@thinkai/tai-api-contract 2.68.0-pr.945.8ba31b6f → 2.69.0

package/openapi/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ThinkAI API
-  version: 2.68.0
+  version: 2.69.0
   description: >
     Contract surface for the AI Driven SDLC backend used by ThinkAI.
     Workspace-scoped routes use `/workspaces/{workspaceId}/...`.
@@ -1282,7 +1282,8 @@ paths:
         ignored at runtime; verification and future refresh use the fixed Cursor Admin API host.
         Other types pass through with only a
         non-empty `type` requirement so existing
-        jira / sonarqube / bitbucket callers are not regressed.
+        jira / bitbucket callers are not regressed. `sonarqube` entries get strict validation
+        (`baseUrl`, `token`, `projectKey` required; optional `branch`).
         **`type: github` is rejected** with HTTP 400 and `code: github_sources_deprecated`; use the
         GitHub App integration (`POST /workspaces/{workspaceId}/integrations/github/install-url` and callback) instead.
 
@@ -1325,6 +1326,7 @@ paths:
                       - $ref: "#/components/schemas/NewRelicSourceDto"
                       - $ref: "#/components/schemas/PrometheusSourceDto"
                       - $ref: "#/components/schemas/GrafanaSourceDto"
+                      - $ref: "#/components/schemas/SonarQubeSourceDto"
                       - $ref: "#/components/schemas/TenantSourceEntryDto"
             examples:
               cursorAndJira:
@@ -1416,9 +1418,10 @@ paths:
         for service accounts) and return `executionKeyValid` / `executionKeyError` without calling
         the Admin API on `token`. Malformed cursor entries return `400` with `code: invalid_source_entry`.
         `claude` (Anthropic Admin API at `https://api.anthropic.com`, `X-Api-Key` with an
-        organization Admin API key `sk-ant-admin...`). Other types report
-        `{ success: false, error: "unsupported_type" }`. Documented `error`
-        codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`.
+        organization Admin API key `sk-ant-admin...`). `sonarqube` (`baseUrl`, `token`, `projectKey`
+        required; optional `branch`) calls `GET {baseUrl}/api/measures/component` with a Bearer
+        token. Other types report `{ success: false, error: "unsupported_type" }`. Documented
+        `error` codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`.
 
         **Typical outcomes:** Malformed body, missing `type`, invalid `type`, or missing required fields for the
         declared type → `400` with `{ error: "..." }`. Well-formed body with bad credentials or unreachable
@@ -1439,6 +1442,7 @@ paths:
                 - $ref: "#/components/schemas/NewRelicSourceDto"
                 - $ref: "#/components/schemas/PrometheusSourceDto"
                 - $ref: "#/components/schemas/GrafanaSourceDto"
+                - $ref: "#/components/schemas/SonarQubeSourceDto"
                 - $ref: "#/components/schemas/TenantSourceEntryDto"
             examples:
               cursorValid:
@@ -1456,6 +1460,13 @@ paths:
                 value:
                   type: claude
                   token: sk-ant-admin-example-key
+              sonarqubeValid:
+                summary: SonarQube source for connection test
+                value:
+                  type: sonarqube
+                  baseUrl: https://sonarqube.example.com
+                  token: sonarqube_api_token_example
+                  projectKey: my-project
               githubShape:
                 summary: GitHub-shaped body (non-AI-tool types return unsupported_type unless extended)
                 value:
@@ -8683,6 +8694,59 @@ components:
         orgName:
           type: string
 
+    SonarQubeSourceDto:
+      type: object
+      description: >
+        SonarQube source for workspace sources PUT and connection test. Every field is
+        re-submitted on each save; `token` is never round-tripped from `GET` workspace config.
+      required: [type, baseUrl, token, projectKey]
+      additionalProperties: false
+      properties:
+        type:
+          type: string
+          enum: [sonarqube]
+        baseUrl:
+          type: string
+          minLength: 1
+          maxLength: 2048
+          description: SonarQube server URL, e.g. https://sonarqube.example.com.
+        token:
+          type: string
+          minLength: 1
+          maxLength: 512
+          description: >
+            User or project analysis token (write-only on PUT). Literal tokens are
+            encrypted at rest. Operator-managed secrets may use an `env:VAR` reference
+            (resolved at runtime / batch poll), matching other non-AI-tool sources.
+        projectKey:
+          type: string
+          minLength: 1
+          maxLength: 400
+          description: SonarQube project key (component key).
+        branch:
+          type: string
+          minLength: 1
+          maxLength: 255
+          description: Optional branch name for branch-scoped measures.
+
+    SonarQubeSourceConfigDto:
+      type: object
+      description: Redacted SonarQube source returned by GET workspace config.
+      required: [type, hasToken, baseUrl, projectKey]
+      additionalProperties: false
+      properties:
+        type:
+          type: string
+          enum: [sonarqube]
+        hasToken:
+          type: boolean
+        baseUrl:
+          type: string
+        projectKey:
+          type: string
+        branch:
+          type: string
+
     AgentExecutionProviderDto:
       type: string
       description: >
@@ -8709,6 +8773,7 @@ components:
               - $ref: "#/components/schemas/NewRelicSourceConfigDto"
               - $ref: "#/components/schemas/PrometheusSourceConfigDto"
               - $ref: "#/components/schemas/GrafanaSourceConfigDto"
+              - $ref: "#/components/schemas/SonarQubeSourceConfigDto"
               - $ref: "#/components/schemas/TenantSourceEntryDto"
         orgChart:
           nullable: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkai/tai-api-contract",
-  "version": "2.68.0-pr.945.8ba31b6f",
+  "version": "2.69.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/generated/openapi.ts

@@ -491,7 +491,7 @@ export interface paths {
         get?: never;
         /**
          * Replace workspace data sources
-         * @description Replace the workspace's `sources` array. Cursor entries are validated strictly (`token` 1-256 chars, no whitespace, no `env:` prefix; optional deprecated `baseUrl` is accepted for backwards compatibility and ignored at runtime; verification and future refresh use the fixed Cursor Admin API host. Other types pass through with only a non-empty `type` requirement so existing jira / sonarqube / bitbucket callers are not regressed. **`type: github` is rejected** with HTTP 400 and `code: github_sources_deprecated`; use the GitHub App integration (`POST /workspaces/{workspaceId}/integrations/github/install-url` and callback) instead.
+         * @description Replace the workspace's `sources` array. Cursor entries are validated strictly (`token` 1-256 chars, no whitespace, no `env:` prefix; optional deprecated `baseUrl` is accepted for backwards compatibility and ignored at runtime; verification and future refresh use the fixed Cursor Admin API host. Other types pass through with only a non-empty `type` requirement so existing jira / bitbucket callers are not regressed. `sonarqube` entries get strict validation (`baseUrl`, `token`, `projectKey` required; optional `branch`). **`type: github` is rejected** with HTTP 400 and `code: github_sources_deprecated`; use the GitHub App integration (`POST /workspaces/{workspaceId}/integrations/github/install-url` and callback) instead.
          *     Every secret-keyed top-level string field (`token`, `password`, `api_key`, `secret`, `private_key`, `client_secret`) is encrypted at rest with AES-256-GCM under `SOURCES_TOKEN_ENC_KEY` before persistence; `env:`-prefixed values pass through unchanged. `GET /workspaces/{workspaceId}/config` continues to redact every secret-keyed field to `***` regardless of whether the stored value is encrypted, plaintext, or `env:` ref.
          *     Requires editor or admin workspace role.
          *     **Typical outcomes:** Valid typed sources → `200` with `{ ok: true, workspaceId }`. Missing required fields for a given `type` → `400` with `error` text. Unknown `type` strings (non-AI-tool, non-github) currently pass through to storage (lenient compatibility). Registered AI tools (`cursor`, `claude`) get strict field validation (no whitespace, no `env:` prefix on tokens). For `cursor`, each PUT entry may include `token` (admin key), `executionToken` (execution key), or both; at least one key field is required per entry. Cursor-specific `400` codes: `cursor_execution_token_is_admin_key` (admin key in `executionToken`), `invalid_cursor_execution_token` (execution key failed Cloud Agents verification).
@@ -516,7 +516,7 @@ export interface paths {
         /**
          * Test one source connection (does not persist)
          * @description Verify a source's credentials without persisting them. Always returns 200 — upstream auth, rate-limit, and network failures surface as `{ success: false, error }` so the SPA can render an inline error.
-         *     Registered AI tools are verified end-to-end: `cursor` (Admin API key in `token` and/or execution key in `executionToken`; at least one must be present). Execution-only tests validate the key against the Cloud Agents API (`GET /v1/me`, with `GET /v1/models` fallback for service accounts) and return `executionKeyValid` / `executionKeyError` without calling the Admin API on `token`. Malformed cursor entries return `400` with `code: invalid_source_entry`. `claude` (Anthropic Admin API at `https://api.anthropic.com`, `X-Api-Key` with an organization Admin API key `sk-ant-admin...`). Other types report `{ success: false, error: "unsupported_type" }`. Documented `error` codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`.
+         *     Registered AI tools are verified end-to-end: `cursor` (Admin API key in `token` and/or execution key in `executionToken`; at least one must be present). Execution-only tests validate the key against the Cloud Agents API (`GET /v1/me`, with `GET /v1/models` fallback for service accounts) and return `executionKeyValid` / `executionKeyError` without calling the Admin API on `token`. Malformed cursor entries return `400` with `code: invalid_source_entry`. `claude` (Anthropic Admin API at `https://api.anthropic.com`, `X-Api-Key` with an organization Admin API key `sk-ant-admin...`). `sonarqube` (`baseUrl`, `token`, `projectKey` required; optional `branch`) calls `GET {baseUrl}/api/measures/component` with a Bearer token. Other types report `{ success: false, error: "unsupported_type" }`. Documented `error` codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`.
          *     **Typical outcomes:** Malformed body, missing `type`, invalid `type`, or missing required fields for the declared type → `400` with `{ error: "..." }`. Well-formed body with bad credentials or unreachable service → `200` with `{ success: false, error: "..." }`.
          */
         post: operations["postTenantSourceTest"];
@@ -3415,6 +3415,28 @@ export interface components {
             orgId?: string;
             orgName?: string;
         };
+        /** @description SonarQube source for workspace sources PUT and connection test. Every field is re-submitted on each save; `token` is never round-tripped from `GET` workspace config. */
+        SonarQubeSourceDto: {
+            /** @enum {string} */
+            type: "sonarqube";
+            /** @description SonarQube server URL, e.g. https://sonarqube.example.com. */
+            baseUrl: string;
+            /** @description User or project analysis token (write-only on PUT). Literal tokens are encrypted at rest. Operator-managed secrets may use an `env:VAR` reference (resolved at runtime / batch poll), matching other non-AI-tool sources. */
+            token: string;
+            /** @description SonarQube project key (component key). */
+            projectKey: string;
+            /** @description Optional branch name for branch-scoped measures. */
+            branch?: string;
+        };
+        /** @description Redacted SonarQube source returned by GET workspace config. */
+        SonarQubeSourceConfigDto: {
+            /** @enum {string} */
+            type: "sonarqube";
+            hasToken: boolean;
+            baseUrl: string;
+            projectKey: string;
+            branch?: string;
+        };
         /**
          * @description The agent execution account used for Agentic Foundation runs (readiness scanner + fix queue). Exactly one is active per workspace.
          *       - `thinkai_platform_cursor`: ThinkAI platform Cursor key (Cursor Agent CLI) — opt-in, never default.
@@ -3424,7 +3446,7 @@ export interface components {
          */
         AgentExecutionProviderDto: "thinkai_platform_cursor" | "cursor_user_api_key" | "claude_api_key";
         WorkspaceConfigDto: {
-            sources: (components["schemas"]["CursorSourceConfigDto"] | components["schemas"]["ClaudeSourceConfigDto"] | components["schemas"]["NewRelicSourceConfigDto"] | components["schemas"]["PrometheusSourceConfigDto"] | components["schemas"]["GrafanaSourceConfigDto"] | components["schemas"]["TenantSourceEntryDto"])[];
+            sources: (components["schemas"]["CursorSourceConfigDto"] | components["schemas"]["ClaudeSourceConfigDto"] | components["schemas"]["NewRelicSourceConfigDto"] | components["schemas"]["PrometheusSourceConfigDto"] | components["schemas"]["GrafanaSourceConfigDto"] | components["schemas"]["SonarQubeSourceConfigDto"] | components["schemas"]["TenantSourceEntryDto"])[];
             orgChart?: components["schemas"]["ScoringOrgChartDto"] | null;
             /** @enum {string|null} */
             region?: "us" | "eu" | "me" | null;
@@ -6839,6 +6861,8 @@ export type PrometheusSourceDto = components['schemas']['PrometheusSourceDto'];
 export type PrometheusSourceConfigDto = components['schemas']['PrometheusSourceConfigDto'];
 export type GrafanaSourceDto = components['schemas']['GrafanaSourceDto'];
 export type GrafanaSourceConfigDto = components['schemas']['GrafanaSourceConfigDto'];
+export type SonarQubeSourceDto = components['schemas']['SonarQubeSourceDto'];
+export type SonarQubeSourceConfigDto = components['schemas']['SonarQubeSourceConfigDto'];
 export type AgentExecutionProviderDto = components['schemas']['AgentExecutionProviderDto'];
 export type WorkspaceConfigDto = components['schemas']['WorkspaceConfigDto'];
 export type TestConnectionResponseDto = components['schemas']['TestConnectionResponseDto'];
@@ -8554,7 +8578,7 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    sources: (components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["TenantSourceEntryDto"])[];
+                    sources: (components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["SonarQubeSourceDto"] | components["schemas"]["TenantSourceEntryDto"])[];
                 };
             };
         };
@@ -8608,7 +8632,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["TenantSourceEntryDto"];
+                "application/json": components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["SonarQubeSourceDto"] | components["schemas"]["TenantSourceEntryDto"];
             };
         };
         responses: {