@onesi/genesis 0.2.2 → 0.2.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/README.md +1 -1
  2. package/dist/boxes.d.ts +1 -1
  3. package/dist/boxes.js +1 -1
  4. package/dist/client.d.ts +8 -1
  5. package/dist/client.js +43 -6
  6. package/dist/errors.d.ts +4 -0
  7. package/dist/errors.js +30 -1
  8. package/dist/foundry.d.ts +3 -2
  9. package/dist/foundry.js +3 -2
  10. package/dist/generated/operations.js +79 -39
  11. package/dist/generated/schema.d.ts +93 -21
  12. package/dist/genesis.d.ts +1 -1
  13. package/dist/genesis.openapi.json +245 -50
  14. package/dist/idempotency.js +6 -1
  15. package/dist/index.d.ts +1 -1
  16. package/dist/index.js +1 -1
  17. package/dist/redact.d.ts +0 -6
  18. package/dist/redact.js +3 -2
  19. package/dist/urls.d.ts +9 -0
  20. package/dist/urls.js +61 -0
  21. package/package.json +1 -1
package/README.md CHANGED
@@ -3,7 +3,7 @@
3
3
  The TypeScript SDK for OneOS. One typed client for every Genesis service, through the Genesis API at `https://os.one.ml/api`.
4
4
 
5
5
  ```sh
6
- npm install @onesi/genesis@0.2.2
6
+ npm install @onesi/genesis@0.2.4
7
7
  ```
8
8
 
9
9
  ```ts
package/dist/boxes.d.ts CHANGED
@@ -3,7 +3,7 @@ import type { OperationInput as In } from './types.js';
3
3
  /** Boxes (mail, docs, files, sheets, slides, calendar, identity, MCP): one method per operation, grouped as the
4
4
  * Boxes resource tree. Path parameters come first, then the body, then query options, then an optional
5
5
  * idempotency key on the operations that take one. Operations that stream or download bytes return the raw Response;
6
- * uploads take a FormData body. GET needs boxes:read, everything else boxes:write. Generated from the Boxes spec. */
6
+ * uploads take a FormData body. GET needs boxes:read, everything else boxes:write; mail domain administration needs boxes:admin. Generated from the Boxes spec. */
7
7
  export declare function boxesModule(client: GenesisClient): {
8
8
  mail: {
9
9
  addresses: {
package/dist/boxes.js CHANGED
@@ -2,7 +2,7 @@ import { idempotencyHeaders } from './idempotency.js';
2
2
  /** Boxes (mail, docs, files, sheets, slides, calendar, identity, MCP): one method per operation, grouped as the
3
3
  * Boxes resource tree. Path parameters come first, then the body, then query options, then an optional
4
4
  * idempotency key on the operations that take one. Operations that stream or download bytes return the raw Response;
5
- * uploads take a FormData body. GET needs boxes:read, everything else boxes:write. Generated from the Boxes spec. */
5
+ * uploads take a FormData body. GET needs boxes:read, everything else boxes:write; mail domain administration needs boxes:admin. Generated from the Boxes spec. */
6
6
  export function boxesModule(client) {
7
7
  return {
8
8
  mail: {
package/dist/client.d.ts CHANGED
@@ -25,8 +25,15 @@ export interface GenesisOptions {
25
25
  headers?: Record<string, string>;
26
26
  userAgent?: string;
27
27
  }
28
+ /**
29
+ * Redact URL userinfo from an error's message, stack and cause chain (bounded). If the error is frozen or any of
30
+ * those properties cannot be rewritten, return a new sanitized Error instead of the original.
31
+ */
32
+ export declare function scrubError(e: unknown, depth?: number): unknown;
28
33
  export declare class GenesisClient {
29
- readonly baseUrl: string;
34
+ /** The configured gateway root, kept without userinfo so it is safe to log or print. */
35
+ get baseUrl(): string;
36
+ private readonly root;
30
37
  readonly routing: 'gateway' | 'direct';
31
38
  private readonly opts;
32
39
  private readonly fetchImpl;
package/dist/client.js CHANGED
@@ -8,7 +8,7 @@ import { blindsOperationKey, blindsOwnerTransport, isBlindsOwnerOperation } from
8
8
  import { isHivesObjectUpload, hivesObjectBody, hivesContentType, isHivesResourceOperation, resourceError, resourceErrorFromResponse } from './hives-resources-transport.js';
9
9
  import { operationTable, services } from './generated/operations.js';
10
10
  import { GenesisError } from './errors.js';
11
- import { requireSecureUrl } from './urls.js';
11
+ import { requireSecureUrl, redactUserinfo, stripUserinfo } from './urls.js';
12
12
  import { iamDirectoryFailure, isIamDirectoryOperation } from './iam-directory.js';
13
13
  import { validateHivesInvocation, hivesFunctionResponseHeaders, hivesFunctionMetadata, hivesOperationError } from './hives-functions.js';
14
14
  import { validateHivesEnvironment, validateHivesEnvironmentNames, hivesEnvironmentSetNames, hivesEnvironmentMetadata, hivesEnvironmentReveal } from './hives-environment.js';
@@ -21,20 +21,57 @@ const ENDLESS_STREAMS = {
21
21
  hives_stream_logs: 'genesis.hives.logs.stream() or genesis.hives.logs.window()',
22
22
  hives_stream_deployment_logs: 'hivesSseWindow(await genesis.raw(...))',
23
23
  };
24
+ const SCRUB_DEPTH = 5;
25
+ /**
26
+ * Redact URL userinfo from an error's message, stack and cause chain (bounded). If the error is frozen or any of
27
+ * those properties cannot be rewritten, return a new sanitized Error instead of the original.
28
+ */
29
+ export function scrubError(e, depth = 0) {
30
+ if (typeof e === 'string')
31
+ return redactUserinfo(e);
32
+ if (!(e instanceof Error))
33
+ return e;
34
+ if (depth >= SCRUB_DEPTH)
35
+ return undefined;
36
+ const message = redactUserinfo(String(e.message));
37
+ const stack = typeof e.stack === 'string' ? redactUserinfo(e.stack) : e.stack;
38
+ const hasCause = 'cause' in e;
39
+ const cause = hasCause ? scrubError(e.cause, depth + 1) : undefined;
40
+ if (message === e.message && stack === e.stack && cause === e.cause)
41
+ return e;
42
+ try {
43
+ if (Object.isFrozen(e))
44
+ throw e;
45
+ Object.defineProperty(e, 'message', { value: message, writable: true, configurable: true, enumerable: false });
46
+ Object.defineProperty(e, 'stack', { value: stack, writable: true, configurable: true, enumerable: false });
47
+ if (hasCause)
48
+ Object.defineProperty(e, 'cause', { value: cause, writable: true, configurable: true, enumerable: false });
49
+ if (e.message === message && e.stack === stack && (!hasCause || e.cause === cause))
50
+ return e;
51
+ }
52
+ catch { /* fall through to a fresh error */ }
53
+ const fresh = new (e instanceof TypeError ? TypeError : Error)(message, hasCause ? { cause } : undefined);
54
+ fresh.name = redactUserinfo(String(e.name));
55
+ fresh.stack = stack;
56
+ return fresh;
57
+ }
24
58
  export class GenesisClient {
25
- baseUrl;
59
+ /** The configured gateway root, kept without userinfo so it is safe to log or print. */
60
+ get baseUrl() { return stripUserinfo(this.root); }
61
+ root;
26
62
  routing;
27
63
  opts;
28
64
  fetchImpl;
29
65
  get contextFetch() { return this.fetchImpl; }
30
66
  constructor(opts = {}) {
31
67
  this.opts = opts;
32
- this.baseUrl = requireSecureUrl(opts.baseUrl ?? env.GENESIS_BASE_URL ?? DEFAULT_BASE_URL, 'baseUrl').replace(/\/+$/, '');
68
+ this.root = requireSecureUrl(opts.baseUrl ?? env.GENESIS_BASE_URL ?? DEFAULT_BASE_URL, 'baseUrl').replace(/\/+$/, '');
33
69
  this.routing = opts.routing ?? (env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway');
34
70
  const f = opts.fetch ?? globalThis.fetch;
35
71
  if (!f)
36
72
  throw new Error('No fetch available; pass options.fetch');
37
- this.fetchImpl = f.bind(globalThis);
73
+ // fetch errors can quote the request URL (and its userinfo); scrub them before they surface.
74
+ this.fetchImpl = ((input, init) => f.call(globalThis, input, init).catch((e) => { throw scrubError(e); }));
38
75
  }
39
76
  static operations = operationTable;
40
77
  static services = services;
@@ -68,7 +105,7 @@ export class GenesisClient {
68
105
  p = fill(op.upstream.path);
69
106
  }
70
107
  else {
71
- base = this.baseUrl;
108
+ base = this.root;
72
109
  p = fill(op.path);
73
110
  }
74
111
  const qs = new URLSearchParams();
@@ -189,7 +226,7 @@ export class GenesisClient {
189
226
  const url = this.url(operationId, input);
190
227
  const headers = {
191
228
  accept: 'application/json',
192
- 'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.2.2',
229
+ 'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.2.4',
193
230
  ...this.opts.headers, ...init.headers,
194
231
  };
195
232
  if (op.service === 'blinds' && !['GET', 'HEAD', 'OPTIONS'].includes(op.method))
package/dist/errors.d.ts CHANGED
@@ -1,3 +1,7 @@
1
+ /** An error body is read to at most this many bytes, before any parsing or redaction; the rest is dropped. */
2
+ export declare const ERROR_BODY_READ_LIMIT: number;
3
+ /** Read at most `limit` bytes of a response body as text, cancelling the stream once the limit is reached. */
4
+ export declare function readCappedText(res: Response, limit?: number): Promise<string>;
1
5
  /** Normalized error for every Genesis service (gateway `{error:{type,message}}`, IAM `{error,error_description}`, Relays `{error}`, Foundry/OpenAI shape). */
2
6
  export declare class GenesisError extends Error {
3
7
  readonly status: number;
package/dist/errors.js CHANGED
@@ -1,4 +1,33 @@
1
1
  import { authorizationCode, redactErrorBody } from './redact.js';
2
+ /** An error body is read to at most this many bytes, before any parsing or redaction; the rest is dropped. */
3
+ export const ERROR_BODY_READ_LIMIT = 64 * 1024;
4
+ /** Read at most `limit` bytes of a response body as text, cancelling the stream once the limit is reached. */
5
+ export async function readCappedText(res, limit = ERROR_BODY_READ_LIMIT) {
6
+ const reader = res.body?.getReader();
7
+ if (!reader)
8
+ return (await res.text()).slice(0, limit);
9
+ const decoder = new TextDecoder();
10
+ let text = '';
11
+ let bytes = 0;
12
+ try {
13
+ for (;;) {
14
+ const { done, value } = await reader.read();
15
+ if (done)
16
+ break;
17
+ const room = limit - bytes;
18
+ text += decoder.decode(value.byteLength > room ? value.subarray(0, room) : value, { stream: true });
19
+ bytes += Math.min(value.byteLength, room);
20
+ if (bytes >= limit) {
21
+ void reader.cancel().catch(() => { });
22
+ break;
23
+ }
24
+ }
25
+ return text + decoder.decode();
26
+ }
27
+ finally {
28
+ reader.releaseLock?.();
29
+ }
30
+ }
2
31
  /** Normalized error for every Genesis service (gateway `{error:{type,message}}`, IAM `{error,error_description}`, Relays `{error}`, Foundry/OpenAI shape). */
3
32
  export class GenesisError extends Error {
4
33
  status;
@@ -16,7 +45,7 @@ export class GenesisError extends Error {
16
45
  this.body = init.body;
17
46
  }
18
47
  static async fromResponse(res, operationId) {
19
- const text = await res.text().catch(() => '');
48
+ const text = await readCappedText(res).catch(() => '');
20
49
  let body = text;
21
50
  try {
22
51
  body = text ? JSON.parse(text) : undefined;
package/dist/foundry.d.ts CHANGED
@@ -266,7 +266,8 @@ export declare function foundryModule(client: GenesisClient): {
266
266
  [key: string]: unknown;
267
267
  }>;
268
268
  };
269
- /** OpenRouter-style generation lookup by request id; content and feedback need Foundry `admin` (refused today). */
269
+ /** OpenRouter-style generation lookup by request id, retained content and feedback for your own generations (not billed).
270
+ * Feedback requires an idempotency key (8-128 characters of A-Z a-z 0-9 _ . : -); reuse it to retry. */
270
271
  generation: {
271
272
  get: (id: string) => Promise<{
272
273
  data: {
@@ -286,7 +287,7 @@ export declare function foundryModule(client: GenesisClient): {
286
287
  content: (id: string) => Promise<{
287
288
  [key: string]: unknown;
288
289
  }>;
289
- feedback: (body: In<"foundry_submitGenerationFeedback">["body"]) => Promise<{
290
+ feedback: (body: In<"foundry_submitGenerationFeedback">["body"], idempotencyKey: string) => Promise<{
290
291
  [key: string]: unknown;
291
292
  }>;
292
293
  };
package/dist/foundry.js CHANGED
@@ -85,11 +85,12 @@ export function foundryModule(client) {
85
85
  status: (workload_id) => client.request('foundry_getWorkloadStatus', { workload_id }),
86
86
  terminate: (workload_id) => client.request('foundry_terminateWorkload', { workload_id }),
87
87
  },
88
- /** OpenRouter-style generation lookup by request id; content and feedback need Foundry `admin` (refused today). */
88
+ /** OpenRouter-style generation lookup by request id, retained content and feedback for your own generations (not billed).
89
+ * Feedback requires an idempotency key (8-128 characters of A-Z a-z 0-9 _ . : -); reuse it to retry. */
89
90
  generation: {
90
91
  get: (id) => client.request('foundry_getGeneration', { id }),
91
92
  content: (id) => client.request('foundry_getGenerationContent', { id }),
92
- feedback: (body) => client.request('foundry_submitGenerationFeedback', { body }),
93
+ feedback: async (body, idempotencyKey) => client.request('foundry_submitGenerationFeedback', { body }, { headers: idempotencyHeaders('foundry_submitGenerationFeedback', idempotencyKey) }),
93
94
  },
94
95
  batches: {
95
96
  create: (body) => client.request('foundry_createBatch', { body }),
package/dist/generated/operations.js CHANGED
@@ -2345,7 +2345,7 @@ export const operationTable = {
2345
2345
  "method": "GET",
2346
2346
  "path": "/v1/files"
2347
2347
  },
2348
- "mcp": false,
2348
+ "mcp": true,
2349
2349
  "internal": false,
2350
2350
  "public": false,
2351
2351
  "pathParams": [],
@@ -2368,7 +2368,7 @@ export const operationTable = {
2368
2368
  "method": "POST",
2369
2369
  "path": "/v1/files"
2370
2370
  },
2371
- "mcp": false,
2371
+ "mcp": true,
2372
2372
  "internal": false,
2373
2373
  "public": false,
2374
2374
  "pathParams": [],
@@ -2407,7 +2407,7 @@ export const operationTable = {
2407
2407
  "method": "GET",
2408
2408
  "path": "/v1/files/{file_id}"
2409
2409
  },
2410
- "mcp": false,
2410
+ "mcp": true,
2411
2411
  "internal": false,
2412
2412
  "public": false,
2413
2413
  "pathParams": [
@@ -2439,7 +2439,7 @@ export const operationTable = {
2439
2439
  "method": "DELETE",
2440
2440
  "path": "/v1/files/{file_id}"
2441
2441
  },
2442
- "mcp": false,
2442
+ "mcp": true,
2443
2443
  "internal": false,
2444
2444
  "public": false,
2445
2445
  "pathParams": [
@@ -2471,7 +2471,7 @@ export const operationTable = {
2471
2471
  "method": "GET",
2472
2472
  "path": "/v1/files/{file_id}/content"
2473
2473
  },
2474
- "mcp": false,
2474
+ "mcp": true,
2475
2475
  "internal": false,
2476
2476
  "public": false,
2477
2477
  "pathParams": [
@@ -2503,7 +2503,7 @@ export const operationTable = {
2503
2503
  "method": "GET",
2504
2504
  "path": "/v1/fine_tuning/providers"
2505
2505
  },
2506
- "mcp": false,
2506
+ "mcp": true,
2507
2507
  "internal": false,
2508
2508
  "public": false,
2509
2509
  "pathParams": [],
@@ -2526,7 +2526,7 @@ export const operationTable = {
2526
2526
  "method": "GET",
2527
2527
  "path": "/v1/fine_tuning/jobs"
2528
2528
  },
2529
- "mcp": false,
2529
+ "mcp": true,
2530
2530
  "internal": false,
2531
2531
  "public": false,
2532
2532
  "pathParams": [],
@@ -2549,7 +2549,7 @@ export const operationTable = {
2549
2549
  "method": "POST",
2550
2550
  "path": "/v1/fine_tuning/jobs"
2551
2551
  },
2552
- "mcp": false,
2552
+ "mcp": true,
2553
2553
  "internal": false,
2554
2554
  "public": false,
2555
2555
  "pathParams": [],
@@ -2663,7 +2663,7 @@ export const operationTable = {
2663
2663
  "method": "GET",
2664
2664
  "path": "/v1/fine_tuning/jobs/{job_id}"
2665
2665
  },
2666
- "mcp": false,
2666
+ "mcp": true,
2667
2667
  "internal": false,
2668
2668
  "public": false,
2669
2669
  "pathParams": [
@@ -2695,7 +2695,7 @@ export const operationTable = {
2695
2695
  "method": "DELETE",
2696
2696
  "path": "/v1/fine_tuning/jobs/{job_id}"
2697
2697
  },
2698
- "mcp": false,
2698
+ "mcp": true,
2699
2699
  "internal": false,
2700
2700
  "public": false,
2701
2701
  "pathParams": [
@@ -2727,7 +2727,7 @@ export const operationTable = {
2727
2727
  "method": "GET",
2728
2728
  "path": "/v1/fine_tuning/jobs/{job_id}/events"
2729
2729
  },
2730
- "mcp": false,
2730
+ "mcp": true,
2731
2731
  "internal": false,
2732
2732
  "public": false,
2733
2733
  "pathParams": [
@@ -2759,7 +2759,7 @@ export const operationTable = {
2759
2759
  "method": "POST",
2760
2760
  "path": "/v1/fine_tuning/jobs/{job_id}/cancel"
2761
2761
  },
2762
- "mcp": false,
2762
+ "mcp": true,
2763
2763
  "internal": false,
2764
2764
  "public": false,
2765
2765
  "pathParams": [
@@ -2791,7 +2791,7 @@ export const operationTable = {
2791
2791
  "method": "GET",
2792
2792
  "path": "/v1/fine_tuning/jobs/{job_id}/checkpoints"
2793
2793
  },
2794
- "mcp": false,
2794
+ "mcp": true,
2795
2795
  "internal": false,
2796
2796
  "public": false,
2797
2797
  "pathParams": [
@@ -2823,7 +2823,7 @@ export const operationTable = {
2823
2823
  "method": "GET",
2824
2824
  "path": "/v1/fine_tuning/models"
2825
2825
  },
2826
- "mcp": false,
2826
+ "mcp": true,
2827
2827
  "internal": false,
2828
2828
  "public": false,
2829
2829
  "pathParams": [],
@@ -2846,7 +2846,7 @@ export const operationTable = {
2846
2846
  "method": "GET",
2847
2847
  "path": "/v1/fine_tuning/models/{model_id}"
2848
2848
  },
2849
- "mcp": false,
2849
+ "mcp": true,
2850
2850
  "internal": false,
2851
2851
  "public": false,
2852
2852
  "pathParams": [
@@ -2878,7 +2878,7 @@ export const operationTable = {
2878
2878
  "method": "POST",
2879
2879
  "path": "/api/beta/batches"
2880
2880
  },
2881
- "mcp": false,
2881
+ "mcp": true,
2882
2882
  "internal": false,
2883
2883
  "public": false,
2884
2884
  "pathParams": [],
@@ -2932,7 +2932,7 @@ export const operationTable = {
2932
2932
  "method": "GET",
2933
2933
  "path": "/api/beta/batches/{batch_id}"
2934
2934
  },
2935
- "mcp": false,
2935
+ "mcp": true,
2936
2936
  "internal": false,
2937
2937
  "public": false,
2938
2938
  "pathParams": [
@@ -2995,7 +2995,7 @@ export const operationTable = {
2995
2995
  "method": "GET",
2996
2996
  "path": "/api/v1/generation/content"
2997
2997
  },
2998
- "mcp": false,
2998
+ "mcp": true,
2999
2999
  "internal": false,
3000
3000
  "public": false,
3001
3001
  "pathParams": [],
@@ -3026,13 +3026,14 @@ export const operationTable = {
3026
3026
  "method": "POST",
3027
3027
  "path": "/api/v1/generation/feedback"
3028
3028
  },
3029
- "mcp": false,
3029
+ "mcp": true,
3030
3030
  "internal": false,
3031
3031
  "public": false,
3032
3032
  "pathParams": [],
3033
3033
  "queryParams": [],
3034
3034
  "hasBody": true,
3035
3035
  "requestContentType": "application/json",
3036
+ "idempotencyKey": "required",
3036
3037
  "inputSchema": {
3037
3038
  "type": "object",
3038
3039
  "properties": {
@@ -3081,7 +3082,7 @@ export const operationTable = {
3081
3082
  "method": "GET",
3082
3083
  "path": "/api/v1/activity"
3083
3084
  },
3084
- "mcp": false,
3085
+ "mcp": true,
3085
3086
  "internal": false,
3086
3087
  "public": false,
3087
3088
  "pathParams": [],
@@ -3104,7 +3105,7 @@ export const operationTable = {
3104
3105
  "method": "GET",
3105
3106
  "path": "/api/v1/activity/export"
3106
3107
  },
3107
- "mcp": false,
3108
+ "mcp": true,
3108
3109
  "internal": false,
3109
3110
  "public": false,
3110
3111
  "pathParams": [],
@@ -3135,7 +3136,7 @@ export const operationTable = {
3135
3136
  "method": "GET",
3136
3137
  "path": "/api/v1/analytics/meta"
3137
3138
  },
3138
- "mcp": false,
3139
+ "mcp": true,
3139
3140
  "internal": false,
3140
3141
  "public": false,
3141
3142
  "pathParams": [],
@@ -3158,7 +3159,7 @@ export const operationTable = {
3158
3159
  "method": "POST",
3159
3160
  "path": "/api/v1/analytics/query"
3160
3161
  },
3161
- "mcp": false,
3162
+ "mcp": true,
3162
3163
  "internal": false,
3163
3164
  "public": false,
3164
3165
  "pathParams": [],
@@ -4398,24 +4399,30 @@ export const operationTable = {
4398
4399
  "body": {
4399
4400
  "type": "object",
4400
4401
  "required": [
4401
- "api_key"
4402
+ "label",
4403
+ "scopes"
4402
4404
  ],
4405
+ "description": "Body for creating or rotating a Sandbox prepaid native key through Genesis (Console key broker, gateway/src/foundry-key-write.ts). The secret is generated by Foundry and returned once; it is never sent by the caller.",
4403
4406
  "properties": {
4404
- "api_key": {
4405
- "type": "string",
4406
- "writeOnly": true
4407
- },
4408
4407
  "label": {
4409
4408
  "type": [
4410
4409
  "string",
4411
4410
  "null"
4412
- ]
4411
+ ],
4412
+ "maxLength": 120,
4413
+ "description": "Display label (UTF-8, at most 120 bytes, no control characters), or null."
4413
4414
  },
4414
4415
  "scopes": {
4415
4416
  "type": "array",
4417
+ "minItems": 1,
4418
+ "maxItems": 1,
4416
4419
  "items": {
4417
- "type": "string"
4418
- }
4420
+ "type": "string",
4421
+ "enum": [
4422
+ "foundry:gateway:invoke:prepaid"
4423
+ ]
4424
+ },
4425
+ "description": "Exactly [\"foundry:gateway:invoke:prepaid\"]."
4419
4426
  }
4420
4427
  },
4421
4428
  "additionalProperties": false
@@ -4477,7 +4484,8 @@ export const operationTable = {
4477
4484
  "key_id"
4478
4485
  ],
4479
4486
  "queryParams": [],
4480
- "hasBody": false,
4487
+ "hasBody": true,
4488
+ "requestContentType": "application/json",
4481
4489
  "idempotencyKey": "required",
4482
4490
  "inputSchema": {
4483
4491
  "type": "object",
@@ -4485,10 +4493,42 @@ export const operationTable = {
4485
4493
  "key_id": {
4486
4494
  "type": "string",
4487
4495
  "minLength": 1
4496
+ },
4497
+ "body": {
4498
+ "type": "object",
4499
+ "required": [
4500
+ "label",
4501
+ "scopes"
4502
+ ],
4503
+ "description": "Body for creating or rotating a Sandbox prepaid native key through Genesis (Console key broker, gateway/src/foundry-key-write.ts). The secret is generated by Foundry and returned once; it is never sent by the caller.",
4504
+ "properties": {
4505
+ "label": {
4506
+ "type": [
4507
+ "string",
4508
+ "null"
4509
+ ],
4510
+ "maxLength": 120,
4511
+ "description": "Display label (UTF-8, at most 120 bytes, no control characters), or null."
4512
+ },
4513
+ "scopes": {
4514
+ "type": "array",
4515
+ "minItems": 1,
4516
+ "maxItems": 1,
4517
+ "items": {
4518
+ "type": "string",
4519
+ "enum": [
4520
+ "foundry:gateway:invoke:prepaid"
4521
+ ]
4522
+ },
4523
+ "description": "Exactly [\"foundry:gateway:invoke:prepaid\"]."
4524
+ }
4525
+ },
4526
+ "additionalProperties": false
4488
4527
  }
4489
4528
  },
4490
4529
  "required": [
4491
- "key_id"
4530
+ "key_id",
4531
+ "body"
4492
4532
  ],
4493
4533
  "additionalProperties": false
4494
4534
  }
@@ -4526,7 +4566,7 @@ export const operationTable = {
4526
4566
  "method": "GET",
4527
4567
  "path": "/v1/provider-keys"
4528
4568
  },
4529
- "mcp": false,
4569
+ "mcp": true,
4530
4570
  "internal": false,
4531
4571
  "public": false,
4532
4572
  "pathParams": [],
@@ -4549,7 +4589,7 @@ export const operationTable = {
4549
4589
  "method": "POST",
4550
4590
  "path": "/v1/provider-keys"
4551
4591
  },
4552
- "mcp": false,
4592
+ "mcp": true,
4553
4593
  "internal": false,
4554
4594
  "public": false,
4555
4595
  "pathParams": [],
@@ -4599,7 +4639,7 @@ export const operationTable = {
4599
4639
  "method": "DELETE",
4600
4640
  "path": "/v1/provider-keys/{provider_id}"
4601
4641
  },
4602
- "mcp": false,
4642
+ "mcp": true,
4603
4643
  "internal": false,
4604
4644
  "public": false,
4605
4645
  "pathParams": [
@@ -4631,7 +4671,7 @@ export const operationTable = {
4631
4671
  "method": "PATCH",
4632
4672
  "path": "/v1/provider-keys/{provider_id}"
4633
4673
  },
4634
- "mcp": false,
4674
+ "mcp": true,
4635
4675
  "internal": false,
4636
4676
  "public": false,
4637
4677
  "pathParams": [
@@ -4677,7 +4717,7 @@ export const operationTable = {
4677
4717
  "method": "GET",
4678
4718
  "path": "/v1/provider-credential-policies"
4679
4719
  },
4680
- "mcp": false,
4720
+ "mcp": true,
4681
4721
  "internal": false,
4682
4722
  "public": false,
4683
4723
  "pathParams": [],
@@ -4700,7 +4740,7 @@ export const operationTable = {
4700
4740
  "method": "PUT",
4701
4741
  "path": "/v1/provider-credential-policies/{provider_id}"
4702
4742
  },
4703
- "mcp": false,
4743
+ "mcp": true,
4704
4744
  "internal": false,
4705
4745
  "public": false,
4706
4746
  "pathParams": [