERVICE_DISABLED */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
 }