@thinkai/tai-api-contract 2.95.0 → 2.97.0

package/openapi/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ThinkAI API
-  version: 2.95.0
+  version: 2.97.0
   description: >
     Contract surface for the AI Driven SDLC backend used by ThinkAI.
     Workspace-scoped routes use `/workspaces/{workspaceId}/...`.
@@ -1492,6 +1492,51 @@ paths:
               schema:
                 $ref: "#/components/schemas/ErrorMessageDto"
 
+  /workspaces/{workspaceId}/delivery-topology:
+    put:
+      tags: [Workspace]
+      summary: Set workspace delivery topology
+      description: >
+        Persist the workspace delivery topology used by federated readiness assessment:
+        which connected repos hold terraform / gitops / ci_templates / api_contracts
+        artifacts, plus optional per-service overrides. Role and override `providerSlug`
+        values must reference repos connected to this workspace, otherwise the request is
+        rejected with `400 invalid_delivery_topology`. Send `null` (or
+        `{ "deliveryTopology": null }`) to clear the topology.
+
+        Requires editor or admin workspace role.
+      operationId: putWorkspaceDeliveryTopology
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              nullable: true
+              allOf:
+                - $ref: "#/components/schemas/DeliveryTopologyDto"
+      responses:
+        "204":
+          description: Topology persisted (or cleared).
+        "400":
+          description: Invalid topology payload or unconnected repo referenced.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          description: Workspace does not exist or malformed workspaceId
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+
   /workspaces/{workspaceId}/sources:
     put:
       tags: [Workspace]
@@ -1550,6 +1595,7 @@ paths:
                       - $ref: "#/components/schemas/GrafanaSourceDto"
                       - $ref: "#/components/schemas/SonarQubeSourceDto"
                       - $ref: "#/components/schemas/PagerDutySourceDto"
+                      - $ref: "#/components/schemas/JiraSourceDto"
                       - $ref: "#/components/schemas/TenantSourceEntryDto"
             examples:
               cursorAndJira:
@@ -1645,6 +1691,8 @@ paths:
         required; optional `branch`) calls `GET {baseUrl}/api/measures/component` with a Bearer
         token. Other types report `{ success: false, error: "unsupported_type" }`. Documented
         `error` codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`.
+        `jira` (`baseUrl`, `email`, `apiToken` or legacy `api_key`) calls
+        `GET {baseUrl}/rest/api/3/myself` with Basic auth.
 
         **Typical outcomes:** Malformed body, missing `type`, invalid `type`, or missing required fields for the
         declared type → `400` with `{ error: "..." }`. Well-formed body with bad credentials or unreachable
@@ -1668,6 +1716,7 @@ paths:
                 - $ref: "#/components/schemas/GrafanaSourceDto"
                 - $ref: "#/components/schemas/SonarQubeSourceDto"
                 - $ref: "#/components/schemas/PagerDutySourceDto"
+                - $ref: "#/components/schemas/JiraSourceDto"
                 - $ref: "#/components/schemas/TenantSourceEntryDto"
             examples:
               cursorValid:
@@ -10201,6 +10250,73 @@ components:
           type: string
           description: PagerDuty user email when known from the last successful verify.
 
+    JiraSourceDto:
+      type: object
+      description: >
+        Jira Cloud source for `PUT /workspaces/{workspaceId}/sources` and
+        `POST /workspaces/{workspaceId}/sources/test`. Uses Atlassian Cloud email + API token
+        (Basic auth). Provide `apiToken` (preferred) or legacy write-only `api_key`; the server
+        normalizes `api_key` to `apiToken` on write.
+      required: [type, baseUrl, email]
+      additionalProperties: false
+      properties:
+        type:
+          type: string
+          enum: [jira]
+        baseUrl:
+          type: string
+          minLength: 1
+          description: Jira Cloud site URL (e.g. `https://your-domain.atlassian.net`).
+        email:
+          type: string
+          minLength: 1
+          description: Atlassian account email used with the API token.
+        apiToken:
+          type: string
+          minLength: 1
+          maxLength: 512
+          description: Atlassian API token (write-only on PUT; preferred).
+        api_key:
+          type: string
+          minLength: 1
+          maxLength: 512
+          description: >
+            Deprecated write-only alias for `apiToken`. Accepted for backward compatibility;
+            normalized to `apiToken` and never returned on GET `/config`.
+        userName:
+          type: string
+          description: Optional display name from a successful connection test (echo-after-test).
+        accountId:
+          type: string
+          description: Optional Atlassian account id from a successful connection test.
+
+    JiraSourceConfigDto:
+      type: object
+      description: >
+        Redacted Jira source returned by `GET /workspaces/{workspaceId}/config`.
+        Raw API token is never returned.
+      required: [type, hasToken, baseUrl, email]
+      additionalProperties: false
+      properties:
+        type:
+          type: string
+          enum: [jira]
+        hasToken:
+          type: boolean
+          description: Whether an API token is stored for this workspace.
+        baseUrl:
+          type: string
+          description: Configured Jira Cloud site URL.
+        email:
+          type: string
+          description: Atlassian account email associated with the stored token.
+        userName:
+          type: string
+          description: Display name when known from the last successful verify.
+        accountId:
+          type: string
+          description: Atlassian account id when known from the last successful verify.
+
     AgentExecutionProviderDto:
       type: string
       description: >
@@ -10252,6 +10368,7 @@ components:
               - $ref: "#/components/schemas/GrafanaSourceConfigDto"
               - $ref: "#/components/schemas/SonarQubeSourceConfigDto"
               - $ref: "#/components/schemas/PagerDutySourceConfigDto"
+              - $ref: "#/components/schemas/JiraSourceConfigDto"
               - $ref: "#/components/schemas/TenantSourceEntryDto"
         orgChart:
           nullable: true
@@ -10303,6 +10420,79 @@ components:
         hasCodeIntelligenceExecutionToken:
           type: boolean
           description: True when a dedicated `code_intelligence` source has a stored executionToken.
+        deliveryTopology:
+          type: object
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/DeliveryTopologyDto"
+          description: >
+            Federated-readiness delivery topology: which connected repos hold terraform /
+            gitops / ci_templates / api_contracts truth for this workspace. Null when not
+            configured. Change via `PUT /workspaces/{workspaceId}/delivery-topology`.
+
+    DeliveryRoleConfigDto:
+      type: object
+      required: [providerSlug]
+      properties:
+        providerSlug:
+          type: string
+          description: Connected workspace repo (`owner/repo`) that holds this role's artifacts.
+        engine:
+          type: string
+          enum: [terraform, pulumi, cdk]
+          description: IaC engine hint (terraform role only).
+        type:
+          type: string
+          enum: [reusable_workflows]
+          description: CI templates flavor (ci_templates role only).
+        custom:
+          type: boolean
+          description: Set true for extension roles outside the known role keys.
+    RepoDeliveryOverrideDto:
+      type: object
+      properties:
+        deliveryModel:
+          type: string
+          enum: [auto, k8s_microservices, mobile_store, web_hosting, data_pipelines, monorepo, library, hybrid]
+        roles:
+          type: object
+          additionalProperties:
+            type: string
+          description: Per-service role → providerSlug overrides (merged over workspace roles).
+        targetPathHint:
+          type: string
+          description: Path prefix inside platform repos where this service's artifacts live.
+    DeliveryTopologyDto:
+      type: object
+      required: [deliveryModel, ciProvider, splitInfra, roles, repoOverrides]
+      properties:
+        deliveryModel:
+          type: string
+          enum: [auto, k8s_microservices, mobile_store, web_hosting, data_pipelines, monorepo, library, hybrid]
+        ciProvider:
+          type: string
+          enum: [github_actions, jenkins, gitlab, bitbucket, hybrid, external_documented]
+        splitInfra:
+          type: boolean
+          description: True when infra/delivery artifacts live outside service repos.
+        roles:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/DeliveryRoleConfigDto"
+          description: >
+            Role → platform repo mapping. Known keys: terraform, gitops, ci_templates,
+            jenkins_shared, mobile_release, hosting, data_platform, api_contracts, sonar_config.
+        servicePathConvention:
+          type: string
+          nullable: true
+          description: >
+            Optional path template inside platform repos, e.g. `services/{repo_name}/`
+            (`{repo_name}` and `{provider_slug}` placeholders supported).
+        repoOverrides:
+          type: object
+          additionalProperties:
+            $ref: "#/components/schemas/RepoDeliveryOverrideDto"
+          description: Per-service-repo overrides keyed by provider slug.
 
     TestConnectionResponseDto:
       type: object
@@ -10329,13 +10519,13 @@ components:
           description: Error detail when `executionKeyValid` is false.
         userName:
           type: string
-          description: Present for New Relic or Grafana verify success — authenticated user name.
+          description: Present for New Relic, Grafana, PagerDuty, or Jira verify success — authenticated user name.
         accountName:
           type: string
           description: Present for New Relic verify success — resolved account display name.
         accountId:
           type: string
-          description: Present for New Relic verify success — resolved account ID.
+          description: Present for New Relic or Jira verify success — resolved account ID.
         orgName:
           type: string
           description: Present for Grafana verify success — resolved organization name.
@@ -14829,6 +15019,58 @@ components:
             per-repo "size / limit". When the size exceeds the limit the latest scan is recorded as
             `partial_failed` with `lastRunErrorCode = exceeded_repo_size_limit` and the repo is marked
             `ineligible`. Null until a scan has populated it.
+        platformArchetype:
+          type: string
+          nullable: true
+          enum: [terraform_platform, gitops_platform, ci_templates, api_contracts_platform]
+          description: >
+            Federated readiness: set when the repo was classified as a platform repository and
+            scored with the reduced platform rubric profile. Null for service repos. The UI shows
+            a "Platform repository" badge instead of comparing its score against service repos.
+        linkedRoleAssessment:
+          type: object
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/LinkedRoleAssessmentDto"
+          description: >
+            Federated readiness completeness for service repos: which linked platform roles
+            (terraform/gitops/ci_templates/api_contracts, from the workspace delivery topology)
+            are still missing scan evidence. Absent/null when no topology is configured or every
+            declared role has fresh metadata (`complete: true`).
+
+    LinkedRolePendingDto:
+      type: object
+      required: [role, providerSlug, reason]
+      properties:
+        role:
+          type: string
+          description: Topology role key, e.g. terraform | gitops | ci_templates | api_contracts.
+        providerSlug:
+          type: string
+          description: Platform repo (`owner/repo`) that must be scanned to satisfy this role.
+        reason:
+          type: string
+          enum: [no_scan, no_metadata_emitted, stale]
+          description: >
+            `no_scan` — the platform repo has no successful readiness run yet;
+            `no_metadata_emitted` — it was scanned but emitted no linkage for this service
+            (wrong archetype or scan predates federated readiness); `stale` — metadata is older
+            than the hard TTL (30 days) and must be refreshed by re-scanning the platform repo.
+        lastRunAt:
+          type: string
+          format: date-time
+          nullable: true
+          description: Latest succeeded scan of the platform repo, when one exists.
+    LinkedRoleAssessmentDto:
+      type: object
+      required: [complete, pending]
+      properties:
+        complete:
+          type: boolean
+        pending:
+          type: array
+          items:
+            $ref: "#/components/schemas/LinkedRolePendingDto"
 
     RepoReadinessScoreDetailDto:
       type: object
@@ -14948,6 +15190,17 @@ components:
           nullable: true
           minimum: 0
           description: GitHub-reported repository size in KB, refreshed on each scan. See RepoReadinessScoreDto.sizeKb.
+        platformArchetype:
+          type: string
+          nullable: true
+          enum: [terraform_platform, gitops_platform, ci_templates, api_contracts_platform]
+          description: See RepoReadinessScoreDto.platformArchetype.
+        linkedRoleAssessment:
+          type: object
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/LinkedRoleAssessmentDto"
+          description: See RepoReadinessScoreDto.linkedRoleAssessment.
 
     AgenticFoundationDashboardSummaryDto:
       type: object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkai/tai-api-contract",
-  "version": "2.95.0",
+  "version": "2.97.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/generated/openapi.ts

@@ -561,6 +561,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/{workspaceId}/delivery-topology": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set workspace delivery topology
+         * @description Persist the workspace delivery topology used by federated readiness assessment: which connected repos hold terraform / gitops / ci_templates / api_contracts artifacts, plus optional per-service overrides. Role and override `providerSlug` values must reference repos connected to this workspace, otherwise the request is rejected with `400 invalid_delivery_topology`. Send `null` (or `{ "deliveryTopology": null }`) to clear the topology.
+         *     Requires editor or admin workspace role.
+         */
+        put: operations["putWorkspaceDeliveryTopology"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/{workspaceId}/sources": {
         parameters: {
             query?: never;
@@ -596,7 +617,7 @@ export interface paths {
         /**
          * Test one source connection (does not persist)
          * @description Verify a source's credentials without persisting them. Always returns 200 — upstream auth, rate-limit, and network failures surface as `{ success: false, error }` so the SPA can render an inline error.
-         *     Registered AI tools are verified end-to-end: `cursor` (Admin API key in `token` and/or execution key in `executionToken`; at least one must be present). Execution-only tests validate the key against the Cloud Agents API (`GET /v1/me`, with `GET /v1/models` fallback for service accounts) and return `executionKeyValid` / `executionKeyError` without calling the Admin API on `token`. Malformed cursor entries return `400` with `code: invalid_source_entry`. `claude` (Anthropic Admin API at `https://api.anthropic.com`, `X-Api-Key` with an organization Admin API key `sk-ant-admin...`). `sonarqube` (`baseUrl`, `token`, `projectKey` required; optional `branch`) calls `GET {baseUrl}/api/measures/component` with a Bearer token. Other types report `{ success: false, error: "unsupported_type" }`. Documented `error` codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`.
+         *     Registered AI tools are verified end-to-end: `cursor` (Admin API key in `token` and/or execution key in `executionToken`; at least one must be present). Execution-only tests validate the key against the Cloud Agents API (`GET /v1/me`, with `GET /v1/models` fallback for service accounts) and return `executionKeyValid` / `executionKeyError` without calling the Admin API on `token`. Malformed cursor entries return `400` with `code: invalid_source_entry`. `claude` (Anthropic Admin API at `https://api.anthropic.com`, `X-Api-Key` with an organization Admin API key `sk-ant-admin...`). `sonarqube` (`baseUrl`, `token`, `projectKey` required; optional `branch`) calls `GET {baseUrl}/api/measures/component` with a Bearer token. Other types report `{ success: false, error: "unsupported_type" }`. Documented `error` codes for AI tool verifiers: `invalid_token`, `rate_limited`, `network_error`. `jira` (`baseUrl`, `email`, `apiToken` or legacy `api_key`) calls `GET {baseUrl}/rest/api/3/myself` with Basic auth.
          *     **Typical outcomes:** Malformed body, missing `type`, invalid `type`, or missing required fields for the declared type → `400` with `{ error: "..." }`. Well-formed body with bad credentials or unreachable service → `200` with `{ success: false, error: "..." }`.
          */
         post: operations["postTenantSourceTest"];
@@ -4106,6 +4127,38 @@ export interface components {
             /** @description PagerDuty user email when known from the last successful verify. */
             userEmail?: string;
         };
+        /** @description Jira Cloud source for `PUT /workspaces/{workspaceId}/sources` and `POST /workspaces/{workspaceId}/sources/test`. Uses Atlassian Cloud email + API token (Basic auth). Provide `apiToken` (preferred) or legacy write-only `api_key`; the server normalizes `api_key` to `apiToken` on write. */
+        JiraSourceDto: {
+            /** @enum {string} */
+            type: "jira";
+            /** @description Jira Cloud site URL (e.g. `https://your-domain.atlassian.net`). */
+            baseUrl: string;
+            /** @description Atlassian account email used with the API token. */
+            email: string;
+            /** @description Atlassian API token (write-only on PUT; preferred). */
+            apiToken?: string;
+            /** @description Deprecated write-only alias for `apiToken`. Accepted for backward compatibility; normalized to `apiToken` and never returned on GET `/config`. */
+            api_key?: string;
+            /** @description Optional display name from a successful connection test (echo-after-test). */
+            userName?: string;
+            /** @description Optional Atlassian account id from a successful connection test. */
+            accountId?: string;
+        };
+        /** @description Redacted Jira source returned by `GET /workspaces/{workspaceId}/config`. Raw API token is never returned. */
+        JiraSourceConfigDto: {
+            /** @enum {string} */
+            type: "jira";
+            /** @description Whether an API token is stored for this workspace. */
+            hasToken: boolean;
+            /** @description Configured Jira Cloud site URL. */
+            baseUrl: string;
+            /** @description Atlassian account email associated with the stored token. */
+            email: string;
+            /** @description Display name when known from the last successful verify. */
+            userName?: string;
+            /** @description Atlassian account id when known from the last successful verify. */
+            accountId?: string;
+        };
         /**
          * @description The agent execution account used for Agentic Foundation runs (readiness scanner + fix queue). Exactly one is active per workspace.
          *       - `thinkai_platform_cursor`: ThinkAI platform Cursor key (Cursor Agent CLI) — opt-in, never default.
@@ -4124,7 +4177,7 @@ export interface components {
             claudeModel?: string | null;
         };
         WorkspaceConfigDto: {
-            sources: (components["schemas"]["CursorSourceConfigDto"] | components["schemas"]["ClaudeSourceConfigDto"] | components["schemas"]["CodeIntelligenceSourceConfigDto"] | components["schemas"]["NewRelicSourceConfigDto"] | components["schemas"]["PrometheusSourceConfigDto"] | components["schemas"]["GrafanaSourceConfigDto"] | components["schemas"]["SonarQubeSourceConfigDto"] | components["schemas"]["PagerDutySourceConfigDto"] | components["schemas"]["TenantSourceEntryDto"])[];
+            sources: (components["schemas"]["CursorSourceConfigDto"] | components["schemas"]["ClaudeSourceConfigDto"] | components["schemas"]["CodeIntelligenceSourceConfigDto"] | components["schemas"]["NewRelicSourceConfigDto"] | components["schemas"]["PrometheusSourceConfigDto"] | components["schemas"]["GrafanaSourceConfigDto"] | components["schemas"]["SonarQubeSourceConfigDto"] | components["schemas"]["PagerDutySourceConfigDto"] | components["schemas"]["JiraSourceConfigDto"] | components["schemas"]["TenantSourceEntryDto"])[];
             orgChart?: components["schemas"]["ScoringOrgChartDto"] | null;
             /** @enum {string|null} */
             region?: "us" | "eu" | "me" | null;
@@ -4150,6 +4203,52 @@ export interface components {
             codeIntelligenceClaudeModel?: string | null;
             /** @description True when a dedicated `code_intelligence` source has a stored executionToken. */
             hasCodeIntelligenceExecutionToken?: boolean;
+            /** @description Federated-readiness delivery topology: which connected repos hold terraform / gitops / ci_templates / api_contracts truth for this workspace. Null when not configured. Change via `PUT /workspaces/{workspaceId}/delivery-topology`. */
+            deliveryTopology?: components["schemas"]["DeliveryTopologyDto"] | null;
+        };
+        DeliveryRoleConfigDto: {
+            /** @description Connected workspace repo (`owner/repo`) that holds this role's artifacts. */
+            providerSlug: string;
+            /**
+             * @description IaC engine hint (terraform role only).
+             * @enum {string}
+             */
+            engine?: "terraform" | "pulumi" | "cdk";
+            /**
+             * @description CI templates flavor (ci_templates role only).
+             * @enum {string}
+             */
+            type?: "reusable_workflows";
+            /** @description Set true for extension roles outside the known role keys. */
+            custom?: boolean;
+        };
+        RepoDeliveryOverrideDto: {
+            /** @enum {string} */
+            deliveryModel?: "auto" | "k8s_microservices" | "mobile_store" | "web_hosting" | "data_pipelines" | "monorepo" | "library" | "hybrid";
+            /** @description Per-service role → providerSlug overrides (merged over workspace roles). */
+            roles?: {
+                [key: string]: string;
+            };
+            /** @description Path prefix inside platform repos where this service's artifacts live. */
+            targetPathHint?: string;
+        };
+        DeliveryTopologyDto: {
+            /** @enum {string} */
+            deliveryModel: "auto" | "k8s_microservices" | "mobile_store" | "web_hosting" | "data_pipelines" | "monorepo" | "library" | "hybrid";
+            /** @enum {string} */
+            ciProvider: "github_actions" | "jenkins" | "gitlab" | "bitbucket" | "hybrid" | "external_documented";
+            /** @description True when infra/delivery artifacts live outside service repos. */
+            splitInfra: boolean;
+            /** @description Role → platform repo mapping. Known keys: terraform, gitops, ci_templates, jenkins_shared, mobile_release, hosting, data_platform, api_contracts, sonar_config. */
+            roles: {
+                [key: string]: components["schemas"]["DeliveryRoleConfigDto"];
+            };
+            /** @description Optional path template inside platform repos, e.g. `services/{repo_name}/` (`{repo_name}` and `{provider_slug}` placeholders supported). */
+            servicePathConvention?: string | null;
+            /** @description Per-service-repo overrides keyed by provider slug. */
+            repoOverrides: {
+                [key: string]: components["schemas"]["RepoDeliveryOverrideDto"];
+            };
         };
         TestConnectionResponseDto: {
             success: boolean;
@@ -4159,11 +4258,11 @@ export interface components {
             executionKeyValid?: boolean | null;
             /** @description Error detail when `executionKeyValid` is false. */
             executionKeyError?: string | null;
-            /** @description Present for New Relic or Grafana verify success — authenticated user name. */
+            /** @description Present for New Relic, Grafana, PagerDuty, or Jira verify success — authenticated user name. */
             userName?: string;
             /** @description Present for New Relic verify success — resolved account display name. */
             accountName?: string;
-            /** @description Present for New Relic verify success — resolved account ID. */
+            /** @description Present for New Relic or Jira verify success — resolved account ID. */
             accountId?: string;
             /** @description Present for Grafana verify success — resolved organization name. */
             orgName?: string;
@@ -6337,6 +6436,33 @@ export interface components {
             }[] | null;
             /** @description GitHub-reported repository size in KB (includes git history), refreshed on each readiness scan (#729). Compare against `eligibilityLimits.maxRepoSizeKb` on the list response to show per-repo "size / limit". When the size exceeds the limit the latest scan is recorded as `partial_failed` with `lastRunErrorCode = exceeded_repo_size_limit` and the repo is marked `ineligible`. Null until a scan has populated it. */
             sizeKb?: number | null;
+            /**
+             * @description Federated readiness: set when the repo was classified as a platform repository and scored with the reduced platform rubric profile. Null for service repos. The UI shows a "Platform repository" badge instead of comparing its score against service repos.
+             * @enum {string|null}
+             */
+            platformArchetype?: "terraform_platform" | "gitops_platform" | "ci_templates" | "api_contracts_platform" | null;
+            /** @description Federated readiness completeness for service repos: which linked platform roles (terraform/gitops/ci_templates/api_contracts, from the workspace delivery topology) are still missing scan evidence. Absent/null when no topology is configured or every declared role has fresh metadata (`complete: true`). */
+            linkedRoleAssessment?: components["schemas"]["LinkedRoleAssessmentDto"] | null;
+        };
+        LinkedRolePendingDto: {
+            /** @description Topology role key, e.g. terraform | gitops | ci_templates | api_contracts. */
+            role: string;
+            /** @description Platform repo (`owner/repo`) that must be scanned to satisfy this role. */
+            providerSlug: string;
+            /**
+             * @description `no_scan` — the platform repo has no successful readiness run yet; `no_metadata_emitted` — it was scanned but emitted no linkage for this service (wrong archetype or scan predates federated readiness); `stale` — metadata is older than the hard TTL (30 days) and must be refreshed by re-scanning the platform repo.
+             * @enum {string}
+             */
+            reason: "no_scan" | "no_metadata_emitted" | "stale";
+            /**
+             * Format: date-time
+             * @description Latest succeeded scan of the platform repo, when one exists.
+             */
+            lastRunAt?: string | null;
+        };
+        LinkedRoleAssessmentDto: {
+            complete: boolean;
+            pending: components["schemas"]["LinkedRolePendingDto"][];
         };
         /** @description Single-repo detail response. Identical to RepoReadinessScoreDto except dimensions use DimensionScoreDetailDto (criteriaDetails required per dimension). */
         RepoReadinessScoreDetailDto: {
@@ -6388,6 +6514,13 @@ export interface components {
             }[] | null;
             /** @description GitHub-reported repository size in KB, refreshed on each scan. See RepoReadinessScoreDto.sizeKb. */
             sizeKb?: number | null;
+            /**
+             * @description See RepoReadinessScoreDto.platformArchetype.
+             * @enum {string|null}
+             */
+            platformArchetype?: "terraform_platform" | "gitops_platform" | "ci_templates" | "api_contracts_platform" | null;
+            /** @description See RepoReadinessScoreDto.linkedRoleAssessment. */
+            linkedRoleAssessment?: components["schemas"]["LinkedRoleAssessmentDto"] | null;
         };
         AgenticFoundationDashboardSummaryDto: {
             repoCount: number;
@@ -8254,9 +8387,14 @@ export type SonarQubeRepoMappingValidateRowDto = components['schemas']['SonarQub
 export type SonarQubeRepoMappingsValidateResponseDto = components['schemas']['SonarQubeRepoMappingsValidateResponseDto'];
 export type PagerDutySourceDto = components['schemas']['PagerDutySourceDto'];
 export type PagerDutySourceConfigDto = components['schemas']['PagerDutySourceConfigDto'];
+export type JiraSourceDto = components['schemas']['JiraSourceDto'];
+export type JiraSourceConfigDto = components['schemas']['JiraSourceConfigDto'];
 export type AgentExecutionProviderDto = components['schemas']['AgentExecutionProviderDto'];
 export type PutCodeIntelligenceSettingsDto = components['schemas']['PutCodeIntelligenceSettingsDto'];
 export type WorkspaceConfigDto = components['schemas']['WorkspaceConfigDto'];
+export type DeliveryRoleConfigDto = components['schemas']['DeliveryRoleConfigDto'];
+export type RepoDeliveryOverrideDto = components['schemas']['RepoDeliveryOverrideDto'];
+export type DeliveryTopologyDto = components['schemas']['DeliveryTopologyDto'];
 export type TestConnectionResponseDto = components['schemas']['TestConnectionResponseDto'];
 export type CursorKeyUsageDto = components['schemas']['CursorKeyUsageDto'];
 export type AiToolSeatDto = components['schemas']['AiToolSeatDto'];
@@ -8430,6 +8568,8 @@ export type ReadinessScoreHistoryPointDto = components['schemas']['ReadinessScor
 export type ReadinessRepoScoreHistoryDto = components['schemas']['ReadinessRepoScoreHistoryDto'];
 export type WorkspaceReadinessScoreHistoryDto = components['schemas']['WorkspaceReadinessScoreHistoryDto'];
 export type RepoReadinessScoreDto = components['schemas']['RepoReadinessScoreDto'];
+export type LinkedRolePendingDto = components['schemas']['LinkedRolePendingDto'];
+export type LinkedRoleAssessmentDto = components['schemas']['LinkedRoleAssessmentDto'];
 export type RepoReadinessScoreDetailDto = components['schemas']['RepoReadinessScoreDetailDto'];
 export type AgenticFoundationDashboardSummaryDto = components['schemas']['AgenticFoundationDashboardSummaryDto'];
 export type PageMetaDto = components['schemas']['PageMetaDto'];
@@ -10208,6 +10348,50 @@ export interface operations {
             };
         };
     };
+    putWorkspaceDeliveryTopology: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: components["parameters"]["WorkspaceId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeliveryTopologyDto"] | null;
+            };
+        };
+        responses: {
+            /** @description Topology persisted (or cleared). */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid topology payload or unconnected repo referenced. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            /** @description Workspace does not exist or malformed workspaceId */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
     putTenantSources: {
         parameters: {
             query?: never;
@@ -10220,7 +10404,7 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    sources: (components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["CodeIntelligenceSourcePatchDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["SonarQubeSourceDto"] | components["schemas"]["PagerDutySourceDto"] | components["schemas"]["TenantSourceEntryDto"])[];
+                    sources: (components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["CodeIntelligenceSourcePatchDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["SonarQubeSourceDto"] | components["schemas"]["PagerDutySourceDto"] | components["schemas"]["JiraSourceDto"] | components["schemas"]["TenantSourceEntryDto"])[];
                 };
             };
         };
@@ -10274,7 +10458,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["CodeIntelligenceSourcePatchDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["SonarQubeSourceDto"] | components["schemas"]["PagerDutySourceDto"] | components["schemas"]["TenantSourceEntryDto"];
+                "application/json": components["schemas"]["CursorSourcePatchDto"] | components["schemas"]["CursorSourceDto"] | components["schemas"]["ClaudeSourcePatchDto"] | components["schemas"]["ClaudeSourceDto"] | components["schemas"]["CodeIntelligenceSourcePatchDto"] | components["schemas"]["NewRelicSourceDto"] | components["schemas"]["PrometheusSourceDto"] | components["schemas"]["GrafanaSourceDto"] | components["schemas"]["SonarQubeSourceDto"] | components["schemas"]["PagerDutySourceDto"] | components["schemas"]["JiraSourceDto"] | components["schemas"]["TenantSourceEntryDto"];
             };
         };
         responses: {