@thinkai/tai-api-contract 2.194.0 → 2.196.0

package/dist/generated/openapi.d.ts

@@ -464,6 +464,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/jobs-session": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint HttpOnly cookie for /admin/jobs dashboard access
+         * @description Platform admins only. Copies the caller's Bearer JWT into an HttpOnly `tai_admin_jobs` cookie (`Path=/admin/`, `SameSite=Lax`, `Secure` when HTTPS/prod, `Max-Age` 1 hour) so browser navigations and admin-SPA iframes can authenticate to `/admin/jobs*` without an `Authorization` header on every request.
+         *     Requires a Bearer JWT from an email on `PLATFORM_ADMIN_EMAILS`. The cookie is only accepted as a Bearer substitute on `/admin/jobs*` paths by the API auth preHandler. The mounted `@pg-boss/dashboard` HTML surface is not part of this contract.
+         */
+        post: operations["adminCreateJobsSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/platform/banner": {
         parameters: {
             query?: never;
@@ -5154,7 +5175,7 @@ export interface paths {
         };
         /**
          * Ingest / backfill data coverage
-         * @description Read-only snapshot of historical ingest coverage for connected pipelines (productivity GitHub, AI usage/spend per provider, SDLC components, monitoring, HRIS). Aggregates existing watermarks and stored day/week evidence — does not trigger ingest or refresh. Productivity detail may include `selfHeal` (latest depth scan and week reconcile) read from stored activity rows; this GET does not run a scan. `selfHeal` is null when neither event exists. AI usage detail includes spend reconciliation (`spendReconciliationStatus`, `spendDataQuality`, provider and stored cent totals, `spendReconcileCheckedAt`) read from the refresh-status snapshot. This GET does not call Cursor or Claude. Productivity, HR, monitoring, and SDLC pipelines omit those fields. `nextScheduledAt` is the scheduled poll instant for `ai_usage`, `hris`, and `monitoring`. It is null for productivity and SDLC, when that sync worker is disabled, or when there has been no attempt. A past instant means the poll is overdue; it is not moved forward to now and is not an ETA. Monitoring `sync` copies stored `issueCount`, `deploymentCount`, and `eventCount` (null when unset). HRIS leaves those three null. Requires workspace membership. Disconnected sources are omitted.
+         * @description Read-only snapshot of historical ingest coverage for connected pipelines (productivity GitHub, AI usage/spend per provider, SDLC components, monitoring, HRIS). Aggregates existing watermarks and stored day/week evidence — does not trigger ingest or refresh. Every pipeline includes always-present `dataTrust` (`status` + `verificationMethod`) as a unified trust summary derived from existing coverage signals (stale, gaps, productivity `verificationStatus`, AI `spendReconciliationStatus`, pipeline `status`). It does not replace Source verified, Spend matched, or Backfill complete fields. Productivity detail may include `selfHeal` (latest depth scan and week reconcile) read from stored activity rows; this GET does not run a scan. `selfHeal` is null when neither event exists. AI usage detail includes spend reconciliation (`spendReconciliationStatus`, `spendDataQuality`, provider and stored cent totals, `spendReconcileCheckedAt`) read from the refresh-status snapshot. This GET does not call Cursor or Claude. Productivity, HR, monitoring, and SDLC pipelines omit those fields. `nextScheduledAt` is the scheduled poll instant for `ai_usage`, `hris`, and `monitoring`. It is null for productivity and SDLC, when that sync worker is disabled, or when there has been no attempt. A past instant means the poll is overdue; it is not moved forward to now and is not an ETA. Monitoring `sync` copies stored `issueCount`, `deploymentCount`, and `eventCount` (null when unset). HRIS leaves those three null. Requires workspace membership. Disconnected sources are omitted. Insights / Measure / Engineering Health response DTOs do not include `dataTrust`.
          */
         get: operations["getWorkspaceIngestCoverage"];
         put?: never;
@@ -10749,6 +10770,21 @@ export interface components {
             /** @description Monitoring meta event count. Null for HRIS and when the stored count is unset. */
             eventCount?: number | null;
         };
+        /**
+         * @description Unified data-trust summary for one ingest-coverage pipeline. Derived from existing coverage signals; does not rename Source verified, Spend matched, or Backfill complete.
+         * @enum {string}
+         */
+        DataTrustStatus: "verified" | "provisional" | "degraded" | "unknown";
+        /**
+         * @description Which check decided `dataTrust.status` (or `none` when no applicable check). When several checks tie, prefer checksum > source_count > calendar_gap > none.
+         * @enum {string}
+         */
+        DataTrustVerificationMethod: "calendar_gap" | "source_count" | "checksum" | "none";
+        /** @description Always-present Data trust summary on each ingest-coverage pipeline (`GET …/ingest-coverage` only). Additive to Source verified / Spend matched / Backfill complete lines. Derived from existing coverage signals only. Not added to Insights / Measure / Engineering Health response DTOs. */
+        DataTrustDto: {
+            status: components["schemas"]["DataTrustStatus"];
+            verificationMethod: components["schemas"]["DataTrustVerificationMethod"];
+        };
         IngestCoveragePipelineDto: {
             id: string;
             /** @enum {string} */
@@ -10785,6 +10821,7 @@ export interface components {
             ai?: components["schemas"]["IngestCoverageAiDetailDto"];
             sdlc?: components["schemas"]["IngestCoverageSdlcDetailDto"];
             sync?: components["schemas"]["IngestCoverageSyncDetailDto"];
+            dataTrust: components["schemas"]["DataTrustDto"];
         };
         IngestCoverageDto: {
             pipelines: components["schemas"]["IngestCoveragePipelineDto"][];
@@ -13511,6 +13548,9 @@ export type IngestCoverageAiDetailDto = components['schemas']['IngestCoverageAiD
 export type IngestCoverageSdlcComponentDto = components['schemas']['IngestCoverageSdlcComponentDto'];
 export type IngestCoverageSdlcDetailDto = components['schemas']['IngestCoverageSdlcDetailDto'];
 export type IngestCoverageSyncDetailDto = components['schemas']['IngestCoverageSyncDetailDto'];
+export type DataTrustStatus = components['schemas']['DataTrustStatus'];
+export type DataTrustVerificationMethod = components['schemas']['DataTrustVerificationMethod'];
+export type DataTrustDto = components['schemas']['DataTrustDto'];
 export type IngestCoveragePipelineDto = components['schemas']['IngestCoveragePipelineDto'];
 export type IngestCoverageDto = components['schemas']['IngestCoverageDto'];
 export type IngestRunDto = components['schemas']['IngestRunDto'];
@@ -15388,6 +15428,71 @@ export interface operations {
             };
         };
     };
+    adminCreateJobsSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Session cookie set (Set-Cookie with tai_admin_jobs). */
+            204: {
+                headers: {
+                    /** @description HttpOnly jobs session cookie with the caller's JWT value, Path=/admin/, SameSite=Lax, Max-Age=3600, Secure when applicable. */
+                    "Set-Cookie"?: string;
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing or non-Bearer Authorization (no JWT to put in the cookie). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Unauthorized",
+                     *       "code": "unauthorized"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Caller is not a platform admin. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Forbidden",
+                     *       "code": "forbidden"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Jobs dashboard unavailable (`JOBS_PG_BOSS_ENABLED=false` or readiness DB URL missing). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Jobs dashboard unavailable",
+                     *       "code": "jobs_dashboard_unavailable"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
     adminGetPlatformBanner: {
         parameters: {
             query?: never;