@walkeros/cli 4.6.0-next-1788817472881 → 4.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +18 -9
  2. package/dist/cli.js +78 -25
  3. package/dist/examples/docker-compose.runner.yml +2 -0
  4. package/dist/index.d.ts +669 -489
  5. package/dist/index.js +82 -28
  6. package/dist/index.js.map +1 -1
  7. package/examples/docker-compose.runner.yml +2 -0
  8. package/openapi/spec.json +1051 -731
  9. package/package.json +8 -8
package/openapi/spec.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "openapi": "3.1.0",
3
3
  "info": {
4
4
  "title": "walkerOS Tag Manager API",
5
- "version": "4.5.1",
5
+ "version": "4.6.1",
6
6
  "description": "API for managing walkerOS flows, projects, and real-time event observation.",
7
7
  "contact": {
8
8
  "name": "elbwalker",
@@ -603,7 +603,7 @@
603
603
  "required": ["projectId", "projectName", "role", "joinedAt"]
604
604
  }
605
605
  },
606
- "apiTokens": {
606
+ "tokens": {
607
607
  "type": "array",
608
608
  "items": {
609
609
  "type": "object",
@@ -614,12 +614,21 @@
614
614
  "name": {
615
615
  "type": "string"
616
616
  },
617
+ "kind": {
618
+ "type": "string",
619
+ "example": "automation"
620
+ },
621
+ "scope": {
622
+ "type": "string",
623
+ "example": "read write"
624
+ },
625
+ "audience": {
626
+ "type": "string",
627
+ "example": "api mcp"
628
+ },
617
629
  "projectId": {
618
630
  "type": ["string", "null"]
619
631
  },
620
- "origin": {
621
- "type": "string"
622
- },
623
632
  "createdAt": {
624
633
  "type": "string"
625
634
  },
@@ -627,7 +636,7 @@
627
636
  "type": ["string", "null"]
628
637
  },
629
638
  "expiresAt": {
630
- "type": ["string", "null"]
639
+ "type": "string"
631
640
  },
632
641
  "revokedAt": {
633
642
  "type": ["string", "null"]
@@ -636,8 +645,10 @@
636
645
  "required": [
637
646
  "id",
638
647
  "name",
648
+ "kind",
649
+ "scope",
650
+ "audience",
639
651
  "projectId",
640
- "origin",
641
652
  "createdAt",
642
653
  "lastUsedAt",
643
654
  "expiresAt",
@@ -666,40 +677,6 @@
666
677
  "required": ["id", "createdAt", "expiresAt", "lastTouchedAt"]
667
678
  }
668
679
  },
669
- "mcpTokens": {
670
- "type": "array",
671
- "items": {
672
- "type": "object",
673
- "properties": {
674
- "id": {
675
- "type": "string"
676
- },
677
- "name": {
678
- "type": "string"
679
- },
680
- "createdAt": {
681
- "type": "string"
682
- },
683
- "lastUsedAt": {
684
- "type": ["string", "null"]
685
- },
686
- "expiresAt": {
687
- "type": "string"
688
- },
689
- "revokedAt": {
690
- "type": ["string", "null"]
691
- }
692
- },
693
- "required": [
694
- "id",
695
- "name",
696
- "createdAt",
697
- "lastUsedAt",
698
- "expiresAt",
699
- "revokedAt"
700
- ]
701
- }
702
- },
703
680
  "mcpSessions": {
704
681
  "type": "array",
705
682
  "items": {
@@ -829,15 +806,14 @@
829
806
  "exportedAt",
830
807
  "profile",
831
808
  "memberships",
832
- "apiTokens",
809
+ "tokens",
833
810
  "sessions",
834
- "mcpTokens",
835
811
  "mcpSessions",
836
812
  "feedback",
837
813
  "invitations"
838
814
  ]
839
815
  },
840
- "ApiTokenSummary": {
816
+ "AutomationTokenSummary": {
841
817
  "type": "object",
842
818
  "properties": {
843
819
  "id": {
@@ -848,24 +824,23 @@
848
824
  "type": "string",
849
825
  "example": "CI Pipeline"
850
826
  },
851
- "prefix": {
852
- "type": "string",
853
- "example": "sk-walkeros-abcd"
854
- },
855
- "origin": {
827
+ "tokenPrefix": {
856
828
  "type": "string",
857
- "example": "manual"
829
+ "example": "wos_pat_a1b2"
858
830
  },
859
- "projectId": {
860
- "type": ["string", "null"],
861
- "example": null
831
+ "scope": {
832
+ "type": "array",
833
+ "items": {
834
+ "type": "string"
835
+ },
836
+ "example": ["read", "write"]
862
837
  },
863
- "scopes": {
864
- "type": ["array", "null"],
838
+ "audience": {
839
+ "type": "array",
865
840
  "items": {
866
841
  "type": "string"
867
842
  },
868
- "example": null
843
+ "example": ["api", "mcp"]
869
844
  },
870
845
  "createdAt": {
871
846
  "type": "string",
@@ -878,7 +853,7 @@
878
853
  "example": "2026-01-26T14:30:00.000Z"
879
854
  },
880
855
  "expiresAt": {
881
- "type": ["string", "null"],
856
+ "type": "string",
882
857
  "format": "date-time",
883
858
  "example": "2026-01-26T14:30:00.000Z"
884
859
  },
@@ -891,10 +866,9 @@
891
866
  "required": [
892
867
  "id",
893
868
  "name",
894
- "prefix",
895
- "origin",
896
- "projectId",
897
- "scopes",
869
+ "tokenPrefix",
870
+ "scope",
871
+ "audience",
898
872
  "createdAt",
899
873
  "lastUsedAt",
900
874
  "expiresAt",
@@ -3567,88 +3541,134 @@
3567
3541
  },
3568
3542
  "required": ["error", "head"]
3569
3543
  },
3570
- "SummarizeReleaseResponse": {
3544
+ "CanvasDocument": {
3571
3545
  "type": "object",
3572
3546
  "properties": {
3573
- "mode": {
3547
+ "v": {
3548
+ "type": "number",
3549
+ "enum": [1]
3550
+ },
3551
+ "nodes": {
3552
+ "type": "array",
3553
+ "items": {
3554
+ "$ref": "#/components/schemas/CanvasNodeEntry"
3555
+ },
3556
+ "maxItems": 2000
3557
+ },
3558
+ "edges": {
3559
+ "type": "array",
3560
+ "items": {
3561
+ "$ref": "#/components/schemas/CanvasEdgeEntry"
3562
+ },
3563
+ "maxItems": 4000
3564
+ },
3565
+ "hidden": {
3566
+ "type": "array",
3567
+ "items": {
3568
+ "type": "string",
3569
+ "maxLength": 200
3570
+ },
3571
+ "maxItems": 4000
3572
+ }
3573
+ },
3574
+ "required": ["v", "nodes", "edges", "hidden"]
3575
+ },
3576
+ "CanvasNodeEntry": {
3577
+ "type": "object",
3578
+ "properties": {
3579
+ "kind": {
3574
3580
  "type": "string",
3575
- "enum": ["draft", "check"]
3581
+ "pattern": "^[a-z][a-z0-9-]{0,31}$"
3576
3582
  },
3577
- "text": {
3578
- "type": "string"
3583
+ "ref": {
3584
+ "type": "string",
3585
+ "minLength": 1,
3586
+ "maxLength": 128
3579
3587
  },
3580
- "cached": {
3581
- "type": "boolean"
3588
+ "position": {
3589
+ "$ref": "#/components/schemas/CanvasPoint"
3582
3590
  },
3583
- "modelId": {
3591
+ "parent": {
3584
3592
  "type": "string",
3585
- "example": "mistral/platform/mistral-large-2512"
3593
+ "maxLength": 200
3586
3594
  },
3587
- "versionNumber": {
3588
- "type": "integer"
3595
+ "size": {
3596
+ "type": "object",
3597
+ "properties": {
3598
+ "width": {
3599
+ "type": "number",
3600
+ "exclusiveMinimum": 0
3601
+ },
3602
+ "height": {
3603
+ "type": "number",
3604
+ "exclusiveMinimum": 0
3605
+ }
3606
+ },
3607
+ "required": ["width", "height"]
3589
3608
  },
3590
- "prevVersionNumber": {
3591
- "type": "integer"
3609
+ "label": {
3610
+ "type": "string",
3611
+ "maxLength": 255
3592
3612
  }
3593
3613
  },
3594
- "required": [
3595
- "mode",
3596
- "text",
3597
- "cached",
3598
- "modelId",
3599
- "versionNumber",
3600
- "prevVersionNumber"
3601
- ]
3614
+ "required": ["kind", "ref", "position"]
3602
3615
  },
3603
- "StepHistoryResponse": {
3616
+ "CanvasPoint": {
3604
3617
  "type": "object",
3605
3618
  "properties": {
3606
- "step": {
3607
- "type": "string"
3608
- },
3609
- "flow": {
3610
- "type": ["string", "null"]
3619
+ "x": {
3620
+ "type": "number"
3611
3621
  },
3612
- "entries": {
3613
- "type": "array",
3614
- "items": {
3615
- "$ref": "#/components/schemas/StepHistoryEntry"
3616
- }
3622
+ "y": {
3623
+ "type": "number"
3624
+ }
3625
+ },
3626
+ "required": ["x", "y"]
3627
+ },
3628
+ "CanvasEdgeEntry": {
3629
+ "type": "object",
3630
+ "properties": {
3631
+ "id": {
3632
+ "type": "string",
3633
+ "pattern": "^edg_[A-Za-z0-9_-]{21}$"
3617
3634
  },
3618
- "scanned": {
3619
- "type": "integer"
3635
+ "kind": {
3636
+ "type": "string",
3637
+ "enum": ["navigation"]
3620
3638
  },
3621
- "truncated": {
3622
- "type": "boolean"
3639
+ "from": {
3640
+ "type": "string",
3641
+ "maxLength": 200
3623
3642
  },
3624
- "entriesTruncated": {
3625
- "type": "boolean"
3643
+ "to": {
3644
+ "type": "string",
3645
+ "maxLength": 200
3626
3646
  },
3627
- "knownSteps": {
3628
- "type": "array",
3629
- "items": {
3630
- "type": "string"
3631
- }
3647
+ "label": {
3648
+ "type": "string",
3649
+ "maxLength": 255
3632
3650
  }
3633
3651
  },
3634
- "required": [
3635
- "step",
3636
- "flow",
3637
- "entries",
3638
- "scanned",
3639
- "truncated",
3640
- "entriesTruncated"
3641
- ]
3652
+ "required": ["id", "kind", "from", "to"]
3642
3653
  },
3643
- "StepHistoryEntry": {
3654
+ "Canvas": {
3644
3655
  "type": "object",
3645
3656
  "properties": {
3646
- "versionId": {
3657
+ "id": {
3647
3658
  "type": "string",
3648
- "pattern": "^ver_[a-zA-Z0-9_-]+$",
3649
- "example": "ver_a1b2c3d4"
3659
+ "pattern": "^cnv_[A-Za-z0-9_-]{21}$",
3660
+ "example": "cnv_V1StGXR8Z5jdHi6BmyT7K"
3650
3661
  },
3651
- "versionNumber": {
3662
+ "projectId": {
3663
+ "type": "string"
3664
+ },
3665
+ "name": {
3666
+ "type": "string"
3667
+ },
3668
+ "document": {
3669
+ "$ref": "#/components/schemas/CanvasDocument"
3670
+ },
3671
+ "version": {
3652
3672
  "type": "integer"
3653
3673
  },
3654
3674
  "createdAt": {
@@ -3656,59 +3676,260 @@
3656
3676
  "format": "date-time",
3657
3677
  "example": "2026-01-26T14:30:00.000Z"
3658
3678
  },
3659
- "flow": {
3660
- "type": ["string", "null"]
3661
- },
3662
- "change": {
3679
+ "updatedAt": {
3663
3680
  "type": "string",
3664
- "enum": ["added", "removed", "changed"],
3665
- "example": "changed"
3681
+ "format": "date-time",
3682
+ "example": "2026-01-26T14:30:00.000Z"
3666
3683
  },
3667
- "humanText": {
3668
- "type": ["string", "null"]
3684
+ "createdBy": {
3685
+ "type": "string"
3669
3686
  },
3670
- "generatedSummary": {
3671
- "type": ["string", "null"]
3687
+ "updatedBy": {
3688
+ "type": "string"
3672
3689
  }
3673
3690
  },
3674
3691
  "required": [
3675
- "versionId",
3676
- "versionNumber",
3692
+ "id",
3693
+ "projectId",
3694
+ "name",
3695
+ "document",
3696
+ "version",
3677
3697
  "createdAt",
3678
- "flow",
3679
- "change",
3680
- "humanText",
3681
- "generatedSummary"
3698
+ "updatedAt",
3699
+ "createdBy",
3700
+ "updatedBy"
3682
3701
  ]
3683
3702
  },
3684
- "HeartbeatResponse": {
3703
+ "CanvasLean": {
3685
3704
  "type": "object",
3686
3705
  "properties": {
3687
- "ack": {
3688
- "type": "boolean",
3689
- "enum": [true]
3706
+ "id": {
3707
+ "type": "string",
3708
+ "pattern": "^cnv_[A-Za-z0-9_-]{21}$",
3709
+ "example": "cnv_V1StGXR8Z5jdHi6BmyT7K"
3690
3710
  },
3691
- "deploymentId": {
3711
+ "projectId": {
3712
+ "type": "string"
3713
+ },
3714
+ "name": {
3715
+ "type": "string"
3716
+ },
3717
+ "version": {
3718
+ "type": "integer"
3719
+ },
3720
+ "createdAt": {
3692
3721
  "type": "string",
3693
- "pattern": "^dep_[a-zA-Z0-9_-]+$",
3694
- "example": "dep_a1b2c3d4"
3722
+ "format": "date-time",
3723
+ "example": "2026-01-26T14:30:00.000Z"
3695
3724
  },
3696
- "action": {
3725
+ "updatedAt": {
3697
3726
  "type": "string",
3698
- "enum": ["none", "stop", "update"]
3727
+ "format": "date-time",
3728
+ "example": "2026-01-26T14:30:00.000Z"
3699
3729
  },
3700
- "versionNumber": {
3701
- "type": "integer",
3702
- "exclusiveMinimum": 0
3730
+ "createdBy": {
3731
+ "type": "string"
3703
3732
  },
3704
- "bundleUrl": {
3733
+ "updatedBy": {
3705
3734
  "type": "string"
3706
3735
  }
3707
3736
  },
3708
- "required": ["ack", "deploymentId", "action"]
3709
- },
3710
- "ObserveTicketRequest": {
3711
- "type": "object",
3737
+ "required": [
3738
+ "id",
3739
+ "projectId",
3740
+ "name",
3741
+ "version",
3742
+ "createdAt",
3743
+ "updatedAt",
3744
+ "createdBy",
3745
+ "updatedBy"
3746
+ ]
3747
+ },
3748
+ "CanvasListResponse": {
3749
+ "type": "object",
3750
+ "properties": {
3751
+ "canvases": {
3752
+ "type": "array",
3753
+ "items": {
3754
+ "$ref": "#/components/schemas/CanvasLean"
3755
+ }
3756
+ }
3757
+ },
3758
+ "required": ["canvases"]
3759
+ },
3760
+ "PutCanvasResponse": {
3761
+ "type": "object",
3762
+ "properties": {
3763
+ "version": {
3764
+ "type": "integer"
3765
+ }
3766
+ },
3767
+ "required": ["version"]
3768
+ },
3769
+ "CanvasConflictResponse": {
3770
+ "type": "object",
3771
+ "properties": {
3772
+ "error": {
3773
+ "type": "object",
3774
+ "properties": {
3775
+ "code": {
3776
+ "type": "string",
3777
+ "enum": ["CANVAS_VERSION_CONFLICT"]
3778
+ },
3779
+ "message": {
3780
+ "type": "string"
3781
+ }
3782
+ },
3783
+ "required": ["code", "message"]
3784
+ },
3785
+ "head": {
3786
+ "$ref": "#/components/schemas/Canvas"
3787
+ }
3788
+ },
3789
+ "required": ["error", "head"]
3790
+ },
3791
+ "SummarizeReleaseResponse": {
3792
+ "type": "object",
3793
+ "properties": {
3794
+ "mode": {
3795
+ "type": "string",
3796
+ "enum": ["draft", "check"]
3797
+ },
3798
+ "text": {
3799
+ "type": "string"
3800
+ },
3801
+ "cached": {
3802
+ "type": "boolean"
3803
+ },
3804
+ "modelId": {
3805
+ "type": "string",
3806
+ "example": "mistral/platform/mistral-large-2512"
3807
+ },
3808
+ "versionNumber": {
3809
+ "type": "integer"
3810
+ },
3811
+ "prevVersionNumber": {
3812
+ "type": "integer"
3813
+ }
3814
+ },
3815
+ "required": [
3816
+ "mode",
3817
+ "text",
3818
+ "cached",
3819
+ "modelId",
3820
+ "versionNumber",
3821
+ "prevVersionNumber"
3822
+ ]
3823
+ },
3824
+ "StepHistoryResponse": {
3825
+ "type": "object",
3826
+ "properties": {
3827
+ "step": {
3828
+ "type": "string"
3829
+ },
3830
+ "flow": {
3831
+ "type": ["string", "null"]
3832
+ },
3833
+ "entries": {
3834
+ "type": "array",
3835
+ "items": {
3836
+ "$ref": "#/components/schemas/StepHistoryEntry"
3837
+ }
3838
+ },
3839
+ "scanned": {
3840
+ "type": "integer"
3841
+ },
3842
+ "truncated": {
3843
+ "type": "boolean"
3844
+ },
3845
+ "entriesTruncated": {
3846
+ "type": "boolean"
3847
+ },
3848
+ "knownSteps": {
3849
+ "type": "array",
3850
+ "items": {
3851
+ "type": "string"
3852
+ }
3853
+ }
3854
+ },
3855
+ "required": [
3856
+ "step",
3857
+ "flow",
3858
+ "entries",
3859
+ "scanned",
3860
+ "truncated",
3861
+ "entriesTruncated"
3862
+ ]
3863
+ },
3864
+ "StepHistoryEntry": {
3865
+ "type": "object",
3866
+ "properties": {
3867
+ "versionId": {
3868
+ "type": "string",
3869
+ "pattern": "^ver_[a-zA-Z0-9_-]+$",
3870
+ "example": "ver_a1b2c3d4"
3871
+ },
3872
+ "versionNumber": {
3873
+ "type": "integer"
3874
+ },
3875
+ "createdAt": {
3876
+ "type": "string",
3877
+ "format": "date-time",
3878
+ "example": "2026-01-26T14:30:00.000Z"
3879
+ },
3880
+ "flow": {
3881
+ "type": ["string", "null"]
3882
+ },
3883
+ "change": {
3884
+ "type": "string",
3885
+ "enum": ["added", "removed", "changed"],
3886
+ "example": "changed"
3887
+ },
3888
+ "humanText": {
3889
+ "type": ["string", "null"]
3890
+ },
3891
+ "generatedSummary": {
3892
+ "type": ["string", "null"]
3893
+ }
3894
+ },
3895
+ "required": [
3896
+ "versionId",
3897
+ "versionNumber",
3898
+ "createdAt",
3899
+ "flow",
3900
+ "change",
3901
+ "humanText",
3902
+ "generatedSummary"
3903
+ ]
3904
+ },
3905
+ "HeartbeatResponse": {
3906
+ "type": "object",
3907
+ "properties": {
3908
+ "ack": {
3909
+ "type": "boolean",
3910
+ "enum": [true]
3911
+ },
3912
+ "deploymentId": {
3913
+ "type": "string",
3914
+ "pattern": "^dep_[a-zA-Z0-9_-]+$",
3915
+ "example": "dep_a1b2c3d4"
3916
+ },
3917
+ "action": {
3918
+ "type": "string",
3919
+ "enum": ["none", "stop", "update"]
3920
+ },
3921
+ "versionNumber": {
3922
+ "type": "integer",
3923
+ "exclusiveMinimum": 0
3924
+ },
3925
+ "bundleUrl": {
3926
+ "type": "string"
3927
+ }
3928
+ },
3929
+ "required": ["ack", "deploymentId", "action"]
3930
+ },
3931
+ "ObserveTicketRequest": {
3932
+ "type": "object",
3712
3933
  "properties": {
3713
3934
  "scope": {
3714
3935
  "type": "object",
@@ -5907,172 +6128,88 @@
5907
6128
  },
5908
6129
  "required": ["ok"]
5909
6130
  },
5910
- "CreateMcpTokenRequest": {
6131
+ "PackageCatalogResponse": {
5911
6132
  "type": "object",
5912
6133
  "properties": {
5913
- "name": {
5914
- "type": "string",
5915
- "minLength": 1,
5916
- "maxLength": 255
6134
+ "catalog": {
6135
+ "type": "array",
6136
+ "items": {
6137
+ "$ref": "#/components/schemas/PackageCatalogEntry"
6138
+ }
5917
6139
  },
5918
- "ttlSeconds": {
6140
+ "count": {
5919
6141
  "type": "integer",
5920
- "exclusiveMinimum": 0
6142
+ "minimum": 0
5921
6143
  }
5922
6144
  },
5923
- "required": ["name"]
6145
+ "required": ["catalog", "count"]
5924
6146
  },
5925
- "CreateMcpTokenResponse": {
6147
+ "PackageCatalogEntry": {
5926
6148
  "type": "object",
5927
6149
  "properties": {
5928
- "id": {
6150
+ "name": {
5929
6151
  "type": "string"
5930
6152
  },
5931
- "name": {
6153
+ "version": {
5932
6154
  "type": "string"
5933
6155
  },
5934
- "token": {
6156
+ "description": {
5935
6157
  "type": "string"
5936
6158
  },
5937
- "createdAt": {
5938
- "type": "string",
5939
- "format": "date-time"
6159
+ "type": {
6160
+ "type": "string"
5940
6161
  },
5941
- "expiresAt": {
5942
- "type": "string",
5943
- "format": "date-time"
6162
+ "platform": {
6163
+ "type": "array",
6164
+ "items": {
6165
+ "type": "string"
6166
+ }
5944
6167
  }
5945
6168
  },
5946
- "required": ["id", "name", "token", "createdAt", "expiresAt"]
6169
+ "required": ["name", "version", "type", "platform"]
5947
6170
  },
5948
- "ListMcpTokensResponse": {
6171
+ "PackageSearchResponse": {
5949
6172
  "type": "object",
5950
6173
  "properties": {
5951
- "tokens": {
6174
+ "packages": {
5952
6175
  "type": "array",
5953
6176
  "items": {
5954
- "$ref": "#/components/schemas/McpTokenSummary"
6177
+ "$ref": "#/components/schemas/PackageSearchHit"
5955
6178
  }
6179
+ },
6180
+ "count": {
6181
+ "type": "integer",
6182
+ "minimum": 0
5956
6183
  }
5957
6184
  },
5958
- "required": ["tokens"]
6185
+ "required": ["packages", "count"]
5959
6186
  },
5960
- "McpTokenSummary": {
6187
+ "PackageSearchHit": {
5961
6188
  "type": "object",
5962
6189
  "properties": {
5963
- "id": {
6190
+ "name": {
5964
6191
  "type": "string"
5965
6192
  },
5966
- "name": {
6193
+ "version": {
5967
6194
  "type": "string"
5968
6195
  },
5969
- "audience": {
6196
+ "description": {
5970
6197
  "type": "string"
6198
+ }
6199
+ },
6200
+ "required": ["name", "version", "description"]
6201
+ },
6202
+ "PackageSearchLogRequest": {
6203
+ "type": "object",
6204
+ "properties": {
6205
+ "query": {
6206
+ "type": "string",
6207
+ "minLength": 1,
6208
+ "maxLength": 214
5971
6209
  },
5972
- "createdAt": {
6210
+ "result": {
5973
6211
  "type": "string",
5974
- "format": "date-time"
5975
- },
5976
- "lastUsedAt": {
5977
- "type": ["string", "null"],
5978
- "format": "date-time"
5979
- },
5980
- "expiresAt": {
5981
- "type": "string",
5982
- "format": "date-time"
5983
- }
5984
- },
5985
- "required": [
5986
- "id",
5987
- "name",
5988
- "audience",
5989
- "createdAt",
5990
- "lastUsedAt",
5991
- "expiresAt"
5992
- ]
5993
- },
5994
- "PackageCatalogResponse": {
5995
- "type": "object",
5996
- "properties": {
5997
- "catalog": {
5998
- "type": "array",
5999
- "items": {
6000
- "$ref": "#/components/schemas/PackageCatalogEntry"
6001
- }
6002
- },
6003
- "count": {
6004
- "type": "integer",
6005
- "minimum": 0
6006
- }
6007
- },
6008
- "required": ["catalog", "count"]
6009
- },
6010
- "PackageCatalogEntry": {
6011
- "type": "object",
6012
- "properties": {
6013
- "name": {
6014
- "type": "string"
6015
- },
6016
- "version": {
6017
- "type": "string"
6018
- },
6019
- "description": {
6020
- "type": "string"
6021
- },
6022
- "type": {
6023
- "type": "string"
6024
- },
6025
- "platform": {
6026
- "type": "array",
6027
- "items": {
6028
- "type": "string"
6029
- }
6030
- }
6031
- },
6032
- "required": ["name", "version", "type", "platform"]
6033
- },
6034
- "PackageSearchResponse": {
6035
- "type": "object",
6036
- "properties": {
6037
- "packages": {
6038
- "type": "array",
6039
- "items": {
6040
- "$ref": "#/components/schemas/PackageSearchHit"
6041
- }
6042
- },
6043
- "count": {
6044
- "type": "integer",
6045
- "minimum": 0
6046
- }
6047
- },
6048
- "required": ["packages", "count"]
6049
- },
6050
- "PackageSearchHit": {
6051
- "type": "object",
6052
- "properties": {
6053
- "name": {
6054
- "type": "string"
6055
- },
6056
- "version": {
6057
- "type": "string"
6058
- },
6059
- "description": {
6060
- "type": "string"
6061
- }
6062
- },
6063
- "required": ["name", "version", "description"]
6064
- },
6065
- "PackageSearchLogRequest": {
6066
- "type": "object",
6067
- "properties": {
6068
- "query": {
6069
- "type": "string",
6070
- "minLength": 1,
6071
- "maxLength": 214
6072
- },
6073
- "result": {
6074
- "type": "string",
6075
- "enum": ["hit", "miss"]
6212
+ "enum": ["hit", "miss"]
6076
6213
  },
6077
6214
  "platform": {
6078
6215
  "type": "string",
@@ -6282,71 +6419,6 @@
6282
6419
  },
6283
6420
  "required": ["sessions"]
6284
6421
  },
6285
- "DeviceCodeResponse": {
6286
- "type": "object",
6287
- "properties": {
6288
- "deviceCode": {
6289
- "type": "string"
6290
- },
6291
- "userCode": {
6292
- "type": "string"
6293
- },
6294
- "expiresIn": {
6295
- "type": "number"
6296
- },
6297
- "interval": {
6298
- "type": "number"
6299
- }
6300
- },
6301
- "required": ["deviceCode", "userCode", "expiresIn", "interval"]
6302
- },
6303
- "ApproveDeviceResponse": {
6304
- "type": "object",
6305
- "properties": {
6306
- "success": {
6307
- "type": "boolean"
6308
- }
6309
- },
6310
- "required": ["success"]
6311
- },
6312
- "ApproveDeviceRequest": {
6313
- "type": "object",
6314
- "properties": {
6315
- "userCode": {
6316
- "type": "string",
6317
- "minLength": 1
6318
- }
6319
- },
6320
- "required": ["userCode"]
6321
- },
6322
- "DeviceTokenResponse": {
6323
- "type": "object",
6324
- "properties": {
6325
- "token": {
6326
- "type": "string"
6327
- },
6328
- "email": {
6329
- "type": "string"
6330
- },
6331
- "userId": {
6332
- "type": "string"
6333
- }
6334
- },
6335
- "required": ["token", "email", "userId"]
6336
- },
6337
- "DeviceTokenRequest": {
6338
- "type": "object",
6339
- "properties": {
6340
- "deviceCode": {
6341
- "type": "string",
6342
- "minLength": 1
6343
- },
6344
- "hostname": {
6345
- "type": "string"
6346
- }
6347
- },
6348
- "required": ["deviceCode"]
6349
- },
6350
6422
  "ListProjectsResponse": {
6351
6423
  "type": "object",
6352
6424
  "properties": {
@@ -6768,19 +6840,19 @@
6768
6840
  },
6769
6841
  "required": ["version", "content", "createdAt", "createdBy"]
6770
6842
  },
6771
- "ListApiTokensResponse": {
6843
+ "ListAutomationTokensResponse": {
6772
6844
  "type": "object",
6773
6845
  "properties": {
6774
6846
  "tokens": {
6775
6847
  "type": "array",
6776
6848
  "items": {
6777
- "$ref": "#/components/schemas/ApiTokenSummary"
6849
+ "$ref": "#/components/schemas/AutomationTokenSummary"
6778
6850
  }
6779
6851
  }
6780
6852
  },
6781
6853
  "required": ["tokens"]
6782
6854
  },
6783
- "CreateApiTokenResponse": {
6855
+ "CreateAutomationTokenResponse": {
6784
6856
  "type": "object",
6785
6857
  "properties": {
6786
6858
  "id": {
@@ -6793,11 +6865,25 @@
6793
6865
  },
6794
6866
  "token": {
6795
6867
  "type": "string",
6796
- "example": "sk-walkeros-abcd1234..."
6868
+ "example": "wos_pat_a1b2c3d4..."
6797
6869
  },
6798
- "prefix": {
6870
+ "tokenPrefix": {
6799
6871
  "type": "string",
6800
- "example": "sk-walkeros-abcd"
6872
+ "example": "wos_pat_a1b2"
6873
+ },
6874
+ "scope": {
6875
+ "type": "array",
6876
+ "items": {
6877
+ "type": "string"
6878
+ },
6879
+ "example": ["read", "write"]
6880
+ },
6881
+ "audience": {
6882
+ "type": "array",
6883
+ "items": {
6884
+ "type": "string"
6885
+ },
6886
+ "example": ["api", "mcp"]
6801
6887
  },
6802
6888
  "createdAt": {
6803
6889
  "type": "string",
@@ -6805,26 +6891,23 @@
6805
6891
  "example": "2026-01-26T14:30:00.000Z"
6806
6892
  },
6807
6893
  "expiresAt": {
6808
- "type": ["string", "null"],
6894
+ "type": "string",
6809
6895
  "format": "date-time",
6810
6896
  "example": "2026-01-26T14:30:00.000Z"
6811
- },
6812
- "projectId": {
6813
- "type": ["string", "null"],
6814
- "example": null
6815
6897
  }
6816
6898
  },
6817
6899
  "required": [
6818
6900
  "id",
6819
6901
  "name",
6820
6902
  "token",
6821
- "prefix",
6903
+ "tokenPrefix",
6904
+ "scope",
6905
+ "audience",
6822
6906
  "createdAt",
6823
- "expiresAt",
6824
- "projectId"
6907
+ "expiresAt"
6825
6908
  ]
6826
6909
  },
6827
- "CreateApiTokenRequest": {
6910
+ "CreateAutomationTokenRequest": {
6828
6911
  "type": "object",
6829
6912
  "properties": {
6830
6913
  "name": {
@@ -6833,14 +6916,34 @@
6833
6916
  "maxLength": 100,
6834
6917
  "example": "CI Pipeline"
6835
6918
  },
6919
+ "scope": {
6920
+ "type": "string",
6921
+ "enum": ["read", "read write"],
6922
+ "example": "read write"
6923
+ },
6836
6924
  "expiresInDays": {
6837
- "type": ["integer", "null"],
6838
- "exclusiveMinimum": 0,
6839
- "maximum": 365,
6925
+ "anyOf": [
6926
+ {
6927
+ "type": "number",
6928
+ "enum": [30]
6929
+ },
6930
+ {
6931
+ "type": "number",
6932
+ "enum": [90]
6933
+ },
6934
+ {
6935
+ "type": "number",
6936
+ "enum": [180]
6937
+ },
6938
+ {
6939
+ "type": "number",
6940
+ "enum": [365]
6941
+ }
6942
+ ],
6840
6943
  "example": 90
6841
6944
  }
6842
6945
  },
6843
- "required": ["name"]
6946
+ "required": ["name", "scope", "expiresInDays"]
6844
6947
  },
6845
6948
  "BundleResponse": {
6846
6949
  "type": "object",
@@ -8057,185 +8160,80 @@
8057
8160
  }
8058
8161
  }
8059
8162
  },
8060
- "/api/auth/device/code": {
8061
- "post": {
8062
- "tags": ["Auth"],
8063
- "summary": "Request device code",
8064
- "description": "Generate a device code and user code for the device authorization flow.",
8163
+ "/api/projects": {
8164
+ "get": {
8165
+ "tags": ["Projects"],
8166
+ "summary": "List my projects",
8167
+ "description": "List all projects where the authenticated user is a member.",
8168
+ "parameters": [
8169
+ {
8170
+ "schema": {
8171
+ "type": "string"
8172
+ },
8173
+ "required": false,
8174
+ "name": "cursor",
8175
+ "in": "query"
8176
+ },
8177
+ {
8178
+ "schema": {
8179
+ "type": "integer",
8180
+ "minimum": 1,
8181
+ "maximum": 100
8182
+ },
8183
+ "required": false,
8184
+ "name": "limit",
8185
+ "in": "query"
8186
+ }
8187
+ ],
8065
8188
  "responses": {
8066
8189
  "200": {
8067
- "description": "Device code generated",
8190
+ "description": "List of projects",
8191
+ "content": {
8192
+ "application/json": {
8193
+ "schema": {
8194
+ "$ref": "#/components/schemas/ListProjectsResponse"
8195
+ }
8196
+ }
8197
+ }
8198
+ },
8199
+ "401": {
8200
+ "description": "Unauthorized",
8068
8201
  "content": {
8069
8202
  "application/json": {
8070
8203
  "schema": {
8071
- "$ref": "#/components/schemas/DeviceCodeResponse"
8204
+ "$ref": "#/components/schemas/ErrorResponse"
8072
8205
  }
8073
8206
  }
8074
8207
  }
8075
8208
  }
8076
8209
  }
8077
- }
8078
- },
8079
- "/api/auth/device/approve": {
8210
+ },
8080
8211
  "post": {
8081
- "tags": ["Auth"],
8082
- "summary": "Approve device code",
8083
- "description": "Approve a device authorization request using the user code. Requires authentication.",
8212
+ "tags": ["Projects"],
8213
+ "summary": "Create project",
8214
+ "description": "Create a new project. The authenticated user becomes the owner.",
8084
8215
  "requestBody": {
8085
8216
  "content": {
8086
8217
  "application/json": {
8087
8218
  "schema": {
8088
- "$ref": "#/components/schemas/ApproveDeviceRequest"
8219
+ "$ref": "#/components/schemas/CreateProjectRequest"
8089
8220
  }
8090
8221
  }
8091
8222
  }
8092
8223
  },
8093
8224
  "responses": {
8094
- "200": {
8095
- "description": "Device approved",
8225
+ "201": {
8226
+ "description": "Project created",
8096
8227
  "content": {
8097
8228
  "application/json": {
8098
8229
  "schema": {
8099
- "$ref": "#/components/schemas/ApproveDeviceResponse"
8230
+ "$ref": "#/components/schemas/CreateProjectResponse"
8100
8231
  }
8101
8232
  }
8102
8233
  }
8103
8234
  },
8104
- "401": {
8105
- "description": "Unauthorized",
8106
- "content": {
8107
- "application/json": {
8108
- "schema": {
8109
- "$ref": "#/components/schemas/ErrorResponse"
8110
- }
8111
- }
8112
- }
8113
- },
8114
- "404": {
8115
- "description": "Not found",
8116
- "content": {
8117
- "application/json": {
8118
- "schema": {
8119
- "$ref": "#/components/schemas/ErrorResponse"
8120
- }
8121
- }
8122
- }
8123
- }
8124
- }
8125
- }
8126
- },
8127
- "/api/auth/device/token": {
8128
- "post": {
8129
- "tags": ["Auth"],
8130
- "summary": "Poll device token",
8131
- "description": "Poll for authorization status using the device code. Returns a token when approved.",
8132
- "requestBody": {
8133
- "content": {
8134
- "application/json": {
8135
- "schema": {
8136
- "$ref": "#/components/schemas/DeviceTokenRequest"
8137
- }
8138
- }
8139
- }
8140
- },
8141
- "responses": {
8142
- "200": {
8143
- "description": "Authorization approved",
8144
- "content": {
8145
- "application/json": {
8146
- "schema": {
8147
- "$ref": "#/components/schemas/DeviceTokenResponse"
8148
- }
8149
- }
8150
- }
8151
- },
8152
- "400": {
8153
- "description": "Pending, slow down, or expired",
8154
- "content": {
8155
- "application/json": {
8156
- "schema": {
8157
- "$ref": "#/components/schemas/ErrorResponse"
8158
- }
8159
- }
8160
- }
8161
- }
8162
- }
8163
- }
8164
- },
8165
- "/api/projects": {
8166
- "get": {
8167
- "tags": ["Projects"],
8168
- "summary": "List my projects",
8169
- "description": "List all projects where the authenticated user is a member.",
8170
- "parameters": [
8171
- {
8172
- "schema": {
8173
- "type": "string"
8174
- },
8175
- "required": false,
8176
- "name": "cursor",
8177
- "in": "query"
8178
- },
8179
- {
8180
- "schema": {
8181
- "type": "integer",
8182
- "minimum": 1,
8183
- "maximum": 100
8184
- },
8185
- "required": false,
8186
- "name": "limit",
8187
- "in": "query"
8188
- }
8189
- ],
8190
- "responses": {
8191
- "200": {
8192
- "description": "List of projects",
8193
- "content": {
8194
- "application/json": {
8195
- "schema": {
8196
- "$ref": "#/components/schemas/ListProjectsResponse"
8197
- }
8198
- }
8199
- }
8200
- },
8201
- "401": {
8202
- "description": "Unauthorized",
8203
- "content": {
8204
- "application/json": {
8205
- "schema": {
8206
- "$ref": "#/components/schemas/ErrorResponse"
8207
- }
8208
- }
8209
- }
8210
- }
8211
- }
8212
- },
8213
- "post": {
8214
- "tags": ["Projects"],
8215
- "summary": "Create project",
8216
- "description": "Create a new project. The authenticated user becomes the owner.",
8217
- "requestBody": {
8218
- "content": {
8219
- "application/json": {
8220
- "schema": {
8221
- "$ref": "#/components/schemas/CreateProjectRequest"
8222
- }
8223
- }
8224
- }
8225
- },
8226
- "responses": {
8227
- "201": {
8228
- "description": "Project created",
8229
- "content": {
8230
- "application/json": {
8231
- "schema": {
8232
- "$ref": "#/components/schemas/CreateProjectResponse"
8233
- }
8234
- }
8235
- }
8236
- },
8237
- "400": {
8238
- "description": "Validation error",
8235
+ "400": {
8236
+ "description": "Validation error",
8239
8237
  "content": {
8240
8238
  "application/json": {
8241
8239
  "schema": {
@@ -12299,15 +12297,15 @@
12299
12297
  "/api/tokens": {
12300
12298
  "get": {
12301
12299
  "tags": ["Tokens"],
12302
- "summary": "List my tokens",
12303
- "description": "List all API tokens for the authenticated user. Returns summaries (no raw token values).",
12300
+ "summary": "List my automation tokens",
12301
+ "description": "The caller's live automation tokens, with the scope and audience each carries. No raw token value is ever returned; `tokenPrefix` is the only fragment of one that survives issuance. A connected app's access token lives in the same store and is deliberately absent: it is taken back by disconnecting the app.",
12304
12302
  "responses": {
12305
12303
  "200": {
12306
- "description": "List of tokens",
12304
+ "description": "List of automation tokens",
12307
12305
  "content": {
12308
12306
  "application/json": {
12309
12307
  "schema": {
12310
- "$ref": "#/components/schemas/ListApiTokensResponse"
12308
+ "$ref": "#/components/schemas/ListAutomationTokensResponse"
12311
12309
  }
12312
12310
  }
12313
12311
  }
@@ -12326,13 +12324,13 @@
12326
12324
  },
12327
12325
  "post": {
12328
12326
  "tags": ["Tokens"],
12329
- "summary": "Create token",
12330
- "description": "Create a new API token. The raw token is returned once and cannot be retrieved again.",
12327
+ "summary": "Create automation token",
12328
+ "description": "Mint an automation token for the authenticated user. The audience is `api` and `mcp`, so one token works against REST and against `/api/mcp`, and the chosen scope decides how far it gets at either: `read` is refused every non-safe REST method with 403 `INSUFFICIENT_SCOPE`. The raw token is returned once and cannot be retrieved again, so the answer carries `Cache-Control: no-store`.",
12331
12329
  "requestBody": {
12332
12330
  "content": {
12333
12331
  "application/json": {
12334
12332
  "schema": {
12335
- "$ref": "#/components/schemas/CreateApiTokenRequest"
12333
+ "$ref": "#/components/schemas/CreateAutomationTokenRequest"
12336
12334
  }
12337
12335
  }
12338
12336
  }
@@ -12343,7 +12341,7 @@
12343
12341
  "content": {
12344
12342
  "application/json": {
12345
12343
  "schema": {
12346
- "$ref": "#/components/schemas/CreateApiTokenResponse"
12344
+ "$ref": "#/components/schemas/CreateAutomationTokenResponse"
12347
12345
  }
12348
12346
  }
12349
12347
  }
@@ -12381,11 +12379,33 @@
12381
12379
  }
12382
12380
  }
12383
12381
  },
12382
+ "/api/tokens/revoke-all": {
12383
+ "post": {
12384
+ "tags": ["Tokens"],
12385
+ "summary": "Revoke all access",
12386
+ "description": "Revoke every grant this person holds, the tokens hanging from them, and every automation token they hold. Runner tokens survive: those are the credentials deployed flow containers run with, so revoking them would stop every container the person is running. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`, so a machine token cannot disconnect everything its owner has connected.",
12387
+ "responses": {
12388
+ "204": {
12389
+ "description": "Access revoked"
12390
+ },
12391
+ "401": {
12392
+ "description": "Unauthorized",
12393
+ "content": {
12394
+ "application/json": {
12395
+ "schema": {
12396
+ "$ref": "#/components/schemas/ErrorResponse"
12397
+ }
12398
+ }
12399
+ }
12400
+ }
12401
+ }
12402
+ }
12403
+ },
12384
12404
  "/api/tokens/{tokenId}": {
12385
12405
  "delete": {
12386
12406
  "tags": ["Tokens"],
12387
- "summary": "Revoke token",
12388
- "description": "Revoke an API token (soft delete via revokedAt timestamp).",
12407
+ "summary": "Revoke automation token",
12408
+ "description": "Revoke one of the caller's tokens. Idempotent and scoped to the caller: an unknown id, another person's token and an already revoked one all answer 204, since a distinguishable answer would tell the caller which ids exist.",
12389
12409
  "parameters": [
12390
12410
  {
12391
12411
  "schema": {
@@ -16500,7 +16520,7 @@
16500
16520
  "get": {
16501
16521
  "tags": ["Projects"],
16502
16522
  "summary": "List the frames of a page, or of the whole project",
16503
- "description": "A frame is a named rectangle with marks inside it, the spatial unit of a measurement plan. Naming a `pageKey` returns that page’s frames at any depth, marks and all, newest updated first: the walk starts at the page’s top-level frames and descends containment, so a child is reachable through its parent rather than by carrying a page of its own. Naming no page returns every live frame of the project WITHOUT its marks, which is what makes that read cheap enough to answer \"what does this project have\": the marks are the bulk of a frame and a listing never renders them. That lean read asks nothing about containment, so a frame whose parent cannot be resolved still appears. Requires member role.",
16523
+ "description": "A frame is a named rectangle with marks inside it, the spatial unit of a measurement plan. Naming a `pageKey` returns that page’s frames at any depth, marks and all, newest updated first: the walk starts at the page’s top-level frames and descends containment, so a child is reachable through its parent rather than by carrying a page of its own. Naming no page returns every live frame of the project WITHOUT its marks, which is what makes that read cheap enough to answer \"what does this project have\": the marks are the bulk of a frame and a listing never renders them. That lean read asks nothing about containment, so a frame whose parent cannot be resolved still appears. `include=marks` asks that project-wide read for the marks anyway, for a surface that spans pages and cannot fetch a page at a time; it is a second, heavier read of the same rows, taken after the lean list has already painted, and omitting it returns exactly the lean rows. It says nothing to the page read, which carries marks either way. Requires member role.",
16504
16524
  "parameters": [
16505
16525
  {
16506
16526
  "schema": {
@@ -16521,6 +16541,15 @@
16521
16541
  "required": false,
16522
16542
  "name": "pageKey",
16523
16543
  "in": "query"
16544
+ },
16545
+ {
16546
+ "schema": {
16547
+ "type": "string",
16548
+ "enum": ["marks"]
16549
+ },
16550
+ "required": false,
16551
+ "name": "include",
16552
+ "in": "query"
16524
16553
  }
16525
16554
  ],
16526
16555
  "responses": {
@@ -17123,11 +17152,11 @@
17123
17152
  }
17124
17153
  }
17125
17154
  },
17126
- "/api/projects/{projectId}/flows/{flowId}/releases/step-history": {
17155
+ "/api/projects/{projectId}/canvases": {
17127
17156
  "get": {
17128
- "tags": ["Deployments"],
17129
- "summary": "List the releases that touched one step",
17130
- "description": "The releases of this flow that added, changed, or removed one step, newest first, each carrying the rationale stored for it. `step` is a `type.name` key over source, transformer, destination, store, and contract. `flow` narrows the scan to one named flow inside the config and is ignored for a contract key. `limit` bounds the releases scanned, not the entries returned. When nothing matched, `knownSteps` lists the addressable keys of the newest scanned release. Requires member role.",
17157
+ "tags": ["Projects"],
17158
+ "summary": "List the canvases of the project",
17159
+ "description": "A canvas is a named, freely arranged board over a project’s frames, the surface on which a plan is laid out across pages rather than within one. This returns every live canvas by name WITHOUT its document: the document is the bulk of a canvas and a listing renders none of it, so opening a board is the single-canvas read. Requires member role.",
17131
17160
  "parameters": [
17132
17161
  {
17133
17162
  "schema": {
@@ -17138,62 +17167,15 @@
17138
17167
  "required": true,
17139
17168
  "name": "projectId",
17140
17169
  "in": "path"
17141
- },
17142
- {
17143
- "schema": {
17144
- "type": "string",
17145
- "pattern": "^flow_[a-zA-Z0-9_-]+$",
17146
- "example": "flow_a1b2c3d4"
17147
- },
17148
- "required": true,
17149
- "name": "flowId",
17150
- "in": "path"
17151
- },
17152
- {
17153
- "schema": {
17154
- "type": "string",
17155
- "example": "destination.ga4"
17156
- },
17157
- "required": true,
17158
- "name": "step",
17159
- "in": "query"
17160
- },
17161
- {
17162
- "schema": {
17163
- "type": "string",
17164
- "example": "web"
17165
- },
17166
- "required": false,
17167
- "name": "flow",
17168
- "in": "query"
17169
- },
17170
- {
17171
- "schema": {
17172
- "type": ["integer", "null"],
17173
- "example": 25
17174
- },
17175
- "required": false,
17176
- "name": "limit",
17177
- "in": "query"
17178
17170
  }
17179
17171
  ],
17180
17172
  "responses": {
17181
17173
  "200": {
17182
- "description": "The releases that touched the step",
17183
- "content": {
17184
- "application/json": {
17185
- "schema": {
17186
- "$ref": "#/components/schemas/StepHistoryResponse"
17187
- }
17188
- }
17189
- }
17190
- },
17191
- "400": {
17192
- "description": "Invalid step key or query",
17174
+ "description": "The project’s canvases, without their documents",
17193
17175
  "content": {
17194
17176
  "application/json": {
17195
17177
  "schema": {
17196
- "$ref": "#/components/schemas/ErrorResponse"
17178
+ "$ref": "#/components/schemas/CanvasListResponse"
17197
17179
  }
17198
17180
  }
17199
17181
  }
@@ -17239,13 +17221,11 @@
17239
17221
  }
17240
17222
  }
17241
17223
  }
17242
- }
17243
- },
17244
- "/api/projects/{projectId}/flows/{flowId}/releases/summarize": {
17224
+ },
17245
17225
  "post": {
17246
- "tags": ["Deployments"],
17247
- "summary": "Summarize or check a release",
17248
- "description": "Describe what one release of this flow changed against an earlier release, or check a written note against that same change. In `draft` mode the generated text is stored as the release's generated summary; in `check` mode nothing is stored and the response says whether the note matches. The diff is always recomputed from the two stored snapshots, with secret literals masked, and is never taken from the request. Both versions must be numbered releases of this flow, and `prevVersionId` must be the earlier of the two. Requires member role and the `hub` feature.",
17226
+ "tags": ["Projects"],
17227
+ "summary": "Create one canvas",
17228
+ "description": "Create one empty canvas at version 1. The id is the client’s, so a board drawn before the first save keeps its identity when it arrives. A canvas comes into existence here and nowhere else: a document write to an id the project does not hold is a 404 rather than a create, which is what keeps a stray write from minting a board. A name another live canvas already holds is 409 `CANVAS_NAME_EXISTS`; the partial unique index is over live rows, so a name a deleted canvas still carries is free. An id that is not a canvas id is refused by the body schema as 400 `VALIDATION_ERROR`. An id that is not available, because a canvas, in this project or another, already holds it, is 400 `INVALID_CANVAS`, whose message says nothing about the project that holds it. Requires member role.",
17249
17229
  "parameters": [
17250
17230
  {
17251
17231
  "schema": {
@@ -17256,16 +17236,6 @@
17256
17236
  "required": true,
17257
17237
  "name": "projectId",
17258
17238
  "in": "path"
17259
- },
17260
- {
17261
- "schema": {
17262
- "type": "string",
17263
- "pattern": "^flow_[a-zA-Z0-9_-]+$",
17264
- "example": "flow_a1b2c3d4"
17265
- },
17266
- "required": true,
17267
- "name": "flowId",
17268
- "in": "path"
17269
17239
  }
17270
17240
  ],
17271
17241
  "requestBody": {
@@ -17274,44 +17244,35 @@
17274
17244
  "schema": {
17275
17245
  "type": "object",
17276
17246
  "properties": {
17277
- "versionId": {
17278
- "type": "string",
17279
- "pattern": "^ver_[a-zA-Z0-9_-]+$",
17280
- "example": "ver_a1b2c3d4"
17281
- },
17282
- "prevVersionId": {
17283
- "type": "string",
17284
- "pattern": "^ver_[a-zA-Z0-9_-]+$",
17285
- "example": "ver_a1b2c3d4"
17286
- },
17287
- "mode": {
17247
+ "id": {
17288
17248
  "type": "string",
17289
- "enum": ["draft", "check"]
17249
+ "pattern": "^cnv_[A-Za-z0-9_-]{21}$",
17250
+ "example": "cnv_V1StGXR8Z5jdHi6BmyT7K"
17290
17251
  },
17291
- "currentText": {
17252
+ "name": {
17292
17253
  "type": "string",
17293
17254
  "minLength": 1,
17294
- "maxLength": 4000
17255
+ "maxLength": 255
17295
17256
  }
17296
17257
  },
17297
- "required": ["versionId", "prevVersionId", "mode"]
17258
+ "required": ["id", "name"]
17298
17259
  }
17299
17260
  }
17300
17261
  }
17301
17262
  },
17302
17263
  "responses": {
17303
- "200": {
17304
- "description": "The generated summary or the check verdict",
17264
+ "201": {
17265
+ "description": "The created canvas, with its empty document",
17305
17266
  "content": {
17306
17267
  "application/json": {
17307
17268
  "schema": {
17308
- "$ref": "#/components/schemas/SummarizeReleaseResponse"
17269
+ "$ref": "#/components/schemas/Canvas"
17309
17270
  }
17310
17271
  }
17311
17272
  }
17312
17273
  },
17313
17274
  "400": {
17314
- "description": "Invalid body, a target is not a release, the pair is out of order, or no LLM provider is configured",
17275
+ "description": "Invalid body, or an id that is not available",
17315
17276
  "content": {
17316
17277
  "application/json": {
17317
17278
  "schema": {
@@ -17350,8 +17311,8 @@
17350
17311
  }
17351
17312
  }
17352
17313
  },
17353
- "429": {
17354
- "description": "Rate limited",
17314
+ "409": {
17315
+ "description": "A name another live canvas already holds",
17355
17316
  "content": {
17356
17317
  "application/json": {
17357
17318
  "schema": {
@@ -17360,8 +17321,8 @@
17360
17321
  }
17361
17322
  }
17362
17323
  },
17363
- "502": {
17364
- "description": "The model call failed or returned no usable text",
17324
+ "429": {
17325
+ "description": "Rate limited",
17365
17326
  "content": {
17366
17327
  "application/json": {
17367
17328
  "schema": {
@@ -17373,11 +17334,478 @@
17373
17334
  }
17374
17335
  }
17375
17336
  },
17376
- "/api/projects/{projectId}/deployments/{deploymentId}/versions/current/content": {
17337
+ "/api/projects/{projectId}/canvases/{canvasId}": {
17377
17338
  "get": {
17378
- "tags": ["Deployments"],
17379
- "summary": "Get current deployed content",
17380
- "description": "Get the active deployed per-setting content for a deployment, used to diff changes since deploy. Content is masked and display-only; every field is null when there is no deployed baseline. Requires member role.",
17339
+ "tags": ["Projects"],
17340
+ "summary": "Read one canvas",
17341
+ "description": "One canvas with its whole document: the nodes with their positions, the edges, and the node keys the board suppresses. A canvas of another project reads back as nothing and answers 404, never 403, so this route cannot become an oracle for what exists elsewhere. A deleted canvas is gone to every read. Requires member role.",
17342
+ "parameters": [
17343
+ {
17344
+ "schema": {
17345
+ "type": "string",
17346
+ "pattern": "^proj_[a-zA-Z0-9_-]+$",
17347
+ "example": "proj_x7y8z9"
17348
+ },
17349
+ "required": true,
17350
+ "name": "projectId",
17351
+ "in": "path"
17352
+ },
17353
+ {
17354
+ "schema": {
17355
+ "type": "string",
17356
+ "pattern": "^cnv_[A-Za-z0-9_-]{21}$",
17357
+ "example": "cnv_V1StGXR8Z5jdHi6BmyT7K",
17358
+ "description": "Canvas ID (cnv_...)"
17359
+ },
17360
+ "required": true,
17361
+ "description": "Canvas ID (cnv_...)",
17362
+ "name": "canvasId",
17363
+ "in": "path"
17364
+ }
17365
+ ],
17366
+ "responses": {
17367
+ "200": {
17368
+ "description": "The canvas",
17369
+ "content": {
17370
+ "application/json": {
17371
+ "schema": {
17372
+ "$ref": "#/components/schemas/Canvas"
17373
+ }
17374
+ }
17375
+ }
17376
+ },
17377
+ "400": {
17378
+ "description": "The path segment does not address a canvas",
17379
+ "content": {
17380
+ "application/json": {
17381
+ "schema": {
17382
+ "$ref": "#/components/schemas/ErrorResponse"
17383
+ }
17384
+ }
17385
+ }
17386
+ },
17387
+ "401": {
17388
+ "description": "Unauthorized",
17389
+ "content": {
17390
+ "application/json": {
17391
+ "schema": {
17392
+ "$ref": "#/components/schemas/ErrorResponse"
17393
+ }
17394
+ }
17395
+ }
17396
+ },
17397
+ "403": {
17398
+ "description": "Forbidden",
17399
+ "content": {
17400
+ "application/json": {
17401
+ "schema": {
17402
+ "$ref": "#/components/schemas/ErrorResponse"
17403
+ }
17404
+ }
17405
+ }
17406
+ },
17407
+ "404": {
17408
+ "description": "Not found",
17409
+ "content": {
17410
+ "application/json": {
17411
+ "schema": {
17412
+ "$ref": "#/components/schemas/ErrorResponse"
17413
+ }
17414
+ }
17415
+ }
17416
+ },
17417
+ "429": {
17418
+ "description": "Rate limited",
17419
+ "content": {
17420
+ "application/json": {
17421
+ "schema": {
17422
+ "$ref": "#/components/schemas/ErrorResponse"
17423
+ }
17424
+ }
17425
+ }
17426
+ }
17427
+ }
17428
+ },
17429
+ "put": {
17430
+ "tags": ["Projects"],
17431
+ "summary": "Replace the document of one canvas",
17432
+ "description": "The whole board every time: a canvas is read and written as a unit, so there is no partial write to reconcile. `clientWriteId` is minted at compose time and is what makes a replayed drain exact: a write whose id already produced the stored version landed once and is answered with that version, writing nothing, so an offline queue drains repeatedly without turning one edit into two versions. A write against a version someone else has moved past answers 409 `CANVAS_VERSION_CONFLICT` carrying the head, which is what lets a client raise keep-mine against load-theirs on the board that conflicted instead of dropping what a person drew. A canvas this project does not hold, or one that was removed, is 404 `CANVAS_NOT_FOUND`: this door replaces a document and never creates one. Requires member role.",
17433
+ "parameters": [
17434
+ {
17435
+ "schema": {
17436
+ "type": "string",
17437
+ "pattern": "^proj_[a-zA-Z0-9_-]+$",
17438
+ "example": "proj_x7y8z9"
17439
+ },
17440
+ "required": true,
17441
+ "name": "projectId",
17442
+ "in": "path"
17443
+ },
17444
+ {
17445
+ "schema": {
17446
+ "type": "string",
17447
+ "pattern": "^cnv_[A-Za-z0-9_-]{21}$",
17448
+ "example": "cnv_V1StGXR8Z5jdHi6BmyT7K",
17449
+ "description": "Canvas ID (cnv_...)"
17450
+ },
17451
+ "required": true,
17452
+ "description": "Canvas ID (cnv_...)",
17453
+ "name": "canvasId",
17454
+ "in": "path"
17455
+ }
17456
+ ],
17457
+ "requestBody": {
17458
+ "content": {
17459
+ "application/json": {
17460
+ "schema": {
17461
+ "type": "object",
17462
+ "properties": {
17463
+ "document": {
17464
+ "$ref": "#/components/schemas/CanvasDocument"
17465
+ },
17466
+ "baseVersion": {
17467
+ "type": "integer",
17468
+ "minimum": 0
17469
+ },
17470
+ "clientWriteId": {
17471
+ "type": "string",
17472
+ "pattern": "^cw_[A-Za-z0-9_-]{21}$"
17473
+ }
17474
+ },
17475
+ "required": ["document", "baseVersion", "clientWriteId"]
17476
+ }
17477
+ }
17478
+ }
17479
+ },
17480
+ "responses": {
17481
+ "200": {
17482
+ "description": "The stored version",
17483
+ "content": {
17484
+ "application/json": {
17485
+ "schema": {
17486
+ "$ref": "#/components/schemas/PutCanvasResponse"
17487
+ }
17488
+ }
17489
+ }
17490
+ },
17491
+ "400": {
17492
+ "description": "Invalid body, or a path segment that addresses no canvas",
17493
+ "content": {
17494
+ "application/json": {
17495
+ "schema": {
17496
+ "$ref": "#/components/schemas/ErrorResponse"
17497
+ }
17498
+ }
17499
+ }
17500
+ },
17501
+ "401": {
17502
+ "description": "Unauthorized",
17503
+ "content": {
17504
+ "application/json": {
17505
+ "schema": {
17506
+ "$ref": "#/components/schemas/ErrorResponse"
17507
+ }
17508
+ }
17509
+ }
17510
+ },
17511
+ "403": {
17512
+ "description": "Forbidden",
17513
+ "content": {
17514
+ "application/json": {
17515
+ "schema": {
17516
+ "$ref": "#/components/schemas/ErrorResponse"
17517
+ }
17518
+ }
17519
+ }
17520
+ },
17521
+ "404": {
17522
+ "description": "This project does not hold the named canvas",
17523
+ "content": {
17524
+ "application/json": {
17525
+ "schema": {
17526
+ "$ref": "#/components/schemas/ErrorResponse"
17527
+ }
17528
+ }
17529
+ }
17530
+ },
17531
+ "409": {
17532
+ "description": "A stale base version, carrying the head",
17533
+ "content": {
17534
+ "application/json": {
17535
+ "schema": {
17536
+ "$ref": "#/components/schemas/CanvasConflictResponse"
17537
+ }
17538
+ }
17539
+ }
17540
+ },
17541
+ "429": {
17542
+ "description": "Rate limited",
17543
+ "content": {
17544
+ "application/json": {
17545
+ "schema": {
17546
+ "$ref": "#/components/schemas/ErrorResponse"
17547
+ }
17548
+ }
17549
+ }
17550
+ }
17551
+ }
17552
+ }
17553
+ },
17554
+ "/api/projects/{projectId}/flows/{flowId}/releases/step-history": {
17555
+ "get": {
17556
+ "tags": ["Deployments"],
17557
+ "summary": "List the releases that touched one step",
17558
+ "description": "The releases of this flow that added, changed, or removed one step, newest first, each carrying the rationale stored for it. `step` is a `type.name` key over source, transformer, destination, store, and contract. `flow` narrows the scan to one named flow inside the config and is ignored for a contract key. `limit` bounds the releases scanned, not the entries returned. When nothing matched, `knownSteps` lists the addressable keys of the newest scanned release. Requires member role.",
17559
+ "parameters": [
17560
+ {
17561
+ "schema": {
17562
+ "type": "string",
17563
+ "pattern": "^proj_[a-zA-Z0-9_-]+$",
17564
+ "example": "proj_x7y8z9"
17565
+ },
17566
+ "required": true,
17567
+ "name": "projectId",
17568
+ "in": "path"
17569
+ },
17570
+ {
17571
+ "schema": {
17572
+ "type": "string",
17573
+ "pattern": "^flow_[a-zA-Z0-9_-]+$",
17574
+ "example": "flow_a1b2c3d4"
17575
+ },
17576
+ "required": true,
17577
+ "name": "flowId",
17578
+ "in": "path"
17579
+ },
17580
+ {
17581
+ "schema": {
17582
+ "type": "string",
17583
+ "example": "destination.ga4"
17584
+ },
17585
+ "required": true,
17586
+ "name": "step",
17587
+ "in": "query"
17588
+ },
17589
+ {
17590
+ "schema": {
17591
+ "type": "string",
17592
+ "example": "web"
17593
+ },
17594
+ "required": false,
17595
+ "name": "flow",
17596
+ "in": "query"
17597
+ },
17598
+ {
17599
+ "schema": {
17600
+ "type": ["integer", "null"],
17601
+ "example": 25
17602
+ },
17603
+ "required": false,
17604
+ "name": "limit",
17605
+ "in": "query"
17606
+ }
17607
+ ],
17608
+ "responses": {
17609
+ "200": {
17610
+ "description": "The releases that touched the step",
17611
+ "content": {
17612
+ "application/json": {
17613
+ "schema": {
17614
+ "$ref": "#/components/schemas/StepHistoryResponse"
17615
+ }
17616
+ }
17617
+ }
17618
+ },
17619
+ "400": {
17620
+ "description": "Invalid step key or query",
17621
+ "content": {
17622
+ "application/json": {
17623
+ "schema": {
17624
+ "$ref": "#/components/schemas/ErrorResponse"
17625
+ }
17626
+ }
17627
+ }
17628
+ },
17629
+ "401": {
17630
+ "description": "Unauthorized",
17631
+ "content": {
17632
+ "application/json": {
17633
+ "schema": {
17634
+ "$ref": "#/components/schemas/ErrorResponse"
17635
+ }
17636
+ }
17637
+ }
17638
+ },
17639
+ "403": {
17640
+ "description": "Forbidden",
17641
+ "content": {
17642
+ "application/json": {
17643
+ "schema": {
17644
+ "$ref": "#/components/schemas/ErrorResponse"
17645
+ }
17646
+ }
17647
+ }
17648
+ },
17649
+ "404": {
17650
+ "description": "Not found",
17651
+ "content": {
17652
+ "application/json": {
17653
+ "schema": {
17654
+ "$ref": "#/components/schemas/ErrorResponse"
17655
+ }
17656
+ }
17657
+ }
17658
+ },
17659
+ "429": {
17660
+ "description": "Rate limited",
17661
+ "content": {
17662
+ "application/json": {
17663
+ "schema": {
17664
+ "$ref": "#/components/schemas/ErrorResponse"
17665
+ }
17666
+ }
17667
+ }
17668
+ }
17669
+ }
17670
+ }
17671
+ },
17672
+ "/api/projects/{projectId}/flows/{flowId}/releases/summarize": {
17673
+ "post": {
17674
+ "tags": ["Deployments"],
17675
+ "summary": "Summarize or check a release",
17676
+ "description": "Describe what one release of this flow changed against an earlier release, or check a written note against that same change. In `draft` mode the generated text is stored as the release's generated summary; in `check` mode nothing is stored and the response says whether the note matches. The diff is always recomputed from the two stored snapshots, with secret literals masked, and is never taken from the request. Both versions must be numbered releases of this flow, and `prevVersionId` must be the earlier of the two. Requires member role and the `hub` feature.",
17677
+ "parameters": [
17678
+ {
17679
+ "schema": {
17680
+ "type": "string",
17681
+ "pattern": "^proj_[a-zA-Z0-9_-]+$",
17682
+ "example": "proj_x7y8z9"
17683
+ },
17684
+ "required": true,
17685
+ "name": "projectId",
17686
+ "in": "path"
17687
+ },
17688
+ {
17689
+ "schema": {
17690
+ "type": "string",
17691
+ "pattern": "^flow_[a-zA-Z0-9_-]+$",
17692
+ "example": "flow_a1b2c3d4"
17693
+ },
17694
+ "required": true,
17695
+ "name": "flowId",
17696
+ "in": "path"
17697
+ }
17698
+ ],
17699
+ "requestBody": {
17700
+ "content": {
17701
+ "application/json": {
17702
+ "schema": {
17703
+ "type": "object",
17704
+ "properties": {
17705
+ "versionId": {
17706
+ "type": "string",
17707
+ "pattern": "^ver_[a-zA-Z0-9_-]+$",
17708
+ "example": "ver_a1b2c3d4"
17709
+ },
17710
+ "prevVersionId": {
17711
+ "type": "string",
17712
+ "pattern": "^ver_[a-zA-Z0-9_-]+$",
17713
+ "example": "ver_a1b2c3d4"
17714
+ },
17715
+ "mode": {
17716
+ "type": "string",
17717
+ "enum": ["draft", "check"]
17718
+ },
17719
+ "currentText": {
17720
+ "type": "string",
17721
+ "minLength": 1,
17722
+ "maxLength": 4000
17723
+ }
17724
+ },
17725
+ "required": ["versionId", "prevVersionId", "mode"]
17726
+ }
17727
+ }
17728
+ }
17729
+ },
17730
+ "responses": {
17731
+ "200": {
17732
+ "description": "The generated summary or the check verdict",
17733
+ "content": {
17734
+ "application/json": {
17735
+ "schema": {
17736
+ "$ref": "#/components/schemas/SummarizeReleaseResponse"
17737
+ }
17738
+ }
17739
+ }
17740
+ },
17741
+ "400": {
17742
+ "description": "Invalid body, a target is not a release, the pair is out of order, or no LLM provider is configured",
17743
+ "content": {
17744
+ "application/json": {
17745
+ "schema": {
17746
+ "$ref": "#/components/schemas/ErrorResponse"
17747
+ }
17748
+ }
17749
+ }
17750
+ },
17751
+ "401": {
17752
+ "description": "Unauthorized",
17753
+ "content": {
17754
+ "application/json": {
17755
+ "schema": {
17756
+ "$ref": "#/components/schemas/ErrorResponse"
17757
+ }
17758
+ }
17759
+ }
17760
+ },
17761
+ "403": {
17762
+ "description": "Forbidden",
17763
+ "content": {
17764
+ "application/json": {
17765
+ "schema": {
17766
+ "$ref": "#/components/schemas/ErrorResponse"
17767
+ }
17768
+ }
17769
+ }
17770
+ },
17771
+ "404": {
17772
+ "description": "Not found",
17773
+ "content": {
17774
+ "application/json": {
17775
+ "schema": {
17776
+ "$ref": "#/components/schemas/ErrorResponse"
17777
+ }
17778
+ }
17779
+ }
17780
+ },
17781
+ "429": {
17782
+ "description": "Rate limited",
17783
+ "content": {
17784
+ "application/json": {
17785
+ "schema": {
17786
+ "$ref": "#/components/schemas/ErrorResponse"
17787
+ }
17788
+ }
17789
+ }
17790
+ },
17791
+ "502": {
17792
+ "description": "The model call failed or returned no usable text",
17793
+ "content": {
17794
+ "application/json": {
17795
+ "schema": {
17796
+ "$ref": "#/components/schemas/ErrorResponse"
17797
+ }
17798
+ }
17799
+ }
17800
+ }
17801
+ }
17802
+ }
17803
+ },
17804
+ "/api/projects/{projectId}/deployments/{deploymentId}/versions/current/content": {
17805
+ "get": {
17806
+ "tags": ["Deployments"],
17807
+ "summary": "Get current deployed content",
17808
+ "description": "Get the active deployed per-setting content for a deployment, used to diff changes since deploy. Content is masked and display-only; every field is null when there is no deployed baseline. Requires member role.",
17381
17809
  "parameters": [
17382
17810
  {
17383
17811
  "schema": {
@@ -18515,114 +18943,6 @@
18515
18943
  }
18516
18944
  }
18517
18945
  },
18518
- "/api/mcp/tokens": {
18519
- "get": {
18520
- "tags": ["Tokens"],
18521
- "summary": "List MCP tokens",
18522
- "description": "List the authenticated user's personal MCP tokens. No secret material is returned.",
18523
- "responses": {
18524
- "200": {
18525
- "description": "MCP token list",
18526
- "content": {
18527
- "application/json": {
18528
- "schema": {
18529
- "$ref": "#/components/schemas/ListMcpTokensResponse"
18530
- }
18531
- }
18532
- }
18533
- },
18534
- "401": {
18535
- "description": "Unauthorized",
18536
- "content": {
18537
- "application/json": {
18538
- "schema": {
18539
- "$ref": "#/components/schemas/ErrorResponse"
18540
- }
18541
- }
18542
- }
18543
- }
18544
- }
18545
- },
18546
- "post": {
18547
- "tags": ["Tokens"],
18548
- "summary": "Issue MCP token",
18549
- "description": "Issue a personal MCP token. The raw token is returned exactly once and is never retrievable afterwards.",
18550
- "requestBody": {
18551
- "content": {
18552
- "application/json": {
18553
- "schema": {
18554
- "$ref": "#/components/schemas/CreateMcpTokenRequest"
18555
- }
18556
- }
18557
- }
18558
- },
18559
- "responses": {
18560
- "201": {
18561
- "description": "MCP token issued",
18562
- "content": {
18563
- "application/json": {
18564
- "schema": {
18565
- "$ref": "#/components/schemas/CreateMcpTokenResponse"
18566
- }
18567
- }
18568
- }
18569
- },
18570
- "400": {
18571
- "description": "Validation error",
18572
- "content": {
18573
- "application/json": {
18574
- "schema": {
18575
- "$ref": "#/components/schemas/ErrorResponse"
18576
- }
18577
- }
18578
- }
18579
- },
18580
- "401": {
18581
- "description": "Unauthorized",
18582
- "content": {
18583
- "application/json": {
18584
- "schema": {
18585
- "$ref": "#/components/schemas/ErrorResponse"
18586
- }
18587
- }
18588
- }
18589
- }
18590
- }
18591
- }
18592
- },
18593
- "/api/mcp/tokens/{tokenId}": {
18594
- "delete": {
18595
- "tags": ["Tokens"],
18596
- "summary": "Revoke MCP token",
18597
- "description": "Revoke a personal MCP token by id.",
18598
- "parameters": [
18599
- {
18600
- "schema": {
18601
- "type": "string",
18602
- "example": "mcptok_abc123"
18603
- },
18604
- "required": true,
18605
- "name": "tokenId",
18606
- "in": "path"
18607
- }
18608
- ],
18609
- "responses": {
18610
- "204": {
18611
- "description": "MCP token revoked"
18612
- },
18613
- "401": {
18614
- "description": "Unauthorized",
18615
- "content": {
18616
- "application/json": {
18617
- "schema": {
18618
- "$ref": "#/components/schemas/ErrorResponse"
18619
- }
18620
- }
18621
- }
18622
- }
18623
- }
18624
- }
18625
- },
18626
18946
  "/api/projects/{projectId}/runners": {
18627
18947
  "get": {
18628
18948
  "tags": ["Deployments"],