@thinkai/tai-api-contract 2.181.0 → 2.183.0

package/src/generated/openapi.ts

@@ -78,7 +78,7 @@ export interface paths {
         put?: never;
         /**
          * Evaluate assessment preflight from server-loaded evidence
-         * @description Loads repository scope, readiness scan age, and window coverage for one workspace. Client fields for scope, scans, windows, and engineer counts are ignored, so an unscanned source cannot be marked fresh. The five-business-day clock uses Monday–Friday in America/New_York and is stored on the first passing result. A later blocker does not clear it. Active-engineer counts stay unloaded until stored activity can be counted.
+         * @description Loads repository scope, readiness scan age, and window coverage for one workspace. Client fields for scope, scans, windows, and engineer counts are ignored, so an unscanned source cannot be marked fresh. The five-business-day clock uses Monday–Friday in America/New_York and is stored on the first passing result. A later blocker does not clear it. The active-engineer count is loaded from stored commit authors and merged pull requests in the 90-day baseline window (bots and identities not on the org chart excluded). It stays unloaded until commit ingest covers the whole window for every non-archived repository.
          *     **Authorization:** Bearer JWT required. Caller email must appear in `PLATFORM_ADMIN_EMAILS`.
          */
         post: operations["runLiveAssessmentPreflight"];
@@ -130,6 +130,56 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/{workspaceId}/assessment-manifest/validate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Validate this workspace's assessment manifest
+         * @description Runs the same fail-closed manifest check as `runAssessmentManifestValidation` for the workspace in the path. The server ignores `manifest.validation` and `manifest.watermark` from the client. `buyerDeliverable` is true only when the result is validated and `shareMode` is internal. An external share-safe result can be validated and is never the buyer file. Unset or exceeded tolerances fail. No numeric tolerance is assumed. GitLab and Bitbucket fixtures are not part of this operation.
+         *     `workspaceId` and `expectedWorkspaceId` in the body must equal the path workspace. A body that names another workspace is rejected. Comparing two workspaces stays on `runAssessmentManifestValidation`.
+         *     **Authorization:** Bearer JWT required. Caller must be a workspace admin, or a platform admin who is a member of this workspace. Members who are not workspace admins receive 403. Non-members of an existing workspace receive 403. Unknown workspaces receive 404.
+         */
+        post: operations["validateWorkspaceAssessmentManifest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/assessment-manifest/build": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Build and validate this workspace's assessment manifest from stored evidence
+         * @description The client sends only the offer, share mode, the render status of each selected section, and the matched-period ROI chapter it printed. The server fills scope, excluded repositories, windows, sources with freshness, consent, `expectedRepositoryIds`, `soldWindowComplete`, `premiumAiAssessable`, and tolerances from stored data, then runs the same fail-closed check as `validateWorkspaceAssessmentManifest`.
+         *
+         *     Scope is the non-archived workspace repositories. Above 50 repositories or 500 active engineers fails (custom quote). For the premium offer, repositories without merged pull requests in both matched windows are listed in `excluded` and left out of scope. Baseline windows: `pre` is null, `post` is the 90 calendar days ending yesterday (America/New_York), and `transitionDays` is 0. Premium windows come from the confirmed rollout day. Freshness: source control 24 hours, AI usage 7 days, readiness scans 30 days. Aggregate-use consent is reported as stored; no row is `unset`.
+         *
+         *     `premiumAiAssessable` needs fresh Cursor, Claude, or Copilot usage in the post window and complete matched-period evidence. A live ROI refusal for incomplete data blocks validation (`rollout_unset`, `window_missing`, `ship_weight_incomplete`, `active_engineers_unknown`, `confounder_inputs_missing`, `normalization_unset`, `output_unit_mismatch`). A refusal that is a legitimate result does not (`non_positive_output`, `confounder`, `missing_cost`, `non_usd_cost`, `cost_not_attributable`); the report prints "not assessable" with no figure. The premium `roi` tolerance is `unset` when the ROI section did not render or `roi` is missing, `exceeded` when the printed chapter differs from the server result (USD figures within the dictionary money tolerance), and `within` otherwise. Named-person sections always fail.
+         *
+         *     Send `result.contentHash` with the PDF to `storeAssessmentReport`, which rebuilds the manifest and stores only when it is still a validated internal buyer file with the same hash.
+         *
+         *     **Authorization:** Bearer JWT required. Caller must be a workspace admin, or a platform admin who is a member of this workspace. Members who are not workspace admins receive 403. Non-members of an existing workspace receive 403. Unknown workspaces receive 404.
+         */
+        post: operations["buildWorkspaceAssessmentManifest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/readiness/token-usage": {
         parameters: {
             query?: never;
@@ -2525,6 +2575,50 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/{workspaceId}/assessment-rollout": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read the customer-confirmed assessment rollout day
+         * @description Returns the AI rollout day the customer confirmed for the Agentic AI ROI assessment, interpreted at 00:00 America/New_York, plus who set it and when. This is the only rollout source for the matched pre and post windows. `rolloutDay` is null until an admin sets it. Any workspace member may read it.
+         */
+        get: operations["getWorkspaceAssessmentRollout"];
+        /**
+         * Set the customer-confirmed assessment rollout day
+         * @description Workspace admins, or platform admins who are workspace members, set the rollout day. The day must be a real calendar date that has already started in America/New_York. Each save records the caller and time and writes one `workspace.assessment_rollout.changed` activity-log row.
+         */
+        put: operations["putWorkspaceAssessmentRollout"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/assessment-roi": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read the matched-period ROI from stored evidence
+         * @description Derives the 90-day pre window, the 14-day transition, and the 90-day post window from the confirmed rollout day, then loads calendar-day coverage, merged pull request Ship Weight per window, and recorded USD AI spend for the post window. The figure is USD cost per incremental normalized Ship Weight (per active engineer and Mon–Fri America/New_York working day). Fails closed: `status` is `not_assessable` with a `reason` when a window is incomplete, cost is missing, non-USD, or not attributable by day, Ship Weight is unscored, active engineers are not countable, incremental output is not positive, or a confounder is flagged or cannot be checked. Cost is never estimated. Any workspace member may read it.
+         */
+        get: operations["getWorkspaceAssessmentRoi"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/{workspaceId}/aggregate-use-consent": {
         parameters: {
             query?: never;
@@ -2569,6 +2663,130 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/{workspaceId}/assessment-reports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List stored assessment reports and their secure links
+         * @description Workspace admin (or platform admin who is a workspace member). Lists stored buyer PDFs (metadata only, never bytes) with every secure link grant. Link tokens and token hashes are never returned. A hidden report stays listed: `hidden_restorable` until `restoreUntil`, then `restore_window_ended`. The restore window is restore capability, not erasure. Responses carry `Cache-Control: no-store`.
+         */
+        get: operations["listAssessmentReports"];
+        put?: never;
+        /**
+         * Store a validated buyer PDF for secure delivery
+         * @description Workspace admin (or platform admin who is a workspace member). The client never supplies evidence: the server rebuilds the manifest from stored data with the same builder as `buildWorkspaceAssessmentManifest`, using only `build` (offer, share mode, section status, printed ROI), and stores the PDF only when `buyerDeliverable` is true (validated and internal) and the rebuilt `contentHash` equals the one sent. An external share-safe file is never stored here. The PDF is encrypted with AES-256-GCM and kept in Postgres with its sha256; it is limited to 10 MiB. Records `report.assessment_stored` without report content.
+         */
+        post: operations["storeAssessmentReport"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/assessment-reports/{reportId}/links": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create a secure link and email it to a workspace member
+         * @description Workspace admin (or platform admin who is a workspace member). Creates one link grant for a current workspace member and emails them the link only: generic text and `{siteUrl}/reports/secure?t=<opaque token>`. The email carries no PDF attachment, report name, metrics, repository, or person names. Only the sha256 of the token is stored and the token is never returned. Expiry defaults to 14 days and can be shorter. When SMTP is not configured the grant still stands and `email` says why it was skipped. Hidden reports cannot be shared (`409 report_hidden`).
+         */
+        post: operations["createAssessmentReportLink"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/assessment-reports/{reportId}/links/{grantId}/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Revoke a secure link
+         * @description Workspace admin (or platform admin who is a workspace member). The link stops working immediately. Idempotent: revoking again keeps the first `revokedAt`. Revoking a link does not affect a file the recipient already downloaded. Records `report.assessment_link_revoked`.
+         */
+        post: operations["revokeAssessmentReportLink"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/assessment-reports/{reportId}/hide": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Hide a stored report
+         * @description Workspace admin (or platform admin who is a workspace member). Same semantics as workspace delete: the report is hidden immediately and every link stops downloading. It can be restored for 30 days (`restoreUntil`). That window is restore capability, not erasure; no backup purge date is promised, and a file the buyer already downloaded stays with them. Idempotent. Records `report.assessment_hidden`.
+         */
+        post: operations["hideAssessmentReport"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/assessment-reports/{reportId}/restore": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Restore a hidden report within the 30-day window
+         * @description Workspace admin (or platform admin who is a workspace member). Allowed only before `restoreUntil`; afterwards it fails with `409 restore_window_ended`. Links that were not revoked or expired work again after restore. Records `report.assessment_restored`.
+         */
+        post: operations["restoreAssessmentReport"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/assessment-reports/secure": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Download a stored report through a secure link
+         * @description Bearer JWT required. The caller must be the link recipient and a current member of the report's workspace. Access follows `decideReportAccess`: `leaked_token`, `removed_member`, and `wrong_workspace` answer 403; `expired` and `revoked` answer 410; `invalid_grant` answers 404. A hidden report answers `410 report_hidden`. Every response carries `Cache-Control: no-store`. Records `report.assessment_downloaded` without report content.
+         */
+        get: operations["downloadAssessmentReport"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/{workspaceId}/activity": {
         parameters: {
             query?: never;
@@ -3343,7 +3561,7 @@ export interface paths {
         put?: never;
         /**
          * Upload a Conversations attachment
-         * @description Any workspace member when chat is ready. Validates size/type against the active provider profile (`attachmentLimits` from readiness). Returns metadata; pass `id` as `attachmentIds` on the next POST message. Max 5 MB per file.
+         * @description Any workspace member when chat is ready. Validates size/type against the active provider profile (`attachmentLimits` from readiness). Returns metadata; pass `id` as `attachmentIds` on the next POST message. Max 5 MB per file (JSON bodyLimit is raised for `contentBase64`). When unbound uploads already sit at the per-message file cap (e.g. after an aborted send), the oldest unbound rows are pruned so a new attach can proceed.
          */
         post: operations["postCodeChatAttachment"];
         delete?: never;
@@ -4287,7 +4505,7 @@ export interface paths {
         put?: never;
         /**
          * Import org chart from Supabase storage path
-         * @description Parse-only. Downloads the CSV at `storagePath` from the `org-charts` bucket and returns `persons` and `errors`. Does not persist to `spa_org_chart` or `org_chart`. The SPA derives teams client-side and saves the org structure via `POST /workspaces/{workspaceId}/org-chart`. Required columns: employee_id, name, email, title, department, team, manager_id, location. Optional: github_username (GitHub login for productivity ingest), bitbucket_nickname, bitbucket_uuid, alternate_emails (comma-separated alternate work emails for AI tool spend attribution). Saving the SPA snapshot also materializes a scoring `org_chart` tree for team/person metrics when import members are present. Parse-only responses may include duplicateEmailWarnings, identityEmailPreview (cross-check against connected AI tool seat rosters), and importWarnings when roster preview is unavailable.
+         * @description Parse-only. Downloads the CSV at `storagePath` from the `org-charts` bucket and returns `persons` and `errors`. Does not persist to `spa_org_chart` or `org_chart`. The SPA derives teams client-side and saves the org structure via `POST /workspaces/{workspaceId}/org-chart`. Required columns: employee_id, name, email, title, department, team, manager_id, location. Optional: github_username (GitHub login for productivity ingest), bitbucket_nickname, bitbucket_uuid, gitlab_username (GitLab.com or self-managed username), alternate_emails (comma-separated alternate work emails for AI tool spend attribution). Saving the SPA snapshot also materializes a scoring `org_chart` tree for team/person metrics when import members are present. Parse-only responses may include duplicateEmailWarnings, identityEmailPreview (cross-check against connected AI tool seat rosters), and importWarnings when roster preview is unavailable.
          */
         post: operations["postOrgChartImport"];
         delete?: never;
@@ -4744,6 +4962,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/{workspaceId}/sources/discover": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * List repositories a GitLab or Bitbucket source can read (does not persist)
+         * @description Lists projects (GitLab.com, self-managed GitLab) or repositories (Bitbucket Cloud, Bitbucket Data Center) for repository selection. Nothing is stored. Self-managed and Data Center `baseUrl` must be `https`, public, and without credentials; private, loopback, and link-local hosts are rejected before any request. `env:` token references are rejected for self-hosted providers and never resolved from the request for cloud providers. A blank or `***` token reuses the stored source with the same provider, host, and account, and requires the editor or admin role. The list covers the whole account (group or workspace/project key), not only `projects`/`repos`. `repoCap` is the standard repository cap (50); ingest refuses to auto-select more than that. Tokens are never returned.
+         */
+        post: operations["postWorkspaceVcsRepoDiscovery"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/{workspaceId}/vcs-provider-coverage": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * GitLab and Bitbucket Data Coverage freshness (server-computed)
+         * @description One row per configured GitLab or Bitbucket source. Freshness is computed on the server from batch-written sync rows and succeeded readiness runs; no request field can mark a row fresh. Git is fresh when the last complete ingest finished within `gitFreshnessHours` (24) and no error was recorded after it. A readiness scan is fresh within `readinessScanFreshnessDays` (30, America/New_York calendar days); `scansFresh` requires every in-scope repository to have a fresh scan. A source with an invalid base URL or missing account is `misconfigured`. Requires workspace membership.
+         */
+        get: operations["getWorkspaceVcsProviderCoverage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/{workspaceId}/ingest/productivity/repos/{slug}/retry": {
         parameters: {
             query?: never;
@@ -5068,6 +5326,81 @@ export interface paths {
 export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
+        /** @description Body of runAssessmentManifestValidation; buildWorkspaceAssessmentManifest returns the server-built object as `validation`. */
+        AssessmentManifestValidationBodyDto: {
+            manifest: {
+                /** @enum {string} */
+                offerId: "engineering_readiness_baseline" | "agentic_ai_roi";
+                dictionaryVersion: string;
+                /** @enum {string} */
+                validation: "validated" | "not_validated";
+                /** @enum {string} */
+                shareMode: "internal" | "external";
+                /** @enum {string|null} */
+                watermark: "NOT VALIDATED" | "SAMPLE · SYNTHETIC DATA" | null;
+                scope: {
+                    repositories: {
+                        id: string;
+                        name: string;
+                    }[];
+                    excluded: {
+                        id: string;
+                        name: string;
+                        reason: string;
+                    }[];
+                };
+                windows: {
+                    pre: {
+                        start: string;
+                        end: string;
+                    } | null;
+                    post: {
+                        start: string;
+                        end: string;
+                    } | null;
+                    transitionDays: number;
+                };
+                sources: {
+                    provider: string;
+                    status: string;
+                    freshAt: string | null;
+                }[];
+                consent: {
+                    /** @enum {string} */
+                    aggregateUse: "opt_in" | "opt_out" | "unset";
+                    recordedAt: string | null;
+                };
+                sections: {
+                    id: string;
+                    /** @enum {string} */
+                    status: "ok" | "failed" | "omitted";
+                    reason?: string;
+                }[];
+            };
+            workspaceId: string;
+            expectedWorkspaceId: string;
+            expectedRepositoryIds: string[];
+            soldWindowComplete: boolean;
+            premiumAiAssessable: boolean;
+            namedPersonSectionIds: string[];
+            tolerances: {
+                id: string;
+                /** @enum {string} */
+                status: "unset" | "exceeded" | "within";
+            }[];
+        };
+        AssessmentManifestValidationResultDto: {
+            buyerDeliverable: boolean;
+            /** @enum {string} */
+            validation: "validated" | "not_validated";
+            /** @enum {string|null} */
+            watermark: "NOT VALIDATED" | null;
+            reasons: {
+                code: string;
+                message: string;
+            }[];
+            contentHash: string;
+        };
         TeamsInstallUrlDto: {
             /** Format: uri */
             url: string;
@@ -5233,6 +5566,8 @@ export interface components {
             bitbucketNickname?: string;
             /** @description Bitbucket account UUID (e.g. "{aeefb6b0-...}") to attribute merged PRs and reviews to this person in productivity ingest. Preferred over bitbucketNickname — Bitbucket PR payloads expose a stable uuid but not nickname. Resolves to the same person_id (email) as githubUsername. */
             bitbucketUuid?: string;
+            /** @description GitLab username (no @; GitLab.com or self-managed) to map merged merge requests and commits to this person in productivity ingest and the assessment active-engineer count. Stored lowercased. Resolves to the same person_id (email) as githubUsername. */
+            gitlabUsername?: string;
             /** @description Optional comma-separated work emails that map to the same person for AI tool spend/usage (mirrors multi-login github_username). Primary email remains canonical person_id. */
             alternateEmails?: string;
         };
@@ -5263,6 +5598,7 @@ export interface components {
             githubUsername?: string;
             bitbucketNickname?: string;
             bitbucketUuid?: string;
+            gitlabUsername?: string;
             /** @description Comma-separated alternate work emails for AI tool attribution. */
             alternateEmails?: string;
         };
@@ -7792,10 +8128,88 @@ export interface components {
          * @enum {string}
          */
         ReadinessDimensionId: "ai-agent-readiness" | "token-efficiency" | "repo-hygiene" | "stack-quality" | "tests-qa" | "observability" | "api-contracts" | "platform-governance" | "delivery";
+        /**
+         * @description `bitbucket_server` is Bitbucket Data Center. Self-hosted providers (`gitlab_self_managed`, `bitbucket_server`) always carry `hostBaseUrl`.
+         * @enum {string}
+         */
+        ExternalVcsProviderDto: "gitlab_cloud" | "gitlab_self_managed" | "bitbucket_cloud" | "bitbucket_server";
+        /** @description GitLab or Bitbucket tenant source entry. GitLab: optional `group` (full path) and `projects` (`group/sub/project`). Bitbucket: `workspace` (Cloud workspace or Data Center project key) and optional `repos` (repository slugs). `deployment` selects self-hosted; it then requires `baseUrl`. */
+        GitVcsSourceDto: {
+            /** @enum {string} */
+            type: "gitlab" | "bitbucket";
+            /** @enum {string} */
+            deployment?: "cloud" | "self_managed" | "data_center";
+            baseUrl?: string;
+            group?: string;
+            projects?: string[];
+            workspace?: string;
+            repos?: string[];
+            /** @description Personal / project / HTTP access token, or `***` to reuse the stored token. */
+            token?: string;
+        } & {
+            [key: string]: unknown;
+        };
+        VcsDiscoveredRepoDto: {
+            /** @description `group/sub/project` (GitLab) or `workspace/repo` / `PROJECT/repo` (Bitbucket) */
+            slug: string;
+            name: string;
+            defaultBranch: string | null;
+            webUrl: string | null;
+        };
+        VcsRepoDiscoveryResponseDto: {
+            provider: components["schemas"]["ExternalVcsProviderDto"];
+            hostBaseUrl: string | null;
+            /** @description GitLab group path (empty = token membership), Bitbucket workspace, or project key */
+            account: string;
+            /** @description True when the provider page limit was reached; the list is incomplete. */
+            truncated: boolean;
+            repoCap: number;
+            repositories: components["schemas"]["VcsDiscoveredRepoDto"][];
+        };
+        VcsProviderCoverageRowDto: {
+            provider: components["schemas"]["ExternalVcsProviderDto"];
+            hostBaseUrl: string | null;
+            account: string;
+            selfHosted: boolean;
+            /** @enum {string} */
+            state: "fresh" | "stale" | "never_synced" | "error" | "misconfigured";
+            /** @description Server-computed; true only when `state` is `fresh`. */
+            isFresh: boolean;
+            /** Format: date-time */
+            lastIngestSuccessAt: string | null;
+            lastErrorKind: string | null;
+            /** Format: date-time */
+            lastDiscoveryAt: string | null;
+            discoveredRepoCount: number | null;
+            /** @description Milliseconds past the Git freshness limit when `state` is `stale`. */
+            staleForMs: number | null;
+            /** @description In-scope repositories stored for this source. */
+            repoCount: number;
+            scannedRepoCount: number;
+            freshScanRepoCount: number;
+            scansFresh: boolean;
+            /**
+             * Format: date-time
+             * @description Earliest merge time reached by the assessment merged-request history backfill for this source; null when no backfill window has been written.
+             */
+            mergedHistorySince: string | null;
+            /**
+             * Format: date-time
+             * @description Instant from which every in-scope repository of this source has contiguous default-branch commit-author coverage (latest per-repo coverage start); null when any repository has no coverage.
+             */
+            commitHistorySince: string | null;
+        };
+        VcsProviderCoverageDto: {
+            /** Format: date-time */
+            generatedAt: string;
+            gitFreshnessHours: number;
+            readinessScanFreshnessDays: number;
+            sources: components["schemas"]["VcsProviderCoverageRowDto"][];
+        };
         RepoProviderDto: {
             /** @enum {string} */
-            kind: "github" | "bitbucket_cloud" | "bitbucket_server";
-            /** @description owner/repo (GitHub), workspace/repo_slug (Bitbucket Cloud), or PROJECT_KEY/repo_slug (Bitbucket Server) */
+            kind: "github" | "bitbucket_cloud" | "bitbucket_server" | "gitlab_cloud" | "gitlab_self_managed";
+            /** @description owner/repo (GitHub), workspace/repo_slug (Bitbucket Cloud), PROJECT_KEY/repo_slug (Bitbucket Server / Data Center), or group/sub/project (GitLab) */
             slug: string;
             /**
              * Format: uri
@@ -7807,7 +8221,7 @@ export interface components {
             externalId?: string | null;
             /**
              * Format: uri
-             * @description Required for bitbucket_server (self-hosted); null for cloud providers
+             * @description Required for bitbucket_server and gitlab_self_managed (self-hosted); null for cloud providers
              */
             hostBaseUrl?: string | null;
         };
@@ -9156,11 +9570,7 @@ export interface components {
          * @description Type of workspace lifecycle event.
          * @enum {string}
          */
-        ActivityLogEventTypeDto: "repo.added" | "repo.removed" | "repo.readded" | "integration.github.added" | "integration.github.updated" | "integration.github.removed" | "integration.github.permissions_changed" | "integration.github.suspended" | "integration.github.unsuspended" | "integration.github.repo_added" | "integration.github.repo_removed" | "fix.requested" | "fix.generating" | "fix.pr_created" | "fix.merged" | "fix.failed" | "readiness.scan_started" | "readiness.scan_completed" | "readiness.scan_failed" | "readiness.scan_partial" | "code_insights.design_run_started" | "integrations.agent_execution.provider_changed" | "integrations.repo_eligibility.overrides_changed" | "integrations.repo_eligibility.languages_refresh_requested" | "integrations.cursor.platform_key_enabled" | "integrations.cursor.platform_key_disabled" | "member.invited" | "member.invite_accepted" | "member.invite_rejected" | "member.role_changed" | "member.removed" | "hris.personio.sync_started" | "hris.personio.sync_completed" | "hris.personio.sync_failed" | "hris.zenhr.sync_started" | "hris.zenhr.sync_completed" | "hris.zenhr.sync_failed" | "hris.zelt.sync_started" | "hris.zelt.sync_completed" | "hris.zelt.sync_failed" | "hris.hibob.sync_started" | "hris.hibob.sync_completed" | "hris.hibob.sync_failed" | "hris.sync_started" | "hris.sync_completed" | "hris.sync_failed" | "repo.sync_skipped" | "integrations.cursor.execution_key.added" | "integrations.cursor.execution_key.updated" | "integrations.cursor.execution_key.removed" | "integrations.cursor.execution_key.check_failed" | "integrations.cursor.admin_key.added" | "integrations.cursor.admin_key.updated" | "integrations.cursor.admin_key.removed" | "integrations.claude.execution_key.added" | "integrations.claude.execution_key.updated" | "integrations.claude.execution_key.removed" | "integrations.claude.execution_key.check_failed" | "integrations.claude.admin_key.added" | "integrations.claude.admin_key.updated" | "integrations.claude.admin_key.removed" | "integrations.claude.analytics_key.added" | "integrations.claude.analytics_key.updated" | "integrations.claude.analytics_key.removed" | "integrations.code_intelligence.settings_changed" | "integrations.code_intelligence.execution_key.added" | "integrations.code_intelligence.execution_key.updated" | "integrations.code_intelligence.execution_key.removed" | "integrations.code_intelligence.execution_key.check_failed" | "readiness.scan_precheck_failed" | "productivity.ingest.completed" | "productivity.ingest.failed" | "productivity.ingest.skipped" | "productivity.ingest.repo_skipped" | "productivity.ingest.coverage_gap_detected" | "integrations.newrelic.added" | "integrations.newrelic.removed" | "integrations.newrelic.sync_completed" | "integrations.newrelic.sync_failed" | "integrations.prometheus.added" | "integrations.prometheus.removed" | "integrations.prometheus.sync_completed" | "integrations.prometheus.sync_failed" | "integrations.grafana.added" | "integrations.grafana.removed" | "integrations.grafana.sync_completed" | "integrations.grafana.sync_failed" | "integrations.zelt.added" | "integrations.zelt.removed" | "report.exported" | "workspace.aggregate_use.changed";
-        UnsetAssessmentDecisionDto: {
-            /** @enum {string} */
-            status: "unset";
-        };
+        ActivityLogEventTypeDto: "repo.added" | "repo.removed" | "repo.readded" | "integration.github.added" | "integration.github.updated" | "integration.github.removed" | "integration.github.permissions_changed" | "integration.github.suspended" | "integration.github.unsuspended" | "integration.github.repo_added" | "integration.github.repo_removed" | "fix.requested" | "fix.generating" | "fix.pr_created" | "fix.merged" | "fix.failed" | "readiness.scan_started" | "readiness.scan_completed" | "readiness.scan_failed" | "readiness.scan_partial" | "code_insights.design_run_started" | "integrations.agent_execution.provider_changed" | "integrations.repo_eligibility.overrides_changed" | "integrations.repo_eligibility.languages_refresh_requested" | "integrations.cursor.platform_key_enabled" | "integrations.cursor.platform_key_disabled" | "member.invited" | "member.invite_accepted" | "member.invite_rejected" | "member.role_changed" | "member.removed" | "hris.personio.sync_started" | "hris.personio.sync_completed" | "hris.personio.sync_failed" | "hris.zenhr.sync_started" | "hris.zenhr.sync_completed" | "hris.zenhr.sync_failed" | "hris.zelt.sync_started" | "hris.zelt.sync_completed" | "hris.zelt.sync_failed" | "hris.hibob.sync_started" | "hris.hibob.sync_completed" | "hris.hibob.sync_failed" | "hris.sync_started" | "hris.sync_completed" | "hris.sync_failed" | "repo.sync_skipped" | "integrations.cursor.execution_key.added" | "integrations.cursor.execution_key.updated" | "integrations.cursor.execution_key.removed" | "integrations.cursor.execution_key.check_failed" | "integrations.cursor.admin_key.added" | "integrations.cursor.admin_key.updated" | "integrations.cursor.admin_key.removed" | "integrations.claude.execution_key.added" | "integrations.claude.execution_key.updated" | "integrations.claude.execution_key.removed" | "integrations.claude.execution_key.check_failed" | "integrations.claude.admin_key.added" | "integrations.claude.admin_key.updated" | "integrations.claude.admin_key.removed" | "integrations.claude.analytics_key.added" | "integrations.claude.analytics_key.updated" | "integrations.claude.analytics_key.removed" | "integrations.code_intelligence.settings_changed" | "integrations.code_intelligence.execution_key.added" | "integrations.code_intelligence.execution_key.updated" | "integrations.code_intelligence.execution_key.removed" | "integrations.code_intelligence.execution_key.check_failed" | "readiness.scan_precheck_failed" | "productivity.ingest.completed" | "productivity.ingest.failed" | "productivity.ingest.skipped" | "productivity.ingest.repo_skipped" | "productivity.ingest.coverage_gap_detected" | "integrations.newrelic.added" | "integrations.newrelic.removed" | "integrations.newrelic.sync_completed" | "integrations.newrelic.sync_failed" | "integrations.prometheus.added" | "integrations.prometheus.removed" | "integrations.prometheus.sync_completed" | "integrations.prometheus.sync_failed" | "integrations.grafana.added" | "integrations.grafana.removed" | "integrations.grafana.sync_completed" | "integrations.grafana.sync_failed" | "integrations.zelt.added" | "integrations.zelt.removed" | "report.exported" | "report.assessment_stored" | "report.assessment_link_sent" | "report.assessment_link_revoked" | "report.assessment_downloaded" | "report.assessment_hidden" | "report.assessment_restored" | "workspace.aggregate_use.changed" | "workspace.assessment_rollout.changed";
         /** @description Current legal-approved opt-in notice, or `unset` while opt-in is unavailable. */
         AggregateUseNoticeStatusDto: {
             /** @enum {string} */
@@ -9168,14 +9578,130 @@ export interface components {
             /** @description Present only when `status` is `approved`. Send it back on opt-in. */
             version?: string;
         };
-        AggregateUseConsentDto: {
+        /**
+         * @description Confounder-relevant named event from the assessment dictionary.
+         * @enum {string}
+         */
+        AssessmentNamedEventDto: "major_release" | "migration" | "acquisition" | "policy_change";
+        AssessmentRolloutDto: {
             /**
-             * @description Saved choice. `unset` means the workspace never chose and is treated as opted out.
-             * @enum {string}
+             * Format: date
+             * @description Confirmed rollout day (`YYYY-MM-DD`); null until set.
              */
-            aggregateUse: "opt_in" | "opt_out" | "unset";
-            /** @description True only for `opt_in`. Benchmark and marketing extraction must check this. */
-            effective: boolean;
+            rolloutDay: string | null;
+            /** @enum {string} */
+            timezone: "America/New_York";
+            /** @enum {string} */
+            boundary: "midnight";
+            /**
+             * Format: date-time
+             * @description UTC instant of 00:00 America/New_York on `rolloutDay`.
+             */
+            startsAt: string | null;
+            setBy: {
+                /** Format: uuid */
+                userId: string;
+                displayName: string | null;
+            } | null;
+            /** Format: date-time */
+            setAt: string | null;
+            /** @description Named events confirmed during either matched window. Null means the customer or operator has not confirmed yet, so the ROI confounder check reports `confounder_inputs_missing`. An empty array confirms none occurred. */
+            namedEvents: components["schemas"]["AssessmentNamedEventDto"][] | null;
+            namedEventsConfirmedBy: {
+                /** Format: uuid */
+                userId: string;
+                displayName: string | null;
+            } | null;
+            /** Format: date-time */
+            namedEventsConfirmedAt: string | null;
+        };
+        AssessmentRolloutPutDto: {
+            /**
+             * Format: date
+             * @description Real calendar date, not after today in America/New_York.
+             */
+            rolloutDay: string;
+            /** @description Omit to leave the stored named-event confirmation unchanged. Send an empty array to confirm no named event occurred during either matched window, or the events that did. */
+            namedEvents?: components["schemas"]["AssessmentNamedEventDto"][];
+        };
+        /**
+         * @description Why the matched-period ROI is not assessable. `cost_not_attributable` means a billing-cycle bill (GitHub Copilot) overlaps the post window and cannot be split by day. `active_engineers_unknown` means stored identities cannot yet be counted. `confounder_inputs_missing` means a named-event, headcount, or repository-scope check has no stored input.
+         * @enum {string}
+         */
+        AssessmentRoiReasonDto: "rollout_unset" | "window_missing" | "missing_cost" | "non_usd_cost" | "cost_not_attributable" | "ship_weight_incomplete" | "active_engineers_unknown" | "non_positive_output" | "normalization_unset" | "confounder" | "confounder_inputs_missing" | "output_unit_mismatch";
+        AssessmentRoiDayRangeDto: {
+            /** Format: date */
+            from: string;
+            /** Format: date */
+            to: string;
+        };
+        AssessmentRoiWindowDto: {
+            /** Format: date */
+            from: string;
+            /** Format: date */
+            to: string;
+            /** @description Calendar days in the window (90). */
+            requiredDays: number;
+            /** @description Calendar days with stored evidence. */
+            coveredDays: number;
+            /** @description Every calendar day is covered and the window ended before today. */
+            complete: boolean;
+            /** @description Monday–Friday days in America/New_York. No holidays. */
+            workingDays: number;
+            activeEngineers: number | null;
+            mergedPullRequests: number;
+            /** @description Sum of stored Ship Weight for unique merged pull requests; null if any is unscored. */
+            shipWeight: number | null;
+            /** @description Ship Weight per active engineer per working day. */
+            normalizedShipWeight: number | null;
+        };
+        AssessmentRoiDto: {
+            dictionaryVersion: string;
+            /** Format: date */
+            rolloutDay: string | null;
+            rolloutBoundary: {
+                /** @enum {string} */
+                timezone: "America/New_York";
+                /** @enum {string} */
+                boundary: "midnight";
+                /** Format: date-time */
+                startsAt: string | null;
+            };
+            windows: {
+                pre: components["schemas"]["AssessmentRoiWindowDto"] | null;
+                transition: components["schemas"]["AssessmentRoiDayRangeDto"] | null;
+                post: components["schemas"]["AssessmentRoiWindowDto"] | null;
+            };
+            /** @description Recorded daily AI spend inside the post window. Never estimated. */
+            cost: {
+                amountUsd: number | null;
+                /** @enum {string|null} */
+                currency: "USD" | null;
+                providers: string[];
+            };
+            confounders: {
+                /** @description Null when no named-event input is stored. */
+                namedEvent: boolean | null;
+                headcountChangeRatio: number | null;
+                /** @description Repositories with merged pull requests in only one window, over pre-window repositories. */
+                repositoryScopeChangeRatio: number | null;
+            };
+            /** @enum {string} */
+            status: "assessable" | "not_assessable";
+            reason: components["schemas"]["AssessmentRoiReasonDto"] | null;
+            incrementalNormalizedShipWeight: number | null;
+            costPerIncrementalShipWeightUsd: number | null;
+            /** @description Separate correlation. Never the sold ROI figure. */
+            costPerMergedPullRequestUsd: number | null;
+        };
+        AggregateUseConsentDto: {
+            /**
+             * @description Saved choice. `unset` means the workspace never chose and is treated as opted out.
+             * @enum {string}
+             */
+            aggregateUse: "opt_in" | "opt_out" | "unset";
+            /** @description True only for `opt_in`. Benchmark and marketing extraction must check this. */
+            effective: boolean;
             /** @description Notice version accepted with the current opt-in; null otherwise. */
             noticeVersion: string | null;
             /** @enum {string|null} */
@@ -9207,7 +9733,7 @@ export interface components {
         };
         AssessmentDictionaryDto: {
             /** @enum {string} */
-            version: "2026-10-20.1";
+            version: "2026-10-24.1";
             /** @enum {integer} */
             periodDays: 90;
             /** @enum {integer} */
@@ -9285,8 +9811,22 @@ export interface components {
                 costAssessableCurrency: "USD";
             };
             unresolved: {
-                baselinePrice: components["schemas"]["UnsetAssessmentDecisionDto"];
-                premiumPrice: components["schemas"]["UnsetAssessmentDecisionDto"];
+                baselinePrice: {
+                    /** @enum {string} */
+                    status: "set";
+                    /** @enum {integer} */
+                    amountUsd: 4999;
+                    /** @enum {string} */
+                    taxes: "extra";
+                };
+                premiumPrice: {
+                    /** @enum {string} */
+                    status: "set";
+                    /** @enum {integer} */
+                    amountUsd: 9999;
+                    /** @enum {string} */
+                    taxes: "extra";
+                };
                 currency: {
                     /** @enum {string} */
                     status: "set";
@@ -9334,7 +9874,14 @@ export interface components {
                     /** @enum {string} */
                     holidays: "none";
                 };
-                countryAllowList: components["schemas"]["UnsetAssessmentDecisionDto"];
+                /** @description Owner decision without counsel acceptance; `counselAccepted` stays false. */
+                countryAllowList: {
+                    /** @enum {string} */
+                    status: "set";
+                    countries: ("US" | "BH" | "KW" | "OM" | "QA" | "SA" | "AE")[];
+                    /** @enum {boolean} */
+                    counselAccepted: false;
+                };
             };
         };
         /** @description Metadata for a successful Report Center PDF download. Secret-free; no table payloads. Recorded as `report.exported` on the workspace activity log. */
@@ -9361,6 +9908,126 @@ export interface components {
             providerIds?: string[];
             repoIds?: string[];
         };
+        StoreAssessmentReportBodyDto: {
+            /** @description The buyer PDF, base64-encoded. Must start with `%PDF-`; at most 10 MiB decoded. */
+            pdfBase64: string;
+            build: components["schemas"]["BuildAssessmentManifestBodyDto"];
+            /** @description `result.contentHash` from the `buildWorkspaceAssessmentManifest` call the PDF was rendered from. The server rebuilds the manifest and rejects a different hash. */
+            contentHash: string;
+        };
+        BuildAssessmentManifestBodyDto: {
+            /** @enum {string} */
+            offerId: "engineering_readiness_baseline" | "agentic_ai_roi";
+            /** @enum {string} */
+            shareMode: "internal" | "external";
+            /** @description Every selected section with its render status. Ids are unique. */
+            sections: {
+                id: string;
+                /** @enum {string} */
+                status: "ok" | "failed" | "omitted";
+                reason?: string;
+            }[];
+            /** @description The matched-period ROI chapter as printed, copied from the `getWorkspaceAssessmentRoi` result it rendered. Null or omitted when the chapter did not print one. */
+            roi?: components["schemas"]["PrintedAssessmentRoiDto"] | null;
+        };
+        PrintedAssessmentRoiDto: {
+            /** @enum {string} */
+            status: "assessable" | "not_assessable";
+            reason: string | null;
+            incrementalNormalizedShipWeight: number | null;
+            costPerIncrementalShipWeightUsd: number | null;
+            costPerMergedPullRequestUsd: number | null;
+        };
+        BuildAssessmentManifestResponseDto: {
+            validation: components["schemas"]["AssessmentManifestValidationBodyDto"];
+            result: components["schemas"]["AssessmentManifestValidationResultDto"];
+        };
+        StoreAssessmentReportRejectedDto: {
+            error: string;
+            /** @enum {string} */
+            code: "not_buyer_deliverable" | "manifest_changed";
+            /** @enum {string} */
+            validation?: "validated" | "not_validated";
+            reasons?: {
+                code: string;
+                message: string;
+            }[];
+        };
+        AssessmentReportLinkDto: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            reportId: string;
+            /** Format: uuid */
+            recipientUserId: string;
+            /** @description Null when the recipient is no longer a workspace member. */
+            recipientEmail: string | null;
+            recipientName: string | null;
+            /** Format: date-time */
+            expiresAt: string;
+            /** Format: date-time */
+            revokedAt: string | null;
+            /** Format: date-time */
+            createdAt: string;
+            /** Format: date-time */
+            lastAccessedAt: string | null;
+            /** @enum {string} */
+            status: "active" | "expired" | "revoked";
+        };
+        AssessmentReportDto: {
+            /** Format: uuid */
+            id: string;
+            /** @enum {string} */
+            offerId: "engineering_readiness_baseline" | "agentic_ai_roi";
+            sizeBytes: number;
+            /** @description sha256 of the plaintext PDF. */
+            sha256: string;
+            /** @description `contentHash` of the validated manifest. */
+            manifestHash: string;
+            /** Format: date-time */
+            createdAt: string;
+            /** Format: uuid */
+            createdBy: string | null;
+            /** Format: date-time */
+            hiddenAt: string | null;
+            /**
+             * Format: date-time
+             * @description End of the restore window. Not an erasure or backup purge date.
+             */
+            restoreUntil: string | null;
+            /** @enum {string} */
+            status: "available" | "hidden_restorable" | "restore_window_ended";
+            links: components["schemas"]["AssessmentReportLinkDto"][];
+        };
+        AssessmentReportListDto: {
+            /** @enum {integer} */
+            restoreWindowDays: 30;
+            /**
+             * @description Default and maximum secure link lifetime in days.
+             * @enum {integer}
+             */
+            secureLinkDays: 14;
+            reports: components["schemas"]["AssessmentReportDto"][];
+        };
+        CreateAssessmentReportLinkBodyDto: {
+            /**
+             * Format: uuid
+             * @description A current workspace member (`TeamMemberDto.id`).
+             */
+            recipientUserId: string;
+            /** @default 14 */
+            expiresInDays: number;
+        };
+        CreateAssessmentReportLinkResponseDto: {
+            link: components["schemas"]["AssessmentReportLinkDto"];
+            /** @enum {string} */
+            email: "sent" | "skipped_missing_smtp" | "skipped_missing_base_url" | "failed";
+        };
+        AssessmentReportAccessErrorDto: {
+            error: string;
+            /** @enum {string} */
+            code: "leaked_token" | "removed_member" | "wrong_workspace" | "expired" | "revoked" | "invalid_grant" | "report_hidden";
+        };
         ReportCenterExportRecordResponseDto: {
             /** @enum {boolean} */
             ok: true;
@@ -11756,6 +12423,8 @@ export interface components {
     };
     parameters: {
         WorkspaceId: string;
+        /** @description Stored assessment report id (`tai_workspace_assessment_reports.id`). */
+        AssessmentReportId: string;
         /** @description Eval suite id (`tai_workspace_eval_suites.id`). */
         EvalSuiteId: string;
         /** @description Platform starter pack id (kebab-case), e.g. `pr-review`. Not a UUID. */
@@ -11845,6 +12514,8 @@ export interface components {
     headers: never;
     pathItems: never;
 }
+export type AssessmentManifestValidationBodyDto = components['schemas']['AssessmentManifestValidationBodyDto'];
+export type AssessmentManifestValidationResultDto = components['schemas']['AssessmentManifestValidationResultDto'];
 export type TeamsInstallUrlDto = components['schemas']['TeamsInstallUrlDto'];
 export type TeamsConnectionDto = components['schemas']['TeamsConnectionDto'];
 export type TeamsChannelBodyDto = components['schemas']['TeamsChannelBodyDto'];
@@ -12074,6 +12745,12 @@ export type NdaCompletionExternalDto = components['schemas']['NdaCompletionExter
 export type NdaExternalBodyDto = components['schemas']['NdaExternalBodyDto'];
 export type ReadinessDimensionDto = components['schemas']['ReadinessDimensionDto'];
 export type ReadinessDimensionId = components['schemas']['ReadinessDimensionId'];
+export type ExternalVcsProviderDto = components['schemas']['ExternalVcsProviderDto'];
+export type GitVcsSourceDto = components['schemas']['GitVcsSourceDto'];
+export type VcsDiscoveredRepoDto = components['schemas']['VcsDiscoveredRepoDto'];
+export type VcsRepoDiscoveryResponseDto = components['schemas']['VcsRepoDiscoveryResponseDto'];
+export type VcsProviderCoverageRowDto = components['schemas']['VcsProviderCoverageRowDto'];
+export type VcsProviderCoverageDto = components['schemas']['VcsProviderCoverageDto'];
 export type RepoProviderDto = components['schemas']['RepoProviderDto'];
 export type ReadinessAnalyzeBodyDto = components['schemas']['ReadinessAnalyzeBodyDto'];
 export type ReadinessInitializeResponseDto = components['schemas']['ReadinessInitializeResponseDto'];
@@ -12215,12 +12892,29 @@ export type PutAgenticFoundationRepoScopeAppliedDto = components['schemas']['Put
 export type PutAgenticFoundationRepoScopeFailureDto = components['schemas']['PutAgenticFoundationRepoScopeFailureDto'];
 export type PutAgenticFoundationRepoScopeResponseDto = components['schemas']['PutAgenticFoundationRepoScopeResponseDto'];
 export type ActivityLogEventTypeDto = components['schemas']['ActivityLogEventTypeDto'];
-export type UnsetAssessmentDecisionDto = components['schemas']['UnsetAssessmentDecisionDto'];
 export type AggregateUseNoticeStatusDto = components['schemas']['AggregateUseNoticeStatusDto'];
+export type AssessmentNamedEventDto = components['schemas']['AssessmentNamedEventDto'];
+export type AssessmentRolloutDto = components['schemas']['AssessmentRolloutDto'];
+export type AssessmentRolloutPutDto = components['schemas']['AssessmentRolloutPutDto'];
+export type AssessmentRoiReasonDto = components['schemas']['AssessmentRoiReasonDto'];
+export type AssessmentRoiDayRangeDto = components['schemas']['AssessmentRoiDayRangeDto'];
+export type AssessmentRoiWindowDto = components['schemas']['AssessmentRoiWindowDto'];
+export type AssessmentRoiDto = components['schemas']['AssessmentRoiDto'];
 export type AggregateUseConsentDto = components['schemas']['AggregateUseConsentDto'];
 export type AggregateUseConsentPutDto = components['schemas']['AggregateUseConsentPutDto'];
 export type AssessmentDictionaryDto = components['schemas']['AssessmentDictionaryDto'];
 export type ReportCenterExportRecordBodyDto = components['schemas']['ReportCenterExportRecordBodyDto'];
+export type StoreAssessmentReportBodyDto = components['schemas']['StoreAssessmentReportBodyDto'];
+export type BuildAssessmentManifestBodyDto = components['schemas']['BuildAssessmentManifestBodyDto'];
+export type PrintedAssessmentRoiDto = components['schemas']['PrintedAssessmentRoiDto'];
+export type BuildAssessmentManifestResponseDto = components['schemas']['BuildAssessmentManifestResponseDto'];
+export type StoreAssessmentReportRejectedDto = components['schemas']['StoreAssessmentReportRejectedDto'];
+export type AssessmentReportLinkDto = components['schemas']['AssessmentReportLinkDto'];
+export type AssessmentReportDto = components['schemas']['AssessmentReportDto'];
+export type AssessmentReportListDto = components['schemas']['AssessmentReportListDto'];
+export type CreateAssessmentReportLinkBodyDto = components['schemas']['CreateAssessmentReportLinkBodyDto'];
+export type CreateAssessmentReportLinkResponseDto = components['schemas']['CreateAssessmentReportLinkResponseDto'];
+export type AssessmentReportAccessErrorDto = components['schemas']['AssessmentReportAccessErrorDto'];
 export type ReportCenterExportRecordResponseDto = components['schemas']['ReportCenterExportRecordResponseDto'];
 export type ActivityLogActorDto = components['schemas']['ActivityLogActorDto'];
 export type ActivityLogEntryDto = components['schemas']['ActivityLogEntryDto'];
@@ -12449,6 +13143,7 @@ export type ResponseUnauthorized = components['responses']['Unauthorized'];
 export type ResponseForbidden = components['responses']['Forbidden'];
 export type ResponseZenHrSyncInProgress = components['responses']['ZenHrSyncInProgress'];
 export type ParameterWorkspaceId = components['parameters']['WorkspaceId'];
+export type ParameterAssessmentReportId = components['parameters']['AssessmentReportId'];
 export type ParameterEvalSuiteId = components['parameters']['EvalSuiteId'];
 export type ParameterEvalPackId = components['parameters']['EvalPackId'];
 export type ParameterEvalRunId = components['parameters']['EvalRunId'];
@@ -12919,6 +13614,11 @@ export interface operations {
                                 label: string;
                                 href: string | null;
                             } | null;
+                            /**
+                             * Format: date
+                             * @description America/New_York day the five-business-day clock started.
+                             */
+                            clockStartedOn: string | null;
                             /** Format: date */
                             dueDate: string | null;
                             /** Format: date-time */
@@ -12962,68 +13662,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": {
-                    manifest: {
-                        /** @enum {string} */
-                        offerId: "engineering_readiness_baseline" | "agentic_ai_roi";
-                        dictionaryVersion: string;
-                        /** @enum {string} */
-                        validation: "validated" | "not_validated";
-                        /** @enum {string} */
-                        shareMode: "internal" | "external";
-                        /** @enum {string|null} */
-                        watermark: "NOT VALIDATED" | "SAMPLE · SYNTHETIC DATA" | null;
-                        scope: {
-                            repositories: {
-                                id: string;
-                                name: string;
-                            }[];
-                            excluded: {
-                                id: string;
-                                name: string;
-                                reason: string;
-                            }[];
-                        };
-                        windows: {
-                            pre: {
-                                start: string;
-                                end: string;
-                            } | null;
-                            post: {
-                                start: string;
-                                end: string;
-                            } | null;
-                            transitionDays: number;
-                        };
-                        sources: {
-                            provider: string;
-                            status: string;
-                            freshAt: string | null;
-                        }[];
-                        consent: {
-                            /** @enum {string} */
-                            aggregateUse: "opt_in" | "opt_out" | "unset";
-                            recordedAt: string | null;
-                        };
-                        sections: {
-                            id: string;
-                            /** @enum {string} */
-                            status: "ok" | "failed" | "omitted";
-                            reason?: string;
-                        }[];
-                    };
-                    workspaceId: string;
-                    expectedWorkspaceId: string;
-                    expectedRepositoryIds: string[];
-                    soldWindowComplete: boolean;
-                    premiumAiAssessable: boolean;
-                    namedPersonSectionIds: string[];
-                    tolerances: {
-                        id: string;
-                        /** @enum {string} */
-                        status: "unset" | "exceeded" | "within";
-                    }[];
-                };
+                "application/json": components["schemas"]["AssessmentManifestValidationBodyDto"];
             };
         };
         responses: {
@@ -13033,18 +13672,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        buyerDeliverable: boolean;
-                        /** @enum {string} */
-                        validation: "validated" | "not_validated";
-                        /** @enum {string|null} */
-                        watermark: "NOT VALIDATED" | null;
-                        reasons: {
-                            code: string;
-                            message: string;
-                        }[];
-                        contentHash: string;
-                    };
+                    "application/json": components["schemas"]["AssessmentManifestValidationResultDto"];
                 };
             };
             /** @description Body failed validation. */
@@ -13088,102 +13716,48 @@ export interface operations {
             };
         };
     };
-    adminListReadinessTokenUsage: {
+    validateWorkspaceAssessmentManifest: {
         parameters: {
-            query?: {
-                /** @description Filter by workspace UUID. */
-                workspaceId?: string;
-                /** @description Filter by repository slug (e.g. `owner/repo`). */
-                providerSlug?: string;
-                /** @description Filter by operation type. */
-                operation?: "readiness_analysis" | "readiness_fix";
-                /** @description Include only rows created at or after this ISO-8601 timestamp. */
-                from?: string;
-                /** @description Include only rows created at or before this ISO-8601 timestamp. */
-                to?: string;
-                /** @description Maximum number of rows to return (default 200, max 1000). */
-                limit?: number;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AssessmentManifestValidationBodyDto"];
+            };
+        };
         responses: {
-            /** @description Token usage rows, newest first. */
+            /** @description Validation result. Client validation and watermark inputs are ignored. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        rows: components["schemas"]["ReadinessTokenUsageRowDto"][];
-                    };
-                };
-            };
-            /** @description Missing or invalid JWT. */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorMessageDto"];
+                    "application/json": components["schemas"]["AssessmentManifestValidationResultDto"];
                 };
             };
-            /** @description Caller is not a platform admin. */
-            403: {
+            /** @description Body failed validation. */
+            400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     /**
                      * @example {
-                     *       "error": "Forbidden",
-                     *       "code": "forbidden"
+                     *       "error": "manifest.offerId is not a known assessment offer",
+                     *       "code": "invalid_body"
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-        };
-    };
-    adminListReadinessTokenUsageByDimension: {
-        parameters: {
-            query?: {
-                /** @description Filter by workspace UUID. */
-                workspaceId?: string;
-                /** @description Filter by repository slug (e.g. `owner/repo`). */
-                providerSlug?: string;
-                /** @description Filter by operation type. */
-                operation?: "readiness_analysis" | "readiness_fix";
-                /** @description Filter by a specific readiness dimension ID. */
-                dimensionId?: string;
-                /** @description Include only rows whose last activity is at or after this ISO-8601 timestamp. */
-                from?: string;
-                /** @description Include only rows whose first activity is at or before this ISO-8601 timestamp. */
-                to?: string;
-                /** @description Maximum number of rows to return (default 200, max 500). */
-                limit?: number;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Token usage grouped by operation and dimension. */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        rows: components["schemas"]["ReadinessTokenUsageByDimensionRowDto"][];
-                    };
-                };
-            };
-            /** @description Missing or invalid JWT. */
-            401: {
+            401: components["responses"]["Unauthorized"];
+            /** @description Caller cannot validate this workspace. */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -13191,16 +13765,15 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Caller is not a platform admin. */
-            403: {
+            /** @description Workspace does not exist. */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     /**
                      * @example {
-                     *       "error": "Forbidden",
-                     *       "code": "forbidden"
+                     *       "error": "Not found"
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorMessageDto"];
@@ -13208,29 +13781,31 @@ export interface operations {
             };
         };
     };
-    submitPublicPrivacyRequest: {
+    buildWorkspaceAssessmentManifest: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreatePrivacyRequestBodyDto"];
+                "application/json": components["schemas"]["BuildAssessmentManifestBodyDto"];
             };
         };
         responses: {
-            /** @description Request accepted and queued for privacy ops. */
-            201: {
+            /** @description Server-built manifest body and its validation result. */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["CreatePrivacyRequestResultDto"];
+                    "application/json": components["schemas"]["BuildAssessmentManifestResponseDto"];
                 };
             };
-            /** @description Missing or invalid email, unknown request type, or details too long. */
+            /** @description Body failed validation. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -13238,30 +13813,234 @@ export interface operations {
                 content: {
                     /**
                      * @example {
-                     *       "error": "A valid email is required",
-                     *       "code": "invalid_email"
+                     *       "error": "offerId is not a known assessment offer",
+                     *       "code": "invalid_body"
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description An open request for this email and type already exists. */
-            409: {
+            401: components["responses"]["Unauthorized"];
+            /** @description Caller cannot build this workspace's manifest. */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     /**
                      * @example {
-                     *       "error": "An open request for this email already exists",
-                     *       "code": "duplicate_open_request"
+                     *       "error": "Forbidden",
+                     *       "code": "workspace_admin_required"
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Too many submissions from this client; retry later. */
-            429: {
+            /** @description Workspace does not exist. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Not found"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Stored evidence could not be loaded (no database or a load failure). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Service unavailable",
+                     *       "code": "evidence_unavailable"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    adminListReadinessTokenUsage: {
+        parameters: {
+            query?: {
+                /** @description Filter by workspace UUID. */
+                workspaceId?: string;
+                /** @description Filter by repository slug (e.g. `owner/repo`). */
+                providerSlug?: string;
+                /** @description Filter by operation type. */
+                operation?: "readiness_analysis" | "readiness_fix";
+                /** @description Include only rows created at or after this ISO-8601 timestamp. */
+                from?: string;
+                /** @description Include only rows created at or before this ISO-8601 timestamp. */
+                to?: string;
+                /** @description Maximum number of rows to return (default 200, max 1000). */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Token usage rows, newest first. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        rows: components["schemas"]["ReadinessTokenUsageRowDto"][];
+                    };
+                };
+            };
+            /** @description Missing or invalid JWT. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Caller is not a platform admin. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Forbidden",
+                     *       "code": "forbidden"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    adminListReadinessTokenUsageByDimension: {
+        parameters: {
+            query?: {
+                /** @description Filter by workspace UUID. */
+                workspaceId?: string;
+                /** @description Filter by repository slug (e.g. `owner/repo`). */
+                providerSlug?: string;
+                /** @description Filter by operation type. */
+                operation?: "readiness_analysis" | "readiness_fix";
+                /** @description Filter by a specific readiness dimension ID. */
+                dimensionId?: string;
+                /** @description Include only rows whose last activity is at or after this ISO-8601 timestamp. */
+                from?: string;
+                /** @description Include only rows whose first activity is at or before this ISO-8601 timestamp. */
+                to?: string;
+                /** @description Maximum number of rows to return (default 200, max 500). */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Token usage grouped by operation and dimension. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        rows: components["schemas"]["ReadinessTokenUsageByDimensionRowDto"][];
+                    };
+                };
+            };
+            /** @description Missing or invalid JWT. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Caller is not a platform admin. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Forbidden",
+                     *       "code": "forbidden"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    submitPublicPrivacyRequest: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreatePrivacyRequestBodyDto"];
+            };
+        };
+        responses: {
+            /** @description Request accepted and queued for privacy ops. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CreatePrivacyRequestResultDto"];
+                };
+            };
+            /** @description Missing or invalid email, unknown request type, or details too long. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "A valid email is required",
+                     *       "code": "invalid_email"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description An open request for this email and type already exists. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "An open request for this email already exists",
+                     *       "code": "duplicate_open_request"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Too many submissions from this client; retry later. */
+            429: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19266,21 +20045,572 @@ export interface operations {
                 workspaceId: components["parameters"]["WorkspaceId"];
                 repoId: components["parameters"]["RepoId"];
             };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Markdown file of readiness issues */
-            200: {
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Markdown file of readiness issues */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/markdown": string;
+                };
+            };
+            /** @description Malformed `repoId` or invalid query parameters */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace or repository not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    listReadinessRepoRuns: {
+        parameters: {
+            query?: {
+                limit?: number;
+                order?: "asc" | "desc";
+                /** @description Opaque cursor from a prior response `nextCursor` field. */
+                cursor?: string;
+            };
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+                repoId: components["parameters"]["RepoId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Run history page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReadinessRepoRunListDto"];
+                };
+            };
+            /** @description Invalid pagination query */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace or repository not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    listReadinessAudit: {
+        parameters: {
+            query?: {
+                limit?: number;
+                offset?: number;
+                order?: "asc" | "desc";
+                /** @description Sort column for the activity feed. */
+                sort?: "occurredAt" | "actorName" | "repoName" | "eventType" | "dimensionId";
+                /** @description Case-insensitive match on actor name or email. */
+                search?: string;
+                eventType?: components["schemas"]["ReadinessAuditEventType"];
+                dimensionId?: components["schemas"]["ReadinessDimensionId"];
+                repoId?: string;
+                /** @description ISO-8601 lower bound on `occurredAt` (inclusive). */
+                since?: string;
+            };
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Paginated audit entries */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReadinessAuditListDto"];
+                };
+            };
+            /** @description Invalid query */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    getAssessmentDictionary: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current assessment dictionary */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentDictionaryDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    getWorkspaceAssessmentRollout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current rollout day */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentRolloutDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Rollout storage is not configured */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    putWorkspaceAssessmentRollout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AssessmentRolloutPutDto"];
+            };
+        };
+        responses: {
+            /** @description Saved rollout day */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentRolloutDto"];
+                };
+            };
+            /** @description Invalid body, impossible date, or future day (`code`: `invalid_input`) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Caller is not a workspace admin (`code`: `workspace_admin_required`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Rollout storage is not configured */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    getWorkspaceAssessmentRoi: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Matched-period ROI result */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentRoiDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Evidence storage is not configured or could not be read */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    getAggregateUseConsent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current permission and the sentence reports must print */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AggregateUseConsentDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    putAggregateUseConsent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AggregateUseConsentPutDto"];
+            };
+        };
+        responses: {
+            /** @description Saved permission */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AggregateUseConsentDto"];
+                };
+            };
+            /** @description Invalid body (`code`: `invalid_input`) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Caller is not a workspace admin (`code`: `workspace_admin_required`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Opt-in refused because no notice is approved (`aggregate_use_notice_unapproved`) or the submitted notice version is not current (`aggregate_use_notice_stale`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    recordReportCenterExport: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ReportCenterExportRecordBodyDto"];
+            };
+        };
+        responses: {
+            /** @description Export recorded */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ReportCenterExportRecordResponseDto"];
+                };
+            };
+            /** @description Invalid body */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Activity log is not supported by this backend build */
+            501: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    listAssessmentReports: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Stored reports, newest first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentReportListDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Stored reports are not supported by this backend build (no database) */
+            501: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    storeAssessmentReport: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["StoreAssessmentReportBodyDto"];
+            };
+        };
+        responses: {
+            /** @description Report stored */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentReportDto"];
+                };
+            };
+            /** @description Body is not valid, or the file is not a PDF or is too large */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description `not_buyer_deliverable` (the rebuilt manifest did not validate as an internal buyer file; includes `reasons`) or `manifest_changed` (stored evidence changed since the PDF was built, so `contentHash` differs; export again). */
+            422: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "text/markdown": string;
+                    "application/json": components["schemas"]["StoreAssessmentReportRejectedDto"];
                 };
             };
-            /** @description Malformed `repoId` or invalid query parameters */
-            400: {
+            /** @description Stored reports are not supported by this backend build (no database) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19288,10 +20618,8 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
-            /** @description Workspace or repository not found */
-            404: {
+            /** @description Stored evidence could not be loaded to rebuild the manifest. */
+            503: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19301,33 +20629,33 @@ export interface operations {
             };
         };
     };
-    listReadinessRepoRuns: {
+    createAssessmentReportLink: {
         parameters: {
-            query?: {
-                limit?: number;
-                order?: "asc" | "desc";
-                /** @description Opaque cursor from a prior response `nextCursor` field. */
-                cursor?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 workspaceId: components["parameters"]["WorkspaceId"];
-                repoId: components["parameters"]["RepoId"];
+                /** @description Stored assessment report id (`tai_workspace_assessment_reports.id`). */
+                reportId: components["parameters"]["AssessmentReportId"];
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateAssessmentReportLinkBodyDto"];
+            };
+        };
         responses: {
-            /** @description Run history page */
-            200: {
+            /** @description Link created */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ReadinessRepoRunListDto"];
+                    "application/json": components["schemas"]["CreateAssessmentReportLinkResponseDto"];
                 };
             };
-            /** @description Invalid pagination query */
+            /** @description Body is not valid */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -19338,7 +20666,7 @@ export interface operations {
             };
             401: components["responses"]["Unauthorized"];
             403: components["responses"]["Forbidden"];
-            /** @description Workspace or repository not found */
+            /** @description Workspace or report not found (`report_not_found`) */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19347,43 +20675,17 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-        };
-    };
-    listReadinessAudit: {
-        parameters: {
-            query?: {
-                limit?: number;
-                offset?: number;
-                order?: "asc" | "desc";
-                /** @description Sort column for the activity feed. */
-                sort?: "occurredAt" | "actorName" | "repoName" | "eventType" | "dimensionId";
-                /** @description Case-insensitive match on actor name or email. */
-                search?: string;
-                eventType?: components["schemas"]["ReadinessAuditEventType"];
-                dimensionId?: components["schemas"]["ReadinessDimensionId"];
-                repoId?: string;
-                /** @description ISO-8601 lower bound on `occurredAt` (inclusive). */
-                since?: string;
-            };
-            header?: never;
-            path: {
-                workspaceId: components["parameters"]["WorkspaceId"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Paginated audit entries */
-            200: {
+            /** @description The report is hidden (`report_hidden`) */
+            409: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ReadinessAuditListDto"];
+                    "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Invalid query */
-            400: {
+            /** @description The recipient is not a current workspace member (`recipient_not_member`) */
+            422: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19391,10 +20693,8 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
-            /** @description Workspace does not exist */
-            404: {
+            /** @description Stored reports or member listing are not supported by this backend build */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19404,29 +20704,32 @@ export interface operations {
             };
         };
     };
-    getAssessmentDictionary: {
+    revokeAssessmentReportLink: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspaceId: components["parameters"]["WorkspaceId"];
+                /** @description Stored assessment report id (`tai_workspace_assessment_reports.id`). */
+                reportId: components["parameters"]["AssessmentReportId"];
+                grantId: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Current assessment dictionary */
+            /** @description Revoked link */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AssessmentDictionaryDto"];
+                    "application/json": components["schemas"]["AssessmentReportLinkDto"];
                 };
             };
             401: components["responses"]["Unauthorized"];
             403: components["responses"]["Forbidden"];
-            /** @description Workspace does not exist */
+            /** @description Workspace, report, or link not found */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19435,31 +20738,42 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
+            /** @description Stored reports are not supported by this backend build (no database) */
+            501: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
         };
     };
-    getAggregateUseConsent: {
+    hideAssessmentReport: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspaceId: components["parameters"]["WorkspaceId"];
+                /** @description Stored assessment report id (`tai_workspace_assessment_reports.id`). */
+                reportId: components["parameters"]["AssessmentReportId"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Current permission and the sentence reports must print */
+            /** @description Hidden report (`links` is empty in this response; list again for links) */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AggregateUseConsentDto"];
+                    "application/json": components["schemas"]["AssessmentReportDto"];
                 };
             };
             401: components["responses"]["Unauthorized"];
             403: components["responses"]["Forbidden"];
-            /** @description Workspace does not exist */
+            /** @description Workspace or report not found */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -19468,44 +20782,43 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
+            /** @description Stored reports are not supported by this backend build (no database) */
+            501: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
         };
     };
-    putAggregateUseConsent: {
+    restoreAssessmentReport: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspaceId: components["parameters"]["WorkspaceId"];
+                /** @description Stored assessment report id (`tai_workspace_assessment_reports.id`). */
+                reportId: components["parameters"]["AssessmentReportId"];
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["AggregateUseConsentPutDto"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Saved permission */
+            /** @description Restored report (`links` is empty in this response; list again for links) */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AggregateUseConsentDto"];
-                };
-            };
-            /** @description Invalid body (`code`: `invalid_input`) */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorMessageDto"];
+                    "application/json": components["schemas"]["AssessmentReportDto"];
                 };
             };
             401: components["responses"]["Unauthorized"];
-            /** @description Caller is not a workspace admin (`code`: `workspace_admin_required`) */
-            403: {
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace or report not found */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19513,8 +20826,8 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Workspace does not exist */
-            404: {
+            /** @description `not_hidden` or `restore_window_ended` */
+            409: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19522,8 +20835,8 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Opt-in refused because no notice is approved (`aggregate_use_notice_unapproved`) or the submitted notice version is not current (`aggregate_use_notice_stale`). */
-            409: {
+            /** @description Stored reports are not supported by this backend build (no database) */
+            501: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19533,43 +20846,58 @@ export interface operations {
             };
         };
     };
-    recordReportCenterExport: {
+    downloadAssessmentReport: {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                workspaceId: components["parameters"]["WorkspaceId"];
+            query: {
+                /** @description Opaque link token from the email (`secureLinkQuery`). */
+                t: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ReportCenterExportRecordBodyDto"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Export recorded */
-            201: {
+            /** @description The decrypted PDF */
+            200: {
                 headers: {
+                    "Cache-Control"?: "no-store";
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ReportCenterExportRecordResponseDto"];
+                    "application/pdf": string;
                 };
             };
-            /** @description Invalid body */
-            400: {
+            401: components["responses"]["Unauthorized"];
+            /** @description `leaked_token`, `removed_member`, or `wrong_workspace` */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ErrorMessageDto"];
+                    "application/json": components["schemas"]["AssessmentReportAccessErrorDto"];
                 };
             };
-            401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
-            /** @description Workspace does not exist */
+            /** @description `invalid_grant` */
             404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentReportAccessErrorDto"];
+                };
+            };
+            /** @description `expired`, `revoked`, or `report_hidden` */
+            410: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AssessmentReportAccessErrorDto"];
+                };
+            };
+            /** @description The stored report could not be decrypted (`report_unreadable`) */
+            500: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -19577,7 +20905,7 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
-            /** @description Activity log is not supported by this backend build */
+            /** @description Stored reports are not supported by this backend build (no database) */
             501: {
                 headers: {
                     [name: string]: unknown;
@@ -21580,7 +22908,7 @@ export interface operations {
                     "application/json": components["schemas"]["CodeChatAttachmentMetaDto"];
                 };
             };
-            /** @description Validation failed (size, type, totals) */
+            /** @description Validation failed after decode (size, type, totals). Stable codes include `attachment_too_large`, `attachment_total_too_large`, `attachment_too_many`, `attachment_type_unsupported`, `attachment_pdf_too_long`, `attachment_failed`, `invalid_input`. */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -21608,6 +22936,21 @@ export interface operations {
                     "application/json": components["schemas"]["ErrorMessageDto"];
                 };
             };
+            /** @description Fastify rejected the JSON body before the handler (`request_body_too_large`). Typical when `contentBase64` exceeds the route bodyLimit (aligned with the 5 MB per-file cap after base64 expansion). Decoded-size overruns still return `400` `attachment_too_large`. */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Request body is too large.",
+                     *       "code": "request_body_too_large"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
             /** @description Could not process the file */
             422: {
                 headers: {
@@ -24940,6 +26283,83 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    postWorkspaceVcsRepoDiscovery: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["GitVcsSourceDto"];
+            };
+        };
+        responses: {
+            /** @description Repositories the source can read */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VcsRepoDiscoveryResponseDto"];
+                };
+            };
+            /** @description Invalid source (`error` is a code such as `base_url_required`, `base_url_invalid`, `base_url_not_https`, `base_url_has_credentials`, `base_url_has_path`, `base_url_host_blocked`, `env_ref_not_allowed`, `account_missing`, `token_missing`, `unsupported_type`). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description The provider rejected or failed the listing (`error` is `unauthorized`, `forbidden`, `not_found`, `rate_limited`, or `discovery_failed`). */
+            502: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
+    getWorkspaceVcsProviderCoverage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Server-computed provider coverage */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VcsProviderCoverageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Store does not support provider coverage */
+            501: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     retryWorkspaceProductivityRepo: {
         parameters: {
             query?: never;