@tai42/api-client 25.0.1 → 27.0.0

package/src/schemas/auth-routes.ts

@@ -16,10 +16,11 @@ export const removeScopeResult = openapi.scopeDeleteResult;
  * scope id, the public marker, or `null` when the path is unmapped (the mapper's
  * "unassigned" bucket source). `methods` is the route's method set with `HEAD`
  * removed. `tags` are the route's feature-group labels, `summary` its one-line
- * description, and `action` its authorization class — the join fields the Roles
- * grant editor reads to derive grantable feature groups and mark the admin-only
- * (fenced/secret) routes it must never offer a grant for. An unregistered path
- * carries `tags: []`, `summary: ''`, `action: null`. `declared_public` is `true` for
+ * description, `action` its authorization class, and `role_reach` the server's
+ * decision of what opens it for a non-admin role — the Roles grant editor groups
+ * routes by `tags` and offers a level only on a group with a `level` route. An
+ * unregistered path carries `tags: []`, `summary: ''`, `action: null`,
+ * `role_reach: null`. `declared_public` is `true` for
  * a route its registration declares public: it is served without authentication
  * and no scope mapping or public pin changes that, so the mapper never offers it
  * for a scope.
@@ -30,14 +31,23 @@ export const authRoutes = openapi.routeMappingList;
 
 /**
  * A route's authorization ACTION class, joined onto the catalog from the route
- * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
- * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
- * level reaches them). `null` on a row marks a path the registry carries no metadata
- * for (an unregistered/ungated path — no feature tags, no action).
+ * registry: `read`/`write` by the route's method, `fenced`/`secret` reserved for
+ * admins. `null` on a row marks a path the registry carries no metadata for (an
+ * unregistered/ungated path — no feature tags, no action).
  */
 export const routeAction = openapi.routeMappingRow.shape.action.unwrap();
 export type RouteAction = z.infer<typeof routeAction>;
 
+/**
+ * A route's role reach, the server's decision of what opens it for a non-admin role:
+ * `level` — a role's per-tag level opens it; `self_service` — every role keeps it, no
+ * level; `admin_only` — a fenced/secret class or a control-plane route the base tier
+ * reserves; `public` — the route is not authenticated and answers everyone without a
+ * login. `null` on a row marks a path with no registry metadata.
+ */
+export const routeRoleReach = openapi.routeMappingRow.shape.role_reach.unwrap();
+export type RouteRoleReach = z.infer<typeof routeRoleReach>;
+
 /** `GET /api/auth/public-routes` — the sorted urls pinned to the public marker. */
 export const publicRoutes = openapi.stringList;
 

package/src/schemas/backup.ts

@@ -6,6 +6,13 @@ import { fleetReportFanout } from './fleet';
 
 export const backupSections = openapi.backupSectionListing;
 
+/**
+ * The export door's downloaded document: the exported `sections` and the `errors` map
+ * naming each section whose exporter failed (that section is absent from `sections`).
+ */
+export const backupExportDocument = openapi.backupExportDocument;
+export type BackupExportDocument = z.infer<typeof backupExportDocument>;
+
 /**
  * A backup document as the import door accepts it — validated when the UI reads a picked
  * file. Hand-written over the export's document: the import door takes `version` 1 and a

package/src/schemas/capabilities.ts

@@ -3,7 +3,11 @@ import type { z } from 'zod';
 
 import * as openapi from '../generated/openapi-schemas';
 
-/** A concrete route the caller can reach, with the methods that pass its jq fence. */
+/**
+ * A route the caller can reach — a concrete path, or a route template such as
+ * `/api/presets/{name}` — with the methods its grant admits (on a representative
+ * instance, for a template).
+ */
 export const routeEntry = openapi.routeEntry;
 export type RouteEntry = z.infer<typeof routeEntry>;
 
@@ -25,17 +29,17 @@ export const subMcpEntry = openapi.subMcpEntry;
 export type SubMcpEntry = z.infer<typeof subMcpEntry>;
 
 /**
- * `GET /api/auth/me` — the caller's derived capability projection: the concrete
- * (path, method) surface, dynamic patterns, sub-MCP mounts, tools, and agents it
+ * `GET /api/auth/me` — the caller's derived capability projection: the (path, method)
+ * surface (concrete paths and route templates), dynamic patterns, sub-MCP mounts, tools, and agents it
  * can reach RIGHT NOW (derived server-side, never stored). `admin` is the
  * condition-free `"*"` discriminator (a TOTAL projection); a scoped
- * session carries `admin: false` and a jq-exact `routes` list. `owner_user_id` is
+ * session carries `admin: false` and its projected `routes` list. `owner_user_id` is
  * the key's owner claim, `null` for a key with no owner claim. `principal` is the
  * caller's principal (kind + display name), `null` when no principal row backs the
  * credential. `public_resource_id` is the deployment's reserved public marker (the
  * route-table id a public route maps to — never a scope). The invariant is projection ⊆ gate: every projected surface is one
- * the server would admit, so the UI can filter on it without ever advertising a
- * door the gate denies.
+ * the server would admit for a role-holder; a credential fenced per instance is
+ * decided at the server, which answers 403 where its fence denies the instance.
  */
 export const meProjection = openapi.projectionResult;
 export type MeProjection = z.infer<typeof meProjection>;

package/src/schemas/channels.ts

@@ -9,3 +9,5 @@ import * as openapi from '../generated/openapi-schemas';
 
 export const channels = openapi.channelListing;
 export type Channels = z.infer<typeof channels>;
+/** One installed channel plugin: its name and its declared identity hint, if any. */
+export type { ChannelEntry } from '../generated/openapi-schemas';

package/src/schemas/extensions.ts

@@ -11,8 +11,8 @@ export type Extension = z.infer<typeof extension>;
 // reads its `{ name, config }` form.
 /**
  * One element of an extension combo: a bare extension NAME, or a
- * `{ name, config }` mapping binding author config (e.g. an `output_schema` JSON
- * Schema, or an `ask_external` verifier). Both wire forms are admitted so a
+ * `{ name, config }` mapping binding the extension's settings, which the server
+ * checks against the extension's declared `config_schema`. Both wire forms are admitted so a
  * config-bearing combo parses without dropping server data. A drift throws
  * `ApiSchemaError`.
  */
@@ -25,8 +25,9 @@ export type PresetExtensionElement = z.infer<typeof presetExtensionElement>;
 /**
  * `GET /api/tools/{name}/extensions` — a tool's FULL lossless list-of-combos plus
  * the extension catalog. `combos` is a list of combos, each an ordered list of
- * extension ELEMENTS (a bare name or a config-bearing `{ name, config }` mapping —
- * `output_schema` carries its schema this way); `[]` when the tool has no map entry.
+ * extension ELEMENTS (a bare name, or a `{ name, config }` mapping binding the
+ * extension's settings, which the server checks against the extension's declared
+ * `config_schema`); `[]` when the tool has no map entry.
  * It carries EVERY combo mapped to the base tool (the union across every `tools`/`mcp`
  * config), never a single flattened one. `available` is the same flat catalog
  * `GET /api/extensions` returns. A drift throws `ApiSchemaError`.

package/src/schemas/manifest-mcp.ts

@@ -2,6 +2,7 @@
 import { z } from 'zod';
 
 import * as openapi from '../generated/openapi-schemas';
+import { presetExtensionElement } from './extensions';
 import { fleetReportFanout } from './fleet';
 
 /**
@@ -33,8 +34,23 @@ export const manifestMcpEntry = z
   .loose();
 export type ManifestMcpEntry = z.infer<typeof manifestMcpEntry>;
 
+const extensionMap = z.record(z.string(), z.array(z.array(presetExtensionElement)));
+
+/**
+ * The preserved manifest's extension settings: the extension modules, the backend
+ * module, and the `extensions` maps of the `tools`, `mcp` and `api_tools` sections,
+ * each combo element refined to the client's extension-element schema.
+ */
+export const manifestExtensionSettings = openapi.manifestExtensionSettings.extend({
+  tools: z.array(openapi.manifestExtensionMap.extend({ extensions: extensionMap })),
+  mcp: z.array(openapi.manifestExtensionMap.extend({ extensions: extensionMap })),
+  api_tools: extensionMap,
+});
+export type ManifestExtensionSettings = z.infer<typeof manifestExtensionSettings>;
+
 export const manifestView = openapi.preservedManifestView.extend({
   mcp: z.array(manifestMcpEntry),
+  extension_settings: manifestExtensionSettings,
 });
 
 /**
@@ -62,3 +78,12 @@ export type McpEnvRefs = z.infer<typeof mcpEnvRefs>;
  */
 export const reloadConfigResult = openapi.applyResponse.extend({ fanout: fleetReportFanout });
 export type ReloadConfigResult = z.infer<typeof reloadConfigResult>;
+
+/**
+ * `POST /api/mcp-status/{title}/advertised-tools` — every tool the server advertises
+ * (before the entry's include/exclude filter), each with whether it is selected and
+ * bound, and why not (`unbound_reason`, or `null` when bound or unselected).
+ */
+export const mcpAdvertisedTools = openapi.mcpAdvertisedTools;
+export type McpAdvertisedTools = z.infer<typeof mcpAdvertisedTools>;
+export type { McpAdvertisedTool } from '../generated/openapi-schemas';

package/src/schemas/marketplace.ts

@@ -2,6 +2,7 @@
 import { z } from 'zod';
 
 import * as openapi from '../generated/openapi-schemas';
+import { reloadConfigResult } from './manifest-mcp';
 
 // The registry's listing, search, version, detail and advisory shapes are hand-written: the
 // skeleton passes the upstream registry's bodies through as opaque values. The installed,
@@ -299,10 +300,12 @@ export type MarketplaceMountedRoute = z.infer<typeof marketplaceMountedRoute>;
  * non-critical `advisories` ride BOTH the install and update receipts.
  * `routes` is the mounted-route list — empty for a plugin that registers none.
  * `package`, `reload` and `pip_output` carry the installed package, the config reload
- * and the raw install log.
+ * and the raw install log; the reload's fan-out parses into its three modes so a
+ * failed propagation reaches the fleet report.
  */
 export const marketplaceInstallResult = openapi.installResult.extend({
   advisories: z.array(marketplaceAdvisory),
+  reload: reloadConfigResult,
 });
 export type MarketplaceInstallResult = z.infer<typeof marketplaceInstallResult>;
 
@@ -348,5 +351,7 @@ export type MarketplaceInstallPreview = z.infer<typeof marketplaceInstallPreview
  * provider still selected by its env var); render them like the install
  * receipt's notes. `reload` is `null` when the plugin wrote no manifest entry to remove.
  */
-export const marketplaceUninstallResult = openapi.uninstallResult;
+export const marketplaceUninstallResult = openapi.uninstallResult.extend({
+  reload: reloadConfigResult.nullable(),
+});
 export type MarketplaceUninstallResult = z.infer<typeof marketplaceUninstallResult>;

package/src/schemas/presets.ts

@@ -52,13 +52,20 @@ export const presetRenamed = openapi.presetRenameResult;
 export type PresetRenamed = z.infer<typeof presetRenamed>;
 
 /**
- * `GET /api/presets/{name}/referees` — every OTHER preset whose active authored
- * composition names this one as a tool (the referees a rename would strand). An
- * empty list is the clean case; a non-empty list means a rename is blocked until
- * those presets are updated. A drift throws `ApiSchemaError`.
+ * `GET /api/presets/{name}/referees?action=` and
+ * `GET /api/states/{name}/attachments/{template}/referees` — every holder that would
+ * refuse the action. An empty list is the clean case; a non-empty list is what the
+ * server's 409 would name. A drift throws `ApiSchemaError`.
  */
-export const presetReferees = openapi.presetRefereesResult;
-export type PresetReferees = z.infer<typeof presetReferees>;
+export const holdersPreview = openapi.holdersPreview;
+export type HoldersPreview = z.infer<typeof holdersPreview>;
+
+/** One holder of a reference: its kind, its name, a one-line summary and its locator. */
+export const referenceHolder = openapi.referenceHolder;
+export type ReferenceHolder = z.infer<typeof referenceHolder>;
+
+/** The preset action a holder preview answers for. */
+export type PresetHolderAction = 'rename' | 'delete';
 
 /**
  * `POST /api/presets/validate` — the dry-run verdict for a preset draft. `valid`

package/src/schemas/storage.ts

@@ -4,10 +4,19 @@ import type { z } from 'zod';
 import * as openapi from '../generated/openapi-schemas';
 
 /** `GET /api/storage` — the storage-provider identity, or the absent sentinel
- * (`present: false`, a 200) when no storage-provider plugin is installed. */
+ * (`present: false`, a 200) when no storage-provider plugin is installed; `surfaces`
+ * names the mounted doors (`storage`, `templates`) the caller's grants reach. */
 export const storageInfo = openapi.storageInfo;
 export type StorageInfo = z.infer<typeof storageInfo>;
 
+/**
+ * `GET /api/storage/entries/{id}` — one stored object as the server classifies it: a
+ * `text` or `document` entry carries its (extracted) content, a `binary` entry only its
+ * type and size. An unknown `kind` throws `ApiSchemaError`.
+ */
+export const storedEntry = openapi.storedEntry;
+export type StoredEntry = z.infer<typeof storedEntry>;
+
 /** `GET /api/storage/resources` — the full sorted resource-id list. */
 export const storageResourceList = openapi.resourceList;
 

package/src/schemas/system-kinds.ts

@@ -6,11 +6,12 @@ import { fleetResult } from './fleet';
 import { reloadConfigResult } from './manifest-mcp';
 
 // `GET /api/system/kinds` — one row per pluggable kind (identity, accounts,
-// monitoring, storage, backend, channels, webhook_verifiers, config,
-// studio_plugins). `state` is the kind's active/default/off status: `active` = a
-// real plugin serves it, `default` = a built-in fallback serves it, `off` =
-// nothing is registered (a legal state, reported not "fixed"). `plugin` is the
-// provider/module name when known, else null.
+// monitoring, storage, files, backend, sandbox, channels, webhook_verifiers,
+// config, studio_plugins). `state` is the kind's active/default/off status:
+// `active` = a real plugin serves it, `default` = a built-in fallback serves it,
+// `off` = nothing is registered (a legal state, reported not "fixed"). `plugin` is
+// the provider/module name when known, else null. The `files` row reports whether
+// the server's optional file-loading dependencies are installed.
 
 export const kindStatus = openapi.kindStatus;
 export const kindStatusList = openapi.systemKindsListing;

package/src/schemas/templates.ts

@@ -1,8 +1,24 @@
 /** Prompt-template listing, render and mutation ack schemas. */
+import type { z } from 'zod';
+
 import * as openapi from '../generated/openapi-schemas';
 
 export const templateNames = openapi.stringListResponse;
-export const templateDetail = openapi.templateFetchView;
+/**
+ * `POST /api/template` — one stored template entry. A `text` entry carries its content
+ * and either its declared `schema` or the `schema_error` that kept it from compiling;
+ * `document` and `binary` entries carry no schema. A text entry with both or neither of
+ * `schema` and `schema_error` is refused.
+ */
+export const templateEntry = openapi.templateEntry.superRefine((entry, ctx) => {
+  if (entry.kind === 'text' && (entry.schema === null) === (entry.schema_error === null)) {
+    ctx.addIssue({
+      code: 'custom',
+      message: "a text template entry carries exactly one of 'schema' and 'schema_error'",
+    });
+  }
+});
+export type TemplateEntry = z.infer<typeof templateEntry>;
 export const templateUploaded = openapi.templateUploadResult;
 export const templateDeleted = openapi.templateDeleteResult;
 export const templateDirDeleted = openapi.templateDeleteResult;