@thinkai/tai-api-contract 2.156.0 → 2.158.0

package/openapi/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ThinkAI API
-  version: 2.156.0
+  version: 2.158.0
   description: >
     Contract surface for the AI Driven SDLC backend used by ThinkAI.
     Workspace-scoped routes use `/workspaces/{workspaceId}/...`.
@@ -6959,6 +6959,15 @@ paths:
                         fixed: 0
                       verificationGapCount: 0
                       verificationGaps: []
+                      blockedRepoCount: 0
+                      topBlockingRuleTitle: null
+                      topBlockingRuleRepoCount: 0
+                      fixProof:
+                        windowDays: 30
+                        mergeRatePercent: null
+                        medianDaysToMerge: null
+                        clearedCount: 0
+                        rows: []
                     dimensionAggregates: []
                     fixStatusSummary:
                       queued: 0
@@ -9343,10 +9352,11 @@ paths:
       summary: Slack install URL for Message Center
       operationId: getSlackInstallUrl
       description: >
-        Workspace admin only. Returns the Slack OAuth authorize URL. State is stored
-        server-side and names this workspace and the signed-in admin. Editor or viewer
-        is `403` with `code` `workspace_admin_required`. Missing Slack app settings are
-        `503` with `code` `slack_not_configured`.
+        Workspace admin only. Returns the Slack OAuth authorize URL with
+        `incoming-webhook` scope. State is stored server-side and names this workspace
+        and the signed-in admin. Editor or viewer is `403` with `code`
+        `workspace_admin_required`. Missing Slack app settings are `503` with `code`
+        `slack_not_configured`.
       security:
         - bearerAuth: []
       parameters:
@@ -9393,10 +9403,11 @@ paths:
       description: >
         Browser return from Slack. The provider redirect does not include the API
         bearer token. `state` was issued by `getSlackInstallUrl` to a signed-in admin
-        and is single-use. The bot token is stored encrypted only when that user is
-        still a workspace admin. Success redirects to
+        and is single-use. Install requests `incoming-webhook` only. The encrypted
+        incoming-webhook URL and the channel Slack returns are stored only when that
+        user is still a workspace admin. Success redirects to
         `{spa}/workspace/preferences?chat=slack`. Failures redirect to the same
-        page with `slack=error`. The token is never in the redirect.
+        page with `slack=error`. The webhook URL is never in the redirect.
       parameters:
         - name: code
           in: query
@@ -9431,8 +9442,10 @@ paths:
       summary: Slack connection status
       operationId: getSlackIntegration
       description: >
-        Any workspace member. `{ connected, channelName }`. `channelName` is null
-        until an admin saves a channel. The bot token is never returned.
+        Any workspace member. `{ connected, channelName }`. `connected` is true only
+        when a decryptable install webhook is stored. `channelName` is the channel
+        chosen on Slack's install screen (null when not connected). Secrets are
+        never returned.
       security:
         - bearerAuth: []
       parameters:
@@ -9459,8 +9472,8 @@ paths:
       summary: Disconnect Slack
       operationId: deleteSlackIntegration
       description: >
-        Workspace admin only. Removes the bot token and saved channel. Later
-        Message Center delivery does not post to Slack.
+        Workspace admin only. Removes the install webhook, optional bot token, and
+        saved channel. Later Message Center delivery does not post to Slack.
       security:
         - bearerAuth: []
       parameters:
@@ -9489,13 +9502,15 @@ paths:
   /workspaces/{workspaceId}/integrations/slack/channel:
     put:
       tags: [Integrations]
-      summary: Save the Slack channel for Message Center
+      summary: Change Slack channel (requires reinstall)
       operationId: putSlackChannel
       description: >
-        Workspace admin only. Body `{ channelId }`. Slack must already be connected.
-        The response is the same status object as `getSlackIntegration`, with the
-        channel name Slack returned. Unknown or malformed `channelId` is `400`
-        `invalid_slack_channel`. Not connected is `409` `slack_not_connected`.
+        Workspace admin only. Body `{ channelId }`. The notification channel is
+        chosen on Slack's install screen with the incoming webhook; this route does
+        not rewrite channel metadata. When Slack is connected, the API returns `409`
+        with `code` `slack_channel_reinstall_required` — reconnect via
+        `getSlackInstallUrl` to pick a different channel. Malformed `channelId` is
+        `400` `invalid_slack_channel`. Not connected is `409` `slack_not_connected`.
       security:
         - bearerAuth: []
       parameters:
@@ -9508,19 +9523,21 @@ paths:
               $ref: "#/components/schemas/SlackChannelBodyDto"
       responses:
         "200":
-          description: Channel saved
+          description: >
+            Not returned. The channel is chosen on Slack's install screen; when
+            connected the API responds with `409` `slack_channel_reinstall_required`.
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/SlackIntegrationStatusDto"
         "400":
-          description: channelId is missing, malformed, or unknown to Slack
+          description: channelId is missing or malformed
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorMessageDto"
               example:
-                error: Slack channel was not found
+                error: channelId is required
                 code: invalid_slack_channel
         "401":
           $ref: "#/components/responses/Unauthorized"
@@ -9540,23 +9557,22 @@ paths:
               schema:
                 $ref: "#/components/schemas/ErrorMessageDto"
         "409":
-          description: Slack is not connected
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ErrorMessageDto"
-              example:
-                error: Slack is not connected
-                code: slack_not_connected
-        "502":
-          description: Slack rejected the lookup
+          description: >
+            Slack is not connected (`slack_not_connected`), or the channel cannot be
+            changed without a new install (`slack_channel_reinstall_required`).
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorMessageDto"
-              example:
-                error: Slack did not accept the channel
-                code: slack_request_failed
+              examples:
+                notConnected:
+                  value:
+                    error: Slack is not connected
+                    code: slack_not_connected
+                reinstallRequired:
+                  value:
+                    error: Reconnect Slack to change the notification channel
+                    code: slack_channel_reinstall_required
 
   /workspaces/{workspaceId}/notification-preferences:
     get:
@@ -11508,7 +11524,7 @@ components:
       description: Allowlisted repository sort field.
       schema:
         type: string
-        enum: [repoName, overallScore, lastAnalyzed, language]
+        enum: [repoName, overallScore, lastAnalyzed, language, blockingRule]
         default: overallScore
     CodeInsightsRepoSort:
       name: sort
@@ -18464,6 +18480,15 @@ components:
             scores; live CI health stays in SDLC Insights.
           items:
             $ref: "#/components/schemas/ScanImprovementDto"
+        blockingRule:
+          type: object
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/ReadinessBlockingRuleDto"
+          description: >
+            The one open gap or partial criterion on the latest succeeded scan that is not
+            already fixed. Null when the repo is not blocked. Severity ranks first, then
+            dimension weight, then rubric id.
 
     LinkedRolePendingDto:
       type: object
@@ -18642,10 +18667,27 @@ components:
           description: See RepoReadinessScoreDto.scanImprovements.
           items:
             $ref: "#/components/schemas/ScanImprovementDto"
+        blockingRule:
+          type: object
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/ReadinessBlockingRuleDto"
+          description: See RepoReadinessScoreDto.blockingRule.
 
     AgenticFoundationDashboardSummaryDto:
       type: object
-      required: [repoCount, averageOverallScore, issueCount, criticalIssueCount, issuesByFixStatus]
+      required:
+        [
+          repoCount,
+          averageOverallScore,
+          issueCount,
+          criticalIssueCount,
+          issuesByFixStatus,
+          blockedRepoCount,
+          topBlockingRuleTitle,
+          topBlockingRuleRepoCount,
+          fixProof,
+        ]
       properties:
         repoCount:
           type: integer
@@ -18697,6 +18739,91 @@ components:
             both gaps appears twice. Does not change averageOverallScore.
           items:
             $ref: "#/components/schemas/AgenticFoundationVerificationGapDto"
+        blockedRepoCount:
+          type: integer
+          minimum: 0
+          description: >
+            Non-archived repos whose latest succeeded scan still has a gap or partial
+            criterion that is not fixed. A repo with no open gap is not blocked.
+        topBlockingRuleTitle:
+          type: string
+          nullable: true
+          description: Rule title that blocks the most repos. Null when blockedRepoCount is 0.
+        topBlockingRuleRepoCount:
+          type: integer
+          minimum: 0
+          description: How many blocked repos share topBlockingRuleTitle.
+        fixProof:
+          $ref: "#/components/schemas/AgenticFoundationFixProofDto"
+
+    ReadinessBlockingRuleDto:
+      type: object
+      additionalProperties: false
+      required: [rubricId, title, severity]
+      properties:
+        rubricId:
+          type: string
+        title:
+          type: string
+        severity:
+          type: string
+          enum: [critical, high, medium, low]
+
+    AgenticFoundationFixProofDto:
+      type: object
+      additionalProperties: false
+      required: [windowDays, mergeRatePercent, medianDaysToMerge, clearedCount, rows]
+      properties:
+        windowDays:
+          type: integer
+          minimum: 1
+        mergeRatePercent:
+          type: integer
+          minimum: 0
+          maximum: 100
+          nullable: true
+          description: >
+            Rounded percent of terminal fixes in the window that merged (merged / merged + failed).
+            Null when there is no terminal fix.
+        medianDaysToMerge:
+          type: number
+          nullable: true
+          description: Median days from created_at to merge. Null when nothing merged in the window.
+        clearedCount:
+          type: integer
+          minimum: 0
+          description: Merged fixes in the window whose next scan marked the criterion met.
+        rows:
+          type: array
+          maxItems: 10
+          items:
+            $ref: "#/components/schemas/AgenticFoundationFixProofRowDto"
+
+    AgenticFoundationFixProofRowDto:
+      type: object
+      additionalProperties: false
+      required: [repoName, ruleTitle, scoreBefore, scoreAfter, cleared]
+      properties:
+        repoName:
+          type: string
+        ruleTitle:
+          type: string
+        scoreBefore:
+          type: integer
+          minimum: 0
+          maximum: 100
+          nullable: true
+        scoreAfter:
+          type: integer
+          minimum: 0
+          maximum: 100
+          nullable: true
+        cleared:
+          type: boolean
+          nullable: true
+          description: >
+            True when the first succeeded scan after the merge marked the criterion met.
+            Null when that scan has not run yet.
 
     AgenticFoundationVerificationGapDto:
       type: object
@@ -19646,7 +19773,8 @@ components:
       properties:
         url:
           type: string
-          description: Slack OAuth authorize URL. The bot token is not included.
+          description: >
+            Slack OAuth authorize URL (`incoming-webhook` scope). Secrets are not included.
 
     SlackIntegrationStatusDto:
       type: object
@@ -19655,10 +19783,13 @@ components:
       properties:
         connected:
           type: boolean
+          description: >
+            True only when a decryptable install webhook URL is stored for this workspace.
         channelName:
           type: string
           nullable: true
-          description: Saved channel name. Null until an admin saves a channel, and when disconnected.
+          description: >
+            Channel name returned by Slack at install time. Null when not connected.
 
     SlackChannelBodyDto:
       type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkai/tai-api-contract",
-  "version": "2.156.0",
+  "version": "2.158.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/generated/openapi.ts

@@ -3774,7 +3774,7 @@ export interface paths {
         };
         /**
          * Slack install URL for Message Center
-         * @description Workspace admin only. Returns the Slack OAuth authorize URL. State is stored server-side and names this workspace and the signed-in admin. Editor or viewer is `403` with `code` `workspace_admin_required`. Missing Slack app settings are `503` with `code` `slack_not_configured`.
+         * @description Workspace admin only. Returns the Slack OAuth authorize URL with `incoming-webhook` scope. State is stored server-side and names this workspace and the signed-in admin. Editor or viewer is `403` with `code` `workspace_admin_required`. Missing Slack app settings are `503` with `code` `slack_not_configured`.
          */
         get: operations["getSlackInstallUrl"];
         put?: never;
@@ -3794,7 +3794,7 @@ export interface paths {
         };
         /**
          * Slack OAuth callback
-         * @description Browser return from Slack. The provider redirect does not include the API bearer token. `state` was issued by `getSlackInstallUrl` to a signed-in admin and is single-use. The bot token is stored encrypted only when that user is still a workspace admin. Success redirects to `{spa}/workspace/preferences?chat=slack`. Failures redirect to the same page with `slack=error`. The token is never in the redirect.
+         * @description Browser return from Slack. The provider redirect does not include the API bearer token. `state` was issued by `getSlackInstallUrl` to a signed-in admin and is single-use. Install requests `incoming-webhook` only. The encrypted incoming-webhook URL and the channel Slack returns are stored only when that user is still a workspace admin. Success redirects to `{spa}/workspace/preferences?chat=slack`. Failures redirect to the same page with `slack=error`. The webhook URL is never in the redirect.
          */
         get: operations["getSlackOauthCallback"];
         put?: never;
@@ -3814,14 +3814,14 @@ export interface paths {
         };
         /**
          * Slack connection status
-         * @description Any workspace member. `{ connected, channelName }`. `channelName` is null until an admin saves a channel. The bot token is never returned.
+         * @description Any workspace member. `{ connected, channelName }`. `connected` is true only when a decryptable install webhook is stored. `channelName` is the channel chosen on Slack's install screen (null when not connected). Secrets are never returned.
          */
         get: operations["getSlackIntegration"];
         put?: never;
         post?: never;
         /**
          * Disconnect Slack
-         * @description Workspace admin only. Removes the bot token and saved channel. Later Message Center delivery does not post to Slack.
+         * @description Workspace admin only. Removes the install webhook, optional bot token, and saved channel. Later Message Center delivery does not post to Slack.
          */
         delete: operations["deleteSlackIntegration"];
         options?: never;
@@ -3838,8 +3838,8 @@ export interface paths {
         };
         get?: never;
         /**
-         * Save the Slack channel for Message Center
-         * @description Workspace admin only. Body `{ channelId }`. Slack must already be connected. The response is the same status object as `getSlackIntegration`, with the channel name Slack returned. Unknown or malformed `channelId` is `400` `invalid_slack_channel`. Not connected is `409` `slack_not_connected`.
+         * Change Slack channel (requires reinstall)
+         * @description Workspace admin only. Body `{ channelId }`. The notification channel is chosen on Slack's install screen with the incoming webhook; this route does not rewrite channel metadata. When Slack is connected, the API returns `409` with `code` `slack_channel_reinstall_required` — reconnect via `getSlackInstallUrl` to pick a different channel. Malformed `channelId` is `400` `invalid_slack_channel`. Not connected is `409` `slack_not_connected`.
          */
         put: operations["putSlackChannel"];
         post?: never;
@@ -7835,6 +7835,8 @@ export interface components {
             linkedRoleAssessment?: components["schemas"]["LinkedRoleAssessmentDto"] | null;
             /** @description Repo-level "Improve this scan" recommendations for Agentic Foundation CI setup (at most three). Omitted when the scan emitted none. Does not change criterion scores; live CI health stays in SDLC Insights. */
             scanImprovements?: components["schemas"]["ScanImprovementDto"][];
+            /** @description The one open gap or partial criterion on the latest succeeded scan that is not already fixed. Null when the repo is not blocked. Severity ranks first, then dimension weight, then rubric id. */
+            blockingRule?: components["schemas"]["ReadinessBlockingRuleDto"] | null;
         };
         LinkedRolePendingDto: {
             /** @description Topology role key, e.g. terraform | gitops | ci_templates | api_contracts. */
@@ -7915,6 +7917,8 @@ export interface components {
             linkedRoleAssessment?: components["schemas"]["LinkedRoleAssessmentDto"] | null;
             /** @description See RepoReadinessScoreDto.scanImprovements. */
             scanImprovements?: components["schemas"]["ScanImprovementDto"][];
+            /** @description See RepoReadinessScoreDto.blockingRule. */
+            blockingRule?: components["schemas"]["ReadinessBlockingRuleDto"] | null;
         };
         AgenticFoundationDashboardSummaryDto: {
             repoCount: number;
@@ -7936,6 +7940,37 @@ export interface components {
             verificationGapCount?: number;
             /** @description Up to 12 repo and reason pairs for verificationGapCount. A repo with both gaps appears twice. Does not change averageOverallScore. */
             verificationGaps?: components["schemas"]["AgenticFoundationVerificationGapDto"][];
+            /** @description Non-archived repos whose latest succeeded scan still has a gap or partial criterion that is not fixed. A repo with no open gap is not blocked. */
+            blockedRepoCount: number;
+            /** @description Rule title that blocks the most repos. Null when blockedRepoCount is 0. */
+            topBlockingRuleTitle: string | null;
+            /** @description How many blocked repos share topBlockingRuleTitle. */
+            topBlockingRuleRepoCount: number;
+            fixProof: components["schemas"]["AgenticFoundationFixProofDto"];
+        };
+        ReadinessBlockingRuleDto: {
+            rubricId: string;
+            title: string;
+            /** @enum {string} */
+            severity: "critical" | "high" | "medium" | "low";
+        };
+        AgenticFoundationFixProofDto: {
+            windowDays: number;
+            /** @description Rounded percent of terminal fixes in the window that merged (merged / merged + failed). Null when there is no terminal fix. */
+            mergeRatePercent: number | null;
+            /** @description Median days from created_at to merge. Null when nothing merged in the window. */
+            medianDaysToMerge: number | null;
+            /** @description Merged fixes in the window whose next scan marked the criterion met. */
+            clearedCount: number;
+            rows: components["schemas"]["AgenticFoundationFixProofRowDto"][];
+        };
+        AgenticFoundationFixProofRowDto: {
+            repoName: string;
+            ruleTitle: string;
+            scoreBefore: number | null;
+            scoreAfter: number | null;
+            /** @description True when the first succeeded scan after the merge marked the criterion met. Null when that scan has not run yet. */
+            cleared: boolean | null;
         };
         AgenticFoundationVerificationGapDto: {
             repoName: string;
@@ -8354,12 +8389,13 @@ export interface components {
             teams: components["schemas"]["NotificationChatChannelsDto"];
         };
         SlackInstallUrlDto: {
-            /** @description Slack OAuth authorize URL. The bot token is not included. */
+            /** @description Slack OAuth authorize URL (`incoming-webhook` scope). Secrets are not included. */
             url: string;
         };
         SlackIntegrationStatusDto: {
+            /** @description True only when a decryptable install webhook URL is stored for this workspace. */
             connected: boolean;
-            /** @description Saved channel name. Null until an admin saves a channel, and when disconnected. */
+            /** @description Channel name returned by Slack at install time. Null when not connected. */
             channelName: string | null;
         };
         SlackChannelBodyDto: {
@@ -10800,7 +10836,7 @@ export interface components {
         /** @description Sort direction. */
         PaginationOrder: "asc" | "desc";
         /** @description Allowlisted repository sort field. */
-        ReadinessRepoSort: "repoName" | "overallScore" | "lastAnalyzed" | "language";
+        ReadinessRepoSort: "repoName" | "overallScore" | "lastAnalyzed" | "language" | "blockingRule";
         /** @description Allowlisted Code Insights repo sort field. */
         CodeInsightsRepoSort: "repoName" | "locTotal" | "ccAvg" | "dupPct" | "lastMeasuredAt";
         /** @description Case-insensitive substring filter on repo name / provider slug. */
@@ -11111,6 +11147,9 @@ export type LinkedRolePendingDto = components['schemas']['LinkedRolePendingDto']
 export type LinkedRoleAssessmentDto = components['schemas']['LinkedRoleAssessmentDto'];
 export type RepoReadinessScoreDetailDto = components['schemas']['RepoReadinessScoreDetailDto'];
 export type AgenticFoundationDashboardSummaryDto = components['schemas']['AgenticFoundationDashboardSummaryDto'];
+export type ReadinessBlockingRuleDto = components['schemas']['ReadinessBlockingRuleDto'];
+export type AgenticFoundationFixProofDto = components['schemas']['AgenticFoundationFixProofDto'];
+export type AgenticFoundationFixProofRowDto = components['schemas']['AgenticFoundationFixProofRowDto'];
 export type AgenticFoundationVerificationGapDto = components['schemas']['AgenticFoundationVerificationGapDto'];
 export type PageMetaDto = components['schemas']['PageMetaDto'];
 export type ReadinessEligibilityLimitsDto = components['schemas']['ReadinessEligibilityLimitsDto'];
@@ -21397,7 +21436,7 @@ export interface operations {
             };
         };
         responses: {
-            /** @description Channel saved */
+            /** @description Not returned. The channel is chosen on Slack's install screen; when connected the API responds with `409` `slack_channel_reinstall_required`. */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -21406,7 +21445,7 @@ export interface operations {
                     "application/json": components["schemas"]["SlackIntegrationStatusDto"];
                 };
             };
-            /** @description channelId is missing, malformed, or unknown to Slack */
+            /** @description channelId is missing or malformed */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -21414,7 +21453,7 @@ export interface operations {
                 content: {
                     /**
                      * @example {
-                     *       "error": "Slack channel was not found",
+                     *       "error": "channelId is required",
                      *       "code": "invalid_slack_channel"
                      *     }
                      */
@@ -21446,33 +21485,12 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Slack is not connected */
+            /** @description Slack is not connected (`slack_not_connected`), or the channel cannot be changed without a new install (`slack_channel_reinstall_required`). */
             409: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    /**
-                     * @example {
-                     *       "error": "Slack is not connected",
-                     *       "code": "slack_not_connected"
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorMessageDto"];
-                };
-            };
-            /** @description Slack rejected the lookup */
-            502: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": "Slack did not accept the channel",
-                     *       "code": "slack_request_failed"
-                     *     }
-                     */
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };