@thinkai/tai-api-contract 2.66.0 → 2.67.0

package/dist/generated/openapi.d.ts

@@ -4764,6 +4764,15 @@ export interface components {
              */
             error: "github_permissions_check_failed";
         };
+        /**
+         * @description Whether a GitHub Code security product is enabled and readable for sampled repos. `partial` means mixed enablement across the sample; `unknown` when not probed or grants missing.
+         * @enum {string}
+         */
+        GithubProductSettingStatus: "ok" | "not_enabled" | "partial" | "forbidden" | "unknown";
+        GithubProductSettingsDto: {
+            dependabotAlerts: components["schemas"]["GithubProductSettingStatus"];
+            secretScanning: components["schemas"]["GithubProductSettingStatus"];
+        };
         GithubInstallationSummaryDto: {
             installationId: string;
             account: components["schemas"]["GithubAccountDto"];
@@ -4777,6 +4786,20 @@ export interface components {
             permissionsUpgradeRequired: boolean;
             /** @description True when installation grants read permissions for repository analysis (contents, metadata, pull requests, and members for org installs). */
             corePermissionsOk: boolean;
+            /** @description True when installation grants Vulnerability alerts and Secret scanning alerts read for SDLC security metrics. */
+            securityPermissionsOk: boolean;
+            /** @description True when installation grants financial/operational SDLC metric permissions (Actions, Deployments, and org Administration / Copilot seat reads for organization installs). */
+            financialPermissionsOk: boolean;
+            /** @description Security alert permissions still needed for SDLC security metrics. */
+            missingSecurityPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Financial/operational permissions still needed for SDLC financial metrics. */
+            missingFinancialPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Human-readable summary when security App permissions are missing. */
+            securityUpgradeMessage?: string | null;
+            /** @description Human-readable summary when financial App permissions are missing. */
+            financialUpgradeMessage?: string | null;
+            /** @description Dependabot alerts and secret scanning enablement on sampled repos (throttled probe). Omitted when security App grants are missing or the probe has not run. */
+            githubProductSettings?: components["schemas"]["GithubProductSettingsDto"] | null;
             /** @description True when automated fixes are enabled and the linked Automations (write) installation grants write permissions required for fix PRs. */
             writePermissionsOk: boolean;
             /** @description Alias for `!writePermissionsOk`. */
@@ -4961,6 +4984,20 @@ export interface components {
             permissionsUpgradeRequired: boolean;
             /** @description True when every connected installation grants core read permissions. */
             corePermissionsOk: boolean;
+            /** @description True when every connected installation grants security alert read permissions. */
+            securityPermissionsOk: boolean;
+            /** @description True when every connected installation grants financial/operational read permissions. */
+            financialPermissionsOk: boolean;
+            /** @description Aggregated security permissions missing on installations with security gaps. */
+            missingSecurityPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Aggregated financial permissions missing on installations with financial gaps. */
+            missingFinancialPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Human-readable summary when security App permissions are missing. */
+            securityUpgradeMessage?: string | null;
+            /** @description Human-readable summary when financial App permissions are missing. */
+            financialUpgradeMessage?: string | null;
+            /** @description Workspace-wide Code security product status reduced from installations. */
+            githubProductSettings?: components["schemas"]["GithubProductSettingsDto"] | null;
             /** @description True when every connected installation grants write permissions for automated fixes. */
             writePermissionsOk: boolean;
             /** @description True when any connected installation lacks write permissions for automated fixes. */
@@ -6810,6 +6847,8 @@ export type RepoEligibilityLimitsDto = components['schemas']['RepoEligibilityLim
 export type GithubMissingPermissionDto = components['schemas']['GithubMissingPermissionDto'];
 export type GithubWritePermissionsRequiredErrorDto = components['schemas']['GithubWritePermissionsRequiredErrorDto'];
 export type GithubPermissionsCheckFailedErrorDto = components['schemas']['GithubPermissionsCheckFailedErrorDto'];
+export type GithubProductSettingStatus = components['schemas']['GithubProductSettingStatus'];
+export type GithubProductSettingsDto = components['schemas']['GithubProductSettingsDto'];
 export type GithubInstallationSummaryDto = components['schemas']['GithubInstallationSummaryDto'];
 export type GithubPendingApprovalDto = components['schemas']['GithubPendingApprovalDto'];
 export type GithubSetupInProgressDto = components['schemas']['GithubSetupInProgressDto'];
@@ -10430,8 +10469,10 @@ export interface operations {
             query?: {
                 /** @description When true, bypass `tai_workspace_vcs_repos_cache` and re-fetch from GitHub. When productivity backfill phase is `complete`, also triggers inline `on_demand` ingest for the current UTC week (gap-fill only when metrics are missing). Response includes `productivityRefreshInProgress` while the workspace advisory lock is held. */
                 refresh?: boolean;
-                /** @description When true, re-fetch GitHub App and installation permission metadata (used by the login permission gate after the user approves on GitHub). */
+                /** @description When true, re-fetch GitHub App and installation permission metadata (used by the login permission gate after the user approves on GitHub). Clears App-permission and product-settings caches so the next `productSettingsRefresh` re-probes. Does not itself call alert-list APIs; use `productSettingsRefresh` for that. */
                 permissionsRefresh?: boolean;
+                /** @description When true, probe Dependabot alerts and secret scanning enablement on a small sample of connected repositories (only when security App grants are present). Without this flag, status returns previously cached `githubProductSettings` only (no live probe). Results are cached server-side for several minutes. */
+                productSettingsRefresh?: boolean;
                 /** @description Page size for the nested installation repo list (default 25, max 100). */
                 repoLimit?: components["parameters"]["GithubRepoLimit"];
                 /** @description Zero-based offset into the merged installation repo list. */