/**
 * This file was auto-generated by openapi-typescript.
 * Do not make direct changes to the file.
 */

export interface paths {
    "/auth/login": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Authenticate with username and password
         * @description Validates credentials against the bcrypt hashes in config.json. On success, issues a bearer token, an HttpOnly session cookie (omnipus-session), and a __Host-csrf cookie. CSRF-exempt (cookie cannot pre-exist before login). Rate-limited: 5 failures per IP+username per 15 minutes → 429.
         */
        post: operations["login"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/auth/logout": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Revoke the authenticated user's session
         * @description Clears the user's token_hash and session_token_hash in config.json, then revokes the omnipus-session and __Host-csrf browser cookies. Requires authentication.
         */
        post: operations["logout"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/auth/validate": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Validate the current bearer token
         * @description Returns the authenticated user's username and role when the token is valid. Rate-limited: 30 requests per IP per minute.
         */
        get: operations["validateToken"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/auth/register-admin": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Create the first admin account
         * @description Creates the first admin user. Returns 409 if any admin already exists. The check-create sequence is atomic (TOCTOU-safe via safeUpdateConfigJSON). Issues bearer token, session cookie, and CSRF cookie on success. CSRF-exempt. Rate-limited: 3 requests per IP per minute.
         */
        post: operations["registerAdmin"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/auth/change-password": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Change the authenticated user's own password
         * @description Self-service password change. Requires the current password for verification. Different from PUT /users/{username}/password which is the admin-reset path. Requires authentication.
         */
        post: operations["changePassword"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/onboarding/complete": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Finalize first-run onboarding
         * @description Two-phase commit: writes the LLM provider config and admin user to config.json atomically, then marks onboarding complete in state.json. Returns 409 when onboarding is already complete. CSRF-exempt (no cookie exists yet). Rate-limited: 3 requests per IP per minute. On success, issues a __Host-csrf cookie so the SPA can immediately make CSRF-protected requests.
         */
        post: operations["completeOnboarding"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/onboarding/probe-provider": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Test a provider API key and list available models
         * @description Non-persistent probe: accepts an API key in the request body, tests it against the provider's /models endpoint, and returns the model list. Nothing is written to disk. Available only during onboarding (returns 409 after onboarding completes). CSRF-exempt.
         */
        post: operations["probeProvider"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/sessions": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List sessions across all agents
         * @description Returns all sessions visible to the authenticated user. Supports optional filtering by agent_id and type. When some agents fail to list their sessions (e.g. filesystem error), the response still returns HTTP 200 but includes a partial_errors array alongside the sessions array.
         */
        get: operations["listSessions"];
        put?: never;
        /**
         * Create a new session
         * @description Creates a new session for the specified agent. Returns HTTP 201 on success. The agent must exist (400 if not found).
         */
        post: operations["createSession"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/sessions/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get session detail including full transcript
         * @description Returns the session metadata and complete ordered transcript. Used by the SPA to render the chat history.
         */
        get: operations["getSession"];
        /**
         * Rename a session
         * @description Updates the session title. Returns the updated session metadata.
         */
        put: operations["renameSession"];
        post?: never;
        /**
         * Delete a session and all its data
         * @description Permanently removes the session directory including transcript and context. Returns {"success": true} on success.
         */
        delete: operations["deleteSession"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/sessions/{id}/messages": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get session transcript messages
         * @description Returns the ordered transcript entries for a session without the metadata wrapper. Lighter than GET /sessions/{id} when only the message list is needed.
         */
        get: operations["getSessionMessages"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/sessions/{session_id}/tool-results/{ref}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Fetch a previously-stored tool result body
         * @description Returns the full JSON body of a tool result that was emitted as a ToolResultRef sentinel on the WebSocket. The result is scoped to the session that produced it — a ref from session A cannot be fetched under session B's path. The SPA fetches this lazily when the user expands a clamped tool call, keeping main-thread memory bounded during high-volume agent activity.
         */
        get: operations["getToolResult"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/users": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List all user accounts
         * @description Returns all registered gateway users. Admin-only. Password and token hashes are never included — only boolean presence flags. dev_mode_bypass=true disables this endpoint (503).
         */
        get: operations["listUsers"];
        put?: never;
        /**
         * Create a new user account
         * @description Creates a new user with hashed password. No bearer token is issued at creation time — the user must log in via POST /auth/login to obtain one. Admin-only. dev_mode_bypass=true disables this endpoint (503).
         */
        post: operations["createUser"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/users/{username}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /**
         * Delete a user account
         * @description Permanently removes the user from config.json. The last-admin guard prevents deleting the final admin account (409). Admin-only. dev_mode_bypass=true disables this endpoint (503).
         */
        delete: operations["deleteUser"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/users/{username}/role": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        /**
         * Change a user's RBAC role
         * @description Changes the role of the target user. The last-admin guard prevents demoting the final admin (409). Admin-only. dev_mode_bypass=true disables this endpoint (503).
         */
        patch: operations["changeUserRole"];
        trace?: never;
    };
    "/users/{username}/password": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Admin-reset a user's password
         * @description Resets the target user's password and invalidates their current bearer token. The user must log in again with the new password. This is the admin-reset path — the self-change path is POST /auth/change-password. Admin-only. dev_mode_bypass=true disables this endpoint (503).
         */
        put: operations["resetUserPassword"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/agents": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List all configured agents
         * @description Returns all agents from config.json (core + custom). Core agents return empty soul/heartbeat/instructions (compiled-in prompts are not exposed). Custom agents return SOUL.md content only (not heartbeat/instructions) for efficient list rendering.
         */
        get: operations["listAgents"];
        put?: never;
        /**
         * Create a new custom agent
         * @description Creates a new custom agent with a server-assigned UUID. Returns HTTP 201. The agent starts in "draft" status (no SOUL.md written yet). Triggers a config reload after successful persistence.
         */
        post: operations["createAgent"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/agents/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get a single agent configuration
         * @description Returns the full agent configuration including soul, heartbeat, and instructions. Core (locked) agents return empty soul (compiled-in prompt not exposed).
         */
        get: operations["getAgent"];
        /**
         * Update agent configuration
         * @description Updates the specified agent. All fields are optional (only provided fields change). Locked core agents reject mutations to name, description, soul, heartbeat, instructions (403). Writing soul/heartbeat/instructions triggers a config reload. Model, timeout, max_tool_iterations, steering_mode, tool_feedback, heartbeat_enabled, heartbeat_interval changes do NOT trigger a reload.
         */
        put: operations["updateAgent"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        /**
         * Update agent ownership (admin only)
         * @description Updates the owner_username field on a custom agent. Only admins may call this endpoint. System and core agents cannot have an owner assigned (400). Clearing the owner (empty string) requires the X-Confirm-Demote: 1 header.
         */
        patch: operations["patchAgentOwnership"];
        trace?: never;
    };
    "/agents/{id}/sessions": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List sessions for a specific agent
         * @description Returns all sessions owned by the specified agent. Returns an empty array when the agent has no session store.
         */
        get: operations["listAgentSessions"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/agents/{id}/tools": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get per-agent tool registry view and effective policies
         * @description Returns the agent's current tool policy configuration (AgentToolsCfg) plus the effective per-tool policy after fence application. Used by the Tools & Permissions panel in the Agent Profile UI.
         */
        get: operations["getAgentTools"];
        /**
         * Replace per-agent tool policy configuration
         * @description Replaces the agent's tools_cfg in config.json. Locked (core/system) agents cannot have their tool policy overwritten via this endpoint (403). Triggers a config reload on success.
         */
        put: operations["updateAgentTools"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/session-scope": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get the current DM session scoping strategy
         * @description Returns the dm_scope configuration value. Controls how incoming direct messages from channels are routed to session threads. Defaults to "per-channel-peer" when not explicitly configured.
         */
        get: operations["getSessionScope"];
        /**
         * Update the DM session scoping strategy
         * @description Persists the new dm_scope to config.json. Session routing is cached at boot so all changes require a gateway restart. The response always includes requires_restart=true. Admin-only. Emits a security audit log entry.
         */
        put: operations["updateSessionScope"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/health": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Health check
         * @description Returns HTTP 200 when the gateway is running. No authentication required.
         */
        get: operations["getHealth"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/about": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Gateway metadata
         * @description Returns version, runtime, uptime, PID, and preview listener fields. Used by the SPA to construct iframe preview URLs (FR-009).
         */
        get: operations["getAbout"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/version": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Build version and VCS revision
         * @description Returns the gateway's version string and embedded VCS revision SHA. Used by the frontend to detect version drift and prompt "New version available" (#110). No authentication required.
         */
        get: operations["getVersion"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tools": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Central tool registry snapshot (FR-027)
         * @description Returns all registered tools with name, description, scope, category, and source discriminator (builtin | mcp). Always returns an array — never null even when empty.
         */
        get: operations["getToolRegistry"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tools/builtin": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Deprecated builtin tool catalog (FR-029)
         * @description This endpoint was removed in the central tool registry redesign. Always returns HTTP 404. Use GET /api/v1/tools instead.
         */
        get: operations["getBuiltinToolsDeprecated"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tool-approvals/{approval_id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Resolve a pending tool approval (FR-011, FR-082)
         * @description Approve, deny, or cancel a pending tool call approval. For tools with RequiresAdminAsk=true, the caller must hold the admin role (FR-015).
         */
        post: operations["postToolApproval"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/tool-policies": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get global tool policies
         * @description Returns the current global tool policy configuration from sandbox.tool_policies and sandbox.default_tool_policy.
         */
        get: operations["getGlobalToolPolicies"];
        /**
         * Update global tool policies (admin only)
         * @description Persists new global tool policies to config.json under the sandbox key. Changes are audit-logged (SEC-15). Admin-only; non-admin returns 403.
         */
        put: operations["updateGlobalToolPolicies"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/exec-allowlist": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get exec binary allowlist (SEC-05)
         * @description Returns the current exec allowlist and approval mode.
         */
        get: operations["getExecAllowlist"];
        /**
         * Update exec binary allowlist (SEC-05)
         * @description Atomically updates the exec binary allowlist. Patterns are trimmed, validated, and deduplicated. Changes are audit-logged (SEC-15). Note: requires_restart=true in the response because the in-memory agent loop uses the previous allowlist until the gateway restarts (SEC-12).
         */
        put: operations["updateExecAllowlist"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/exec-proxy-status": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get exec SSRF proxy runtime state (SEC-28)
         * @description Returns whether the exec proxy is configured and currently bound. Operators use this to distinguish "disabled by config" from "failed to bind" from "running normally".
         */
        get: operations["getExecProxyStatus"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/skill-trust": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get skill trust level
         * @description Returns the current skill trust level from sandbox.skill_trust. Default is "warn_unverified" when not set.
         */
        get: operations["getSkillTrust"];
        /**
         * Update skill trust level (admin only)
         * @description Persists the new skill trust level to config.sandbox.skill_trust. Only the three canonical values are accepted (case-sensitive). Changes are audit-logged.
         */
        put: operations["updateSkillTrust"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/prompt-guard": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get prompt injection guard level
         * @description Returns the current prompt injection detection strictness level. Default is "medium". Requires restart is always false (hot-reloaded).
         */
        get: operations["getPromptGuard"];
        /**
         * Update prompt injection guard level (admin only)
         * @description Persists the new prompt injection level to config and hot-reloads. Changes take effect immediately — requires_restart is false on successful hot-reload.
         */
        put: operations["updatePromptGuard"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/rate-limits": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get rate limit configuration and live daily cost
         * @description Returns the current rate-limit config and the live daily LLM cost. Hot-reloaded — requires_restart is always false on PUT.
         */
        get: operations["getRateLimits"];
        /**
         * Update rate limit configuration (admin only)
         * @description Partial update — any subset of the three cap fields. Strict type validation rejects JSON strings in numeric fields, floats in integer fields, negative values, NaN/Inf, and overflow. Changes are hot-reloaded (requires_restart: false).
         */
        put: operations["updateRateLimits"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/sandbox-config": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get sandbox configuration
         * @description Returns the full sandbox configuration including mode, network settings, SSRF controls, and agent defaults.
         */
        get: operations["getSandboxConfig"];
        /**
         * Update sandbox configuration (admin only)
         * @description Partial update — any subset of mode, allow_network_outbound, allowed_paths, ssrf_enabled, ssrf_allow_internal, ssrf.allow_internal, default_profile, shell_deny_patterns. At least one field required. mode, allowed_paths, and default_profile are restart-gated (requires_restart=true). SSRF and shell_deny_patterns are hot-reloaded. Admin-only; non-admin returns 403. Protected by RequireNotBypass middleware (returns 503 when dev_mode_bypass is active).
         */
        put: operations["updateSandboxConfig"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/sandbox-status": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get sandbox backend runtime status (SEC-01/02/03)
         * @description Returns the active sandbox backend, kernel capabilities, enforcement flags, and bind-port-rule count. Lets operators distinguish enforce from permissive from off states.
         */
        get: operations["getSandboxStatus"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/audit-log": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get recent audit log entries
         * @description Returns the last 100 audit log entries in reverse-chronological order, read from ~/.omnipus/system/audit.jsonl. Always returns an array — empty array when no entries exist.
         */
        get: operations["getAuditLog"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/audit-log": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get audit logging enable/disable state
         * @description Returns whether audit logging is currently enabled. Note: this is distinct from GET /api/v1/audit-log which returns entries. This endpoint controls the audit_log config flag.
         */
        get: operations["getAuditLogToggle"];
        /**
         * Enable or disable audit logging (admin only)
         * @description Persists sandbox.audit_log to config.json. Requires restart — the response includes applied_enabled which reflects the value before this save (currently running state). Changes are audit-logged before disabling.
         */
        put: operations["updateAuditLogToggle"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/retention": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get session retention configuration
         * @description Returns session_days and disabled flag from storage.retention.
         */
        get: operations["getRetention"];
        /**
         * Update session retention configuration (admin only)
         * @description Partial update — any subset of session_days and disabled. session_days must be a non-negative integer (floats and strings rejected). disabled must be a JSON boolean (string "true"/"false" rejected). Empty body is accepted as a no-op. Hot-reloaded (requires_restart: false). Admin-only (non-admin returns 403).
         */
        put: operations["updateRetention"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/security/retention/sweep": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Trigger on-demand retention sweep (admin only)
         * @description Immediately purges session directories older than the configured retention window. Returns 409 if a sweep is already in progress. Returns skipped_reason="disabled" when retention is disabled. Admin-only; emits audit with resource="storage.retention.sweep".
         */
        post: operations["triggerRetentionSweep"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List all channels
         * @description Returns the full list of communication channels with their ID, name, transport, enabled state, and description. webchat is always enabled.
         */
        get: operations["listChannels"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get a channel's configuration
         * @description Returns the channel's config with credential fields redacted (replaced with "[configured]" if set).
         */
        get: operations["getChannelConfig"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels/{id}/enable": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Enable a channel
         * @description Sets the channel's enabled flag to true in config.
         */
        put: operations["enableChannel"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels/{id}/disable": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Disable a channel
         * @description Sets the channel's enabled flag to false in config.
         */
        put: operations["disableChannel"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels/{id}/configure": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Configure a channel
         * @description Merges request body fields into the channel's config section. Fields absent from the request body are not touched (merge, not replace). The "enabled" field is reserved and ignored if sent. Returns the updated config with credential fields redacted.
         */
        put: operations["configureChannel"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels/{id}/test": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Test a channel configuration
         * @description Verifies required credential fields are configured without starting the channel. Returns success=false with missing field list if required credentials are absent.
         */
        post: operations["testChannel"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/channels/{id}/routing": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get channel routing configuration
         * @description Returns the routing configuration for the specified channel, including which agent handles its inbound messages.
         */
        get: operations["getChannelRouting"];
        /**
         * Set channel routing configuration
         * @description Sets the routing configuration for the specified channel. The default_agent_id field controls which agent handles inbound messages arriving on this channel. Omit it or leave it empty to fall back to the global default agent.
         */
        put: operations["setChannelRouting"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/config/gateway/rotate-token": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Rotate the gateway bearer token (admin only)
         * @description Generates a new cryptographically random 64-hex-character gateway bearer token, persists it to config.json, triggers a hot reload, and returns the new token. The previous token is immediately invalidated. Admin-only; secured by RequireAdmin + RequireNotBypass chain. Use after security incidents or on a regular rotation schedule.
         */
        post: operations["rotateGatewayToken"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/config/pending-restart": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get pending restart-gated config changes (admin only)
         * @description Returns an array of config keys whose persisted (disk) value differs from the boot-time applied value. Only RestartGatedKeys are checked; hot-reload keys never appear here. An empty array means no restart is needed. Admin-only; non-admin returns 403.
         */
        get: operations["getPendingRestart"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/workspace/{agent_id}/{path}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Read a file from an agent's workspace
         * @description Serves the file at the given path within the agent's workspace. Requires session-cookie-or-bearer authentication and ownership check. Returns 503 when the agent has no owner (ErrAgentOrphan). Path traversal beyond the agent workspace returns 403. Security headers: Referrer-Policy, Content-Security-Policy, X-Content-Type-Options. Files > 1MB are streamed; smaller files are buffered.
         */
        get: operations["getWorkspaceFile"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/preview/{agent_id}/{token}/{path}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Serve agent-generated preview content (token-auth)
         * @description Serves static files or proxies dev-server requests for the given agent and token. No bearer authentication required — the path token IS the credential (FR-023). Served on the separate preview listener (default port gateway.port + 1). Unknown or expired tokens return 404. Static files: path-traversal guard, MIME detection, buffered/streaming. Dev-server: reverse-proxied to loopback port with CSP injection.
         */
        get: operations["getPreview"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/credentials": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List credential key names
         * @description Lists all credential key names without values. Returns an empty array when no credentials are stored.
         */
        get: operations["listCredentials"];
        put?: never;
        /**
         * Add or update a credential
         * @description Stores an encrypted credential. The key must be non-empty. Returns 201 Created on success.
         */
        post: operations["setCredential"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/credentials/{key}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /**
         * Delete a credential
         * @description Removes a credential by key. Returns 404 if not found.
         */
        delete: operations["deleteCredential"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/backup": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Create a backup archive
         * @description Creates a tar.gz of ~/.omnipus/ excluding logs and backups directories. The archive is written atomically to ~/.omnipus/backups/.
         */
        post: operations["createBackup"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/backups": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List backup archives
         * @description Lists all .tar.gz files in ~/.omnipus/backups/ with filename, size, and creation time. Returns an empty array when no backups exist.
         */
        get: operations["listBackups"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/restore": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Restore from a backup archive
         * @description Extracts a backup tar.gz over ~/.omnipus/, skipping config.json to preserve current settings. The filename must not contain path separators or traversal sequences.
         */
        post: operations["restoreBackup"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/storage/stats": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get storage statistics
         * @description Returns session count, workspace size, and memory entry count. May include partial warnings if some agent stores could not be read.
         */
        get: operations["getStorageStats"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/sessions/all": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /**
         * Delete all sessions for all agents
         * @description Removes all session directories across all agent stores. Returns the count of removed sessions and any per-agent warnings.
         */
        delete: operations["clearAllSessions"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/status": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get gateway runtime status
         * @description Returns online status, agent/channel counts, daily cost, and the binary version.
         *     Polled by the SPA StatusBar every 15 seconds.
         */
        get: operations["getGatewayStatus"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/providers": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List configured LLM providers
         * @description Returns all configured LLM providers with connection status and available model list.
         *     Model lists are fetched live from each provider's upstream /models endpoint when an API key is present.
         */
        get: operations["listProviders"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/providers/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Add or update an LLM provider configuration
         * @description Adds or updates an LLM provider entry. On new providers, api_key is required. On existing providers, api_key may be omitted to keep the current key. The API key is stored encrypted (AES-256-GCM) in credentials.json. Available before and after onboarding.
         */
        put: operations["updateProvider"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/providers/{id}/test": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Test provider API key configuration
         * @description Verifies that an API key is configured for the given provider without making an upstream call. Returns success=false with an error message if no key is configured. Available before and after onboarding.
         */
        get: operations["testProvider"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/skills": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List installed skills
         * @description Returns all skills installed in ~/.omnipus/skills/. Returns an empty array when no skills are installed.
         */
        get: operations["listSkills"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/skills/install": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Install a skill from the ClawHub registry
         * @description Installs a skill by name from the ClawHub registry. Currently returns 501 Not Implemented while the registry integration is in progress.
         */
        post: operations["installSkill"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/chat": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Send a chat message via SSE
         * @description Sends a user message to the agent and streams the response via Server-Sent Events. The connection stays open until the agent finishes responding or the client disconnects.
         */
        post: operations["postChat"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/activity": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get recent activity events
         * @description Returns up to 50 activity events from the last 24 hours, sorted reverse-chronological.
         *     Includes session_start events from all agent stores and task lifecycle events.
         */
        get: operations["getActivity"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/upload": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Upload files for a session
         * @description Streams multipart file uploads to disk under ~/.omnipus/uploads/{session_id}/.
         *     Max file size per part: 100 MB. Data is streamed directly to disk; the full file is never buffered in memory.
         *     session_id may be supplied as a query parameter or as a form field before the file parts.
         *     Returns HTTP 201 on success.
         */
        post: operations["uploadFiles"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/state": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get application state
         * @description Returns onboarding status and optional diagnostic metadata. Available to all authenticated users.
         */
        get: operations["getAppState"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        /**
         * Update application state
         * @description Partial update to application state. Currently only supports marking onboarding complete. CSRF-protected.
         */
        patch: operations["patchAppState"];
        trace?: never;
    };
    "/user-context": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get user context (USER.md content)
         * @description Returns the current content of USER.md from the default workspace. This file holds workspace-level context about the user (background, preferences, etc.) that is prepended to agent prompts. Returns empty string when the file does not exist. Requires authentication.
         */
        get: operations["getUserContext"];
        /**
         * Set user context (replace USER.md content)
         * @description Replaces the entire content of USER.md in the default workspace with the provided string. Passing an empty string clears the file. The new content is returned in the response. Requires authentication.
         */
        put: operations["putUserContext"];
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/me": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get current user info
         * @description Returns the authenticated user's RBAC role. Used for SPA gating.
         */
        get: operations["getMe"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/doctor": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Get health check results
         * @description Returns the most recent health check results. Returns null when no health check has been run yet.
         */
        get: operations["getDoctorResults"];
        put?: never;
        /**
         * Run health check
         * @description Runs a fresh health check and returns the results.
         */
        post: operations["runDoctor"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/devices": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List devices
         * @description Returns pending pairing requests and already-paired devices. Admin-only.
         */
        get: operations["listDevices"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tasks": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List tasks
         * @description Returns all tasks, optionally filtered by status. Admin-only.
         */
        get: operations["listTasks"];
        put?: never;
        /**
         * Create a task
         * @description Creates a new task. Admin-only.
         */
        post: operations["createTask"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tasks/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        /**
         * Update a task
         * @description Updates task fields. Admin-only.
         */
        put: operations["updateTask"];
        post?: never;
        /**
         * Delete a task
         * @description Deletes a task by ID. Admin-only.
         */
        delete: operations["deleteTask"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tasks/{id}/subtasks": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List subtasks
         * @description Returns all subtasks for a given parent task. Admin-only.
         */
        get: operations["listSubtasks"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tasks/{id}/start": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        /**
         * Start a task
         * @description Assigns and starts a queued task. Admin-only.
         */
        post: operations["startTask"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/mcp-servers": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List MCP servers
         * @description Returns all configured MCP servers and their connection status.
         */
        get: operations["listMcpServers"];
        put?: never;
        /**
         * Add an MCP server
         * @description Adds a new MCP server to the gateway config. Admin-only.
         */
        post: operations["addMcpServer"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/mcp-servers/{id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        get?: never;
        put?: never;
        post?: never;
        /**
         * Delete an MCP server
         * @description Removes an MCP server from the gateway config. Admin-only.
         */
        delete: operations["deleteMcpServer"];
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/mcp-servers/{id}/tools": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List tools for an MCP server
         * @description Returns the list of tool names exposed by a specific MCP server.
         */
        get: operations["listMcpServerTools"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/tools/mcp": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * List all configured MCP servers
         * @description Returns all configured MCP servers with their status and tool metadata for the agent tool picker UI. Requires authentication.
         */
        get: operations["listMcpTools"];
        put?: never;
        /**
         * Invoke a tool on an MCP server
         * @description Calls a named tool on a specific MCP server and returns the result. Requires authentication. The tool and server must already be configured and enabled. Arguments are tool-specific.
         */
        post: operations["callMcpTool"];
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/uploads/{session_id}/{filename}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Serve an uploaded file
         * @description Serves a previously uploaded file by session ID and filename. Authentication is optional — browsers must be able to load image URLs directly from chat messages. Returns the file content with the appropriate Content-Type header.
         */
        get: operations["serveUpload"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
    "/media/{ref_id}": {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        /**
         * Serve a media file by ref ID
         * @description Resolves a media:// URI (e.g. media://abc123) and streams the underlying file with the correct Content-Type. Used by the chat UI to display screenshots and other agent-generated media. Returns 403 if path traversal is detected in ref_id, 404 if the ref is unknown.
         */
        get: operations["serveMedia"];
        put?: never;
        post?: never;
        delete?: never;
        options?: never;
        head?: never;
        patch?: never;
        trace?: never;
    };
}
export type webhooks = Record<string, never>;
export interface components {
    schemas: {
        /** @description Standard error envelope returned by all non-2xx responses. */
        ErrorResponse: {
            /**
             * @description Human-readable error message.
             * @example user not found
             */
            error: string;
            /**
             * @description Machine-readable error code for programmatic branching (e.g. "csrf_missing", "rate_limited").
             * @example csrf_missing
             */
            code?: string;
            /** @description Optional structured details about the error. */
            details?: {
                [key: string]: unknown;
            };
        };
        /** @description Credentials for authenticating an existing user. */
        LoginRequest: {
            /**
             * @description The user's login name.
             * @example admin
             */
            username: string;
            /**
             * @description The user's password. Maximum 72 characters (bcrypt limit).
             * @example s3cr3tpassword
             */
            password: string;
        };
        /** @description Returned on successful login, register-admin, or onboarding/complete. Contains the bearer token to use in subsequent Authorization headers, the role of the authenticated user, and the username. */
        LoginResponse: {
            token: components["schemas"]["BearerToken"];
            /**
             * @description RBAC role of the authenticated user.
             * @example admin
             * @enum {string}
             */
            role: "admin" | "user";
            /**
             * @description The authenticated user's login name.
             * @example admin
             */
            username: string;
            /**
             * @description Non-fatal advisory message. Present on onboarding/complete when the credential store is locked and the API key was stored in plaintext.
             * @example API key stored in plaintext — set OMNIPUS_MASTER_KEY for encrypted storage
             */
            warning?: string;
        };
        /** @description Body for POST /auth/register-admin. Creates the first admin user (fails 409 if one already exists). */
        RegisterAdminRequest: {
            /**
             * @description Must start with an alphanumeric character and contain only letters, digits, dots, dashes, and underscores. Length 2-63 characters.
             * @example admin
             */
            username: string;
            /**
             * @description Password for the new admin account. Minimum 8 characters, maximum 72 (bcrypt limit).
             * @example s3cr3tpassword
             */
            password: string;
        };
        /** @description Body for POST /auth/change-password. Changes the authenticated user's own password. */
        ChangePasswordRequest: {
            /**
             * @description The user's current password for verification. Maximum 72 characters (bcrypt limit).
             * @example oldpassword
             */
            current_password: string;
            /**
             * @description The new password. Minimum 8 characters, maximum 72 (bcrypt limit).
             * @example newpassword123
             */
            new_password: string;
        };
        /** @description Body for POST /onboarding/complete. Atomically sets up the first LLM provider and creates the initial admin account. CSRF-exempt (no cookie exists at this point). */
        OnboardingCompleteRequest: {
            /** @description LLM provider configuration to persist. */
            provider: {
                /**
                 * @description Provider protocol identifier (e.g. "anthropic", "openai", "openrouter", "gemini"). Must be a known protocol; unknown values are rejected with 400.
                 * @example anthropic
                 */
                id: string;
                /**
                 * @description API key for the provider. Stored encrypted (AES-256-GCM) in credentials.json.
                 * @example sk-ant-...
                 */
                api_key: string;
                /**
                 * @description Default model to use for this provider. When omitted, a sensible default is chosen per provider (e.g. "claude-sonnet-4-6" for anthropic, "gpt-4o" for openai).
                 * @example claude-sonnet-4-6
                 */
                model?: string;
            };
            /** @description Initial admin account credentials. */
            admin: {
                /**
                 * @description Admin login name.
                 * @example admin
                 */
                username: string;
                /**
                 * @description Admin password. Minimum 8 characters.
                 * @example s3cr3tpassword
                 */
                password: string;
            };
        };
        OnboardingCompleteResponse: components["schemas"]["LoginResponse"];
        /** @description Body for POST /onboarding/probe-provider. Tests an API key against a provider and returns available models. Non-persistent — nothing is written to disk. CSRF-exempt. Returns 409 once onboarding is complete. */
        ProbeProviderRequest: {
            /**
             * @description Provider protocol identifier. Must be one of the recognized protocol names that Omnipus can connect to. Validated server-side against the known protocol registry (pkg/providers.IsKnownProtocol).
             * @example openrouter
             * @enum {string}
             */
            id: "anthropic" | "anthropic-messages" | "openai" | "openrouter" | "gemini" | "google" | "ollama" | "azure" | "azure-openai" | "bedrock" | "litellm" | "groq" | "zhipu" | "nvidia" | "moonshot" | "shengsuanyun" | "deepseek" | "cerebras" | "vivgrid" | "volcengine" | "vllm" | "qwen" | "qwen-intl" | "qwen-international" | "dashscope-intl" | "qwen-us" | "dashscope-us" | "mistral" | "avian" | "longcat" | "modelscope" | "novita" | "coding-plan" | "alibaba-coding" | "qwen-coding" | "mimo" | "minimax" | "coding-plan-anthropic" | "alibaba-coding-anthropic" | "antigravity" | "claude-cli" | "claudecli" | "codex-cli" | "codexcli" | "github-copilot" | "copilot";
            /**
             * @description API key to test against the provider.
             * @example sk-or-...
             */
            api_key: string;
            /**
             * @description Optional override for the provider's API base URL. When omitted, the server uses the provider's well-known default endpoint.
             * @example https://openrouter.ai/api/v1
             */
            endpoint?: string;
        };
        /** @description Response from POST /onboarding/probe-provider. Always HTTP 200. success=true means the API key was accepted; success=false means the upstream rejected it (the error field explains why). */
        ProbeProviderResponse: {
            /**
             * @description Whether the provider accepted the API key.
             * @example true
             */
            success: boolean;
            /**
             * @description List of model IDs returned by the provider. Present only when success=true.
             * @example [
             *       "anthropic/claude-3.5-haiku",
             *       "openai/gpt-4o"
             *     ]
             */
            models?: string[];
            /**
             * @description Human-readable error from the upstream provider. Present only when success=false.
             * @example 401 unauthorized
             */
            error?: string;
        };
        /** @description Represents a gateway user account as returned by GET /users and POST /users. Password hashes and token hashes are NEVER included in responses — only the boolean presence flags are exposed. */
        User: {
            /**
             * @description Login name. Immutable after creation.
             * @example alice
             */
            username: string;
            /**
             * @description RBAC role. Case-sensitive.
             * @example admin
             * @enum {string}
             */
            role: "admin" | "user";
            /**
             * @description True when the user's password_hash is non-empty (i.e. a password has been set).
             * @example true
             */
            has_password: boolean;
            /**
             * @description True when the user's token_hash is non-empty (i.e. a bearer token is currently issued).
             * @example true
             */
            has_active_token: boolean;
        };
        /** @description Body for POST /users. Creates a new user account. Admin-only. */
        UserCreateRequest: {
            /**
             * @description Must start with an alphanumeric and contain only letters, digits, dots, dashes, and underscores. Length 2-63 characters.
             * @example alice
             */
            username: string;
            /**
             * @description RBAC role. Case-sensitive; exactly "admin" or "user".
             * @example user
             * @enum {string}
             */
            role: "admin" | "user";
            /**
             * @description Initial password. Minimum 8 characters, maximum 72 (bcrypt limit).
             * @example s3cr3tpassword
             */
            password: string;
        };
        /** @description Returned with HTTP 201 on successful POST /users. Contains the new user's identity fields. No token is issued — the user must log in explicitly. */
        UserCreateResponse: {
            /**
             * @description The created user's login name.
             * @example alice
             */
            username: string;
            /**
             * @description The created user's RBAC role.
             * @example user
             * @enum {string}
             */
            role: "admin" | "user";
            /**
             * @description Present and true when config was saved to disk but the in-memory hot-reload failed. The gateway must be restarted for the user to be able to log in.
             * @example false
             */
            requires_restart?: boolean;
            /**
             * @description Human-readable explanation when requires_restart is true.
             * @example config saved to disk but hot-reload failed; restart the gateway to apply
             */
            warning?: string;
        };
        /** @description Returned on successful DELETE /users/{username}. */
        UserDeleteResponse: {
            /**
             * @description The deleted user's login name.
             * @example alice
             */
            username: string;
            /**
             * @description Always true on success.
             * @example true
             */
            deleted: boolean;
            /**
             * @description Present and true when hot-reload failed after the deletion.
             * @example false
             */
            requires_restart?: boolean;
            /** @description Human-readable explanation when requires_restart is true. */
            warning?: string;
        };
        /** @description Body for PATCH /users/{username}/role. Changes a user's RBAC role. Admin-only. */
        UserRoleChangeRequest: {
            /**
             * @description New role. Case-sensitive; exactly "admin" or "user".
             * @example user
             * @enum {string}
             */
            role: "admin" | "user";
        };
        /** @description Returned on successful PATCH /users/{username}/role. */
        UserRoleChangeResponse: {
            /**
             * @description The affected user's login name.
             * @example alice
             */
            username: string;
            /**
             * @description The new role.
             * @example user
             * @enum {string}
             */
            role: "admin" | "user";
            /**
             * @description Present and true when hot-reload failed after the role change.
             * @example false
             */
            requires_restart?: boolean;
            /** @description Human-readable explanation when requires_restart is true. */
            warning?: string;
        };
        /** @description Body for PUT /users/{username}/password. Admin resets another user's password. This is NOT the self-change-password endpoint — that is POST /auth/change-password. After a successful reset the target user's bearer token is also invalidated, requiring them to log in again with the new password. */
        UserResetPasswordRequest: {
            /**
             * @description New password for the target user. Minimum 8 characters, maximum 72 (bcrypt limit).
             * @example newpassword123
             */
            password: string;
        };
        /** @description Returned on successful PUT /users/{username}/password. */
        UserResetPasswordResponse: {
            /**
             * @description The affected user's login name.
             * @example alice
             */
            username: string;
            /**
             * @description Always true on success.
             * @example true
             */
            password_reset: boolean;
            /**
             * @description Present and true when hot-reload failed after the password reset.
             * @example false
             */
            requires_restart?: boolean;
            /** @description Human-readable explanation when requires_restart is true. */
            warning?: string;
        };
        /** @description Session metadata object (maps to session.UnifiedMeta + session.SessionMeta). Returned in list and detail endpoints. The SPA maps this through rawToSession() which reads stats.message_count, stats.tokens_total, and stats.cost. */
        Session: {
            /**
             * @description Unique session identifier (UUID).
             * @example 550e8400-e29b-41d4-a716-446655440000
             */
            id: string;
            /**
             * @description Session classification. Legacy sessions without a type field are treated as "chat" by the SPA via rawToSession(). Defaults to "chat" on creation.
             * @example chat
             * @enum {string}
             */
            type?: "chat" | "task" | "channel";
            /**
             * @description ID of the primary agent that owns this session.
             * @example jim
             */
            agent_id: string;
            /**
             * @description Human-readable session title. May be auto-generated or user-renamed.
             * @example My chat session
             */
            title: string;
            /**
             * @description Current lifecycle status of the session.
             * @example active
             * @enum {string}
             */
            status: "active" | "archived" | "interrupted";
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the session was created.
             * @example 2026-05-16T10:00:00Z
             */
            created_at: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp of the last modification to session metadata or transcript.
             * @example 2026-05-16T10:05:30Z
             */
            updated_at: string;
            /**
             * @description LLM model name used in this session (may be empty for legacy sessions).
             * @example claude-sonnet-4-6
             */
            model?: string;
            /**
             * @description Provider identifier (e.g. "anthropic", "openai") for this session.
             * @example anthropic
             */
            provider?: string;
            stats: components["schemas"]["SessionStats"];
            /**
             * @description Associated project ID (optional, future v0.3 feature).
             * @example proj-123
             */
            project_id?: string;
            /**
             * @description Associated task ID when this session was created to service a task.
             * @example task-456
             */
            task_id?: string;
            /**
             * @description Channel identifier that initiated this session (e.g. "webchat", "telegram"). Always present (may be empty string for legacy sessions).
             * @example webchat
             */
            channel: string;
            /**
             * @description List of JSONL partition file names (e.g. ["2026-05-16.jsonl"]). Always present as an array (may be empty for new sessions with no messages). One partition per day, so 3650 covers ~10 years of daily partitions.
             * @example [
             *       "2026-05-16.jsonl"
             *     ]
             */
            partitions: string[];
            /**
             * @description Summary of the last context compaction pass (present only when compaction has occurred).
             * @example Compacted 120 messages to summary.
             */
            last_compaction_summary?: string;
            /**
             * @description All agent IDs that have participated in this session (multi-agent sessions). For legacy single-agent sessions this field is absent; callers should fall back to [agent_id] when agent_ids is undefined.
             * @example [
             *       "jim",
             *       "ava"
             *     ]
             */
            agent_ids?: string[];
            /**
             * @description The agent ID currently handling this session (multi-agent sessions only).
             * @example jim
             */
            active_agent_id?: string;
            /** @description Per-agent compaction summaries (multi-agent sessions only). */
            compaction_summaries?: {
                [key: string]: string;
            };
        };
        /** @description Aggregated statistics for a session transcript. */
        SessionStats: {
            /**
             * @description Total input tokens consumed across all messages in this session.
             * @example 1200
             */
            tokens_in: number;
            /**
             * @description Total output tokens generated across all messages in this session.
             * @example 450
             */
            tokens_out: number;
            /**
             * @description Sum of tokens_in and tokens_out.
             * @example 1650
             */
            tokens_total: number;
            /**
             * Format: double
             * @description Total USD cost for this session (based on provider pricing).
             * @example 0.0023
             */
            cost: number;
            /**
             * @description Total number of tool calls made in this session.
             * @example 3
             */
            tool_calls: number;
            /**
             * @description Number of transcript entries in this session.
             * @example 8
             */
            message_count: number;
        };
        /** @description Full session detail as returned by GET /sessions/{id}. Contains the session metadata plus the complete ordered transcript. */
        SessionDetail: {
            session: components["schemas"]["Session"];
            /** @description Ordered list of transcript entries for this session. Capped at 100000 messages to bound response payload size. */
            messages: components["schemas"]["Message"][];
            /**
             * @description True when the agent that owned this session has been deleted from the config. Used by the SPA to display a banner informing the user that the original agent no longer exists. Absent (or false) in the common case.
             * @example false
             */
            agent_removed?: boolean;
        };
        /** @description Body for POST /sessions. Creates a new session for an agent. */
        SessionCreateRequest: {
            /**
             * @description Agent ID that will own this session. Defaults to "main" when omitted. Must reference an existing agent (400 if not found).
             * @example jim
             */
            agent_id?: string;
            /**
             * @description Session type. Defaults to "chat" when omitted.
             * @example chat
             * @enum {string}
             */
            type?: "chat" | "task" | "channel";
        };
        /** @description Body for PUT /sessions/{id}. Renames a session. */
        SessionRenameRequest: {
            /**
             * @description New title for the session.
             * @example Refactoring project setup
             */
            title: string;
        };
        /** @description A single transcript entry (session.TranscriptEntry on the Go side). Maps to the Message interface in src/lib/api.ts. The SPA reads this from GET /sessions/{id}/messages. */
        Message: {
            /**
             * @description Unique message identifier.
             * @example msg_01HXYZ
             */
            id: string;
            /**
             * @description Entry classification. Absent or empty means "message" (backwards compatible). "compaction" entries summarize pruned context; "system" entries are internal markers; "tool_call" entries record tool invocations; "turn_canceled" entries mark a turn that was canceled mid-stream (FR-15). The Go-side EntryType constant set is the source of truth (`pkg/session/daypartition.go`).
             * @example message
             * @enum {string}
             */
            type?: "message" | "compaction" | "system" | "tool_call" | "turn_canceled";
            /**
             * @description Author role. Absent on compaction entries.
             * @example assistant
             * @enum {string}
             */
            role?: "user" | "assistant" | "system";
            /**
             * @description Raw markdown/text content of the message.
             * @example I can help you with that!
             */
            content?: string;
            /**
             * @description Compaction summary text (present only on type=compaction entries).
             * @example Compacted 120 messages.
             */
            summary?: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when this entry was recorded.
             * @example 2026-05-16T10:01:00Z
             */
            timestamp: string;
            /**
             * @description Token count for this entry (input + output). Absent when zero.
             * @example 150
             */
            tokens?: number;
            /**
             * Format: double
             * @description USD cost for this entry. Absent when zero.
             * @example 0.00045
             */
            cost?: number;
            /**
             * @description Completion status of this message turn.
             * @example ok
             * @enum {string}
             */
            status?: "ok" | "error" | "interrupted";
            /** @description File attachments associated with this message. */
            attachments?: components["schemas"]["Attachment"][];
            /** @description Tool invocations made during this message turn. */
            tool_calls?: components["schemas"]["ToolCall"][];
            /**
             * @description ID of the agent that produced this entry (FR-002). Always present.
             * @example jim
             */
            agent_id: string;
            /**
             * @description Number of messages compacted (present only on compaction entries).
             * @example 120
             */
            messages_compacted?: number;
            /**
             * @description Set to true on the last assistant entry when a turn is canceled mid-stream (FR-14). Only present when true. The SPA renders an "(interrupted)" suffix on the bubble when this is set.
             * @example true
             */
            truncated?: boolean;
            /**
             * @description Turn identifier — present only on type="turn_canceled" entries (FR-15). Identifies the turn that was canceled.
             * @example turn-T3
             */
            turn_id?: string;
            /**
             * @description Username of the actor who triggered the cancel — present only on type="turn_canceled" entries (FR-15).
             * @example admin
             */
            canceled_by_user?: string;
            /**
             * @description Channel that originated the cancel request — present only on type="turn_canceled" entries (FR-15).
             * @example webchat
             */
            canceled_by_channel?: string;
            /**
             * @description How the cancel was applied — present only on type="turn_canceled" entries (FR-15). "graceful" lets the in-flight tool finish; "hard" interrupts immediately.
             * @example graceful
             * @enum {string}
             */
            cancel_method?: "graceful" | "hard";
            /**
             * @description IDs of descendant turns that were canceled in cascade — present only on type="turn_canceled" entries (FR-6a).
             * @example [
             *       "turn-T3-sub-1"
             *     ]
             */
            descendants_canceled?: string[];
        };
        /** @description A single tool invocation recorded in a transcript entry. Maps to session.ToolCall on the Go side and ToolCall interface in src/lib/api.ts. */
        ToolCall: {
            /**
             * @description Unique tool call identifier (ToolCallID type on the Go side).
             * @example tc_01HXYZ
             */
            id: string;
            /**
             * @description Tool name as registered in the tool registry (e.g. "workspace.shell", "web_search").
             * @example workspace.shell
             */
            tool: string;
            /**
             * @description Outcome of the tool call.
             * @example success
             * @enum {string}
             */
            status: "success" | "error" | "pending" | "denied" | "running" | "cancelled";
            /**
             * Format: int64
             * @description Elapsed time in milliseconds. Absent when still running.
             * @example 234
             */
            duration_ms?: number;
            /**
             * @description Input parameters passed to the tool.
             * @example {
             *       "command": "ls -la"
             *     }
             */
            parameters?: {
                [key: string]: unknown;
            };
            /** @description Return value from the tool. Shape is tool-specific. */
            result?: {
                [key: string]: unknown;
            };
            /**
             * @description Parent tool call ID for nested subagent tool invocations.
             * @example tc_01HABC
             */
            parent_tool_call_id?: string;
        };
        /** @description File attachment associated with a transcript entry. */
        Attachment: {
            /**
             * @description Attachment category. Aligned with MediaPart.type enum.
             * @example file
             * @enum {string}
             */
            type: "image" | "audio" | "video" | "file";
            /**
             * @description Relative path within the session workspace.
             * @example output/result.txt
             */
            path: string;
            /**
             * Format: int64
             * @description File size in bytes.
             * @example 1024
             */
            size: number;
            /**
             * @description MIME type of the attachment.
             * @example text/plain
             */
            mime_type: string;
        };
        /** @description An agent configuration object as returned by GET /agents and GET /agents/{id}. Maps to the Go agentResponse struct and the TypeScript Agent interface in src/lib/api.ts. Core (locked) agents suppress soul/instructions in list responses and forbid identity mutations via PUT. */
        Agent: {
            /**
             * @description Unique agent identifier. UUID for custom agents; well-known strings for core agents (e.g. "jim").
             * @example 550e8400-e29b-41d4-a716-446655440000
             */
            id: string;
            /**
             * @description Human-readable display name.
             * @example Jim
             */
            name: string;
            /**
             * @description Agent classification. "core" = compiled-in identity locked agent. "custom" = user-defined agent. "system" = legacy operator-supplied entry (config.AgentTypeSystem survives in the API contract for backwards compatibility but SeedConfig does NOT create these — they only appear if config.json contains one).
             * @example core
             * @enum {string}
             */
            type: "core" | "custom" | "system";
            /**
             * @description When true, name, description, soul, heartbeat, and instructions are immutable via the PUT /agents/{id} endpoint. Core agents are always locked.
             * @example false
             */
            locked: boolean;
            /**
             * @description Hex color code for agent avatar display (e.g. "#D4AF37").
             * @example #D4AF37
             */
            color?: string;
            /**
             * @description Phosphor icon name for agent avatar (e.g. "Robot", "Octopus").
             * @example Robot
             */
            icon?: string;
            /**
             * @description Model name string used for LLM calls (resolved from defaults when not explicitly set on the agent). May be "provider/model" format for OpenRouter.
             * @example claude-sonnet-4-6
             */
            model?: string;
            /**
             * @description Short description of the agent's purpose.
             * @example General-purpose coding assistant
             */
            description?: string;
            /**
             * @description Current runtime status. "active" = agent is processing a turn. "idle" = ready and waiting. "draft" = SOUL.md is empty (no prompt written yet). "error" is a frontend-added possibility not emitted by the backend today.
             * @example idle
             * @enum {string}
             */
            status: "active" | "idle" | "draft" | "error";
            /**
             * @description Contents of SOUL.md — the agent's system prompt. Empty string for locked core agents (prompt is compiled in, not exposed via API). Empty string for draft agents (no SOUL.md written yet). Always present (never null).
             * @example You are Jim, a senior software engineer...
             */
            soul: string;
            /**
             * @description Contents of HEARTBEAT.md — periodic background instructions. Empty string when not set. Always present on detail responses (never null).
             * @example Every hour, check for new tasks in the queue.
             */
            heartbeat: string;
            /**
             * @description Body of AGENT.md (everything after the closing frontmatter delimiter) — additional runtime instructions. Empty string when not set. Always present on detail responses (never null).
             * @example Focus on TypeScript and Go projects only.
             */
            instructions: string;
            /**
             * @description Non-fatal advisory (e.g. config reload failed after create/update).
             * @example config reload failed: ...
             */
            warning?: string;
            /**
             * @description Maximum seconds a single agent turn may run before being interrupted. Inherited from agents.defaults.timeout_seconds when not overridden per-agent.
             * @example 300
             */
            timeout_seconds: number;
            /**
             * @description Maximum number of tool calls allowed per turn. Inherited from agents.defaults.max_tool_iterations when not overridden.
             * @example 50
             */
            max_tool_iterations: number;
            /**
             * @description Tool execution steering strategy. "one-at-a-time" = approve each tool call individually. Other values are provider-specific. Defaults to "one-at-a-time".
             * @example one-at-a-time
             */
            steering_mode: string;
            /**
             * @description When true, tool results are echoed back to the LLM as user messages (tool feedback loop enabled).
             * @example true
             */
            tool_feedback: boolean;
            /**
             * @description Whether the HEARTBEAT.md periodic instruction loop is active for this agent.
             * @example false
             */
            heartbeat_enabled: boolean;
            /**
             * @description Interval in seconds between heartbeat passes.
             * @example 3600
             */
            heartbeat_interval: number;
            tools_cfg?: components["schemas"]["AgentToolsCfg"];
            /**
             * @description Kernel sandbox profile applied to this agent's tool calls. "workspace" = Landlock to workspace dir only. "workspace+net" = Landlock + network access. "host" = read-only host filesystem access. "off" = god-mode (requires --allow-god-mode at gateway boot).
             * @example workspace
             * @enum {string}
             */
            sandbox_profile?: "workspace" | "workspace+net" | "host" | "off";
            shell_policy?: components["schemas"]["AgentShellPolicy"];
            /**
             * @description Ordered list of fallback model IDs tried when the primary model returns an error. Each entry may be a bare model name or "provider/model" format.
             * @example [
             *       "anthropic/claude-3.5-haiku"
             *     ]
             */
            fallback_models?: string[];
            model_params?: components["schemas"]["AgentModelParams"];
            rate_limits?: components["schemas"]["AgentRateLimits"];
            stats?: components["schemas"]["AgentStats"];
            /**
             * @description Whether this agent is the global default that handles inbound messages with no more-specific routing rule. At most one agent is default.
             * @example false
             */
            default?: boolean;
        };
        /**
         * AgentModelParams
         * @description LLM sampling parameters applied to an agent's requests. When absent, the provider defaults are used.
         */
        AgentModelParams: {
            /**
             * Format: double
             * @description Sampling temperature (0.0 – 2.0). Lower = more deterministic.
             * @example 1
             */
            temperature?: number;
            /**
             * @description Maximum tokens to generate per turn.
             * @example 4096
             */
            max_tokens?: number;
            /**
             * Format: double
             * @description Nucleus sampling probability mass. 1.0 disables nucleus sampling.
             * @example 1
             */
            top_p?: number;
        };
        /**
         * AgentRateLimits
         * @description Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies and per-agent overrides are ignored.
         */
        AgentRateLimits: {
            /**
             * @description When true, global rate limits are used and per-agent overrides are ignored.
             * @example true
             */
            use_global_defaults?: boolean;
            /**
             * @description Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
             * @example 100
             */
            max_llm_calls_per_hour?: number;
            /**
             * @description Maximum tool calls per minute for this agent. Absent = no per-agent cap.
             * @example 60
             */
            max_tool_calls_per_minute?: number;
            /**
             * Format: double
             * @description Maximum USD cost per day for this agent. Absent = no per-agent cap.
             * @example 5
             */
            max_cost_per_day?: number;
        };
        /**
         * AgentStats
         * @description Aggregate runtime statistics for an agent. Absent on the Agent object when no sessions have been run.
         */
        AgentStats: {
            /**
             * @description Lifetime count of sessions created for this agent.
             * @example 42
             */
            total_sessions: number;
            /**
             * @description Lifetime token count across all sessions.
             * @example 1500000
             */
            total_tokens: number;
            /**
             * Format: double
             * @description Lifetime USD cost across all sessions.
             * @example 3.14
             */
            total_cost: number;
            /**
             * Format: date-time
             * @description RFC3339 timestamp of the last turn completed by this agent.
             * @example 2026-05-17T14:23:00Z
             */
            last_active?: string;
        };
        /**
         * AgentShellPolicy
         * @description Per-agent shell command deny-pattern configuration.
         */
        AgentShellPolicy: {
            /**
             * @description Enable pattern-based shell command blocking.
             * @example true
             */
            enable_deny_patterns?: boolean;
            /**
             * @description Additional Go regexp patterns to block in shell commands.
             * @example [
             *       "rm -rf /",
             *       "curl.*169\\.254"
             *     ]
             */
            custom_deny_patterns?: string[];
        };
        /** @description Per-agent tool configuration governing which builtin tools are accessible and which MCP servers are bound (config.AgentToolsCfg on the Go side, AgentToolsCfg interface in src/lib/api.ts). */
        AgentToolsCfg: {
            /** @description Controls builtin tool visibility for this agent. */
            builtin?: {
                /**
                 * @description Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
                 * @example allow
                 * @enum {string}
                 */
                default_policy?: "allow" | "ask" | "deny";
                /**
                 * @description Per-tool policy overrides. Keys are tool names or glob patterns (e.g. "system.*", "workspace.shell"). Values are one of "allow", "ask", "deny".
                 * @example {
                 *       "system.*": "deny",
                 *       "workspace.shell": "ask"
                 *     }
                 */
                policies?: {
                    [key: string]: "allow" | "ask" | "deny";
                };
            };
            /** @description MCP server bindings for this agent. */
            mcp?: {
                /** @description List of MCP server bindings. */
                servers?: {
                    /**
                     * @description MCP server identifier as registered in config.json.
                     * @example my-mcp-server
                     */
                    id: string;
                    /**
                     * @description Specific tool names to expose from this server. When absent, all tools from the server are available.
                     * @example [
                     *       "search",
                     *       "fetch"
                     *     ]
                     */
                    tools?: string[];
                }[];
            };
        };
        /**
         * AgentToolsUpdateRequest
         * @description Request body for PUT /api/v1/agents/{id}/tools. Replaces the agent's tool policy configuration. Supports both the current policy format (builtin.default_policy + builtin.policies) and the legacy explicit/inherit mode format (builtin.mode + builtin.visible) for backward compatibility. Legacy fields are converted to policy format server-side before persisting.
         */
        AgentToolsUpdateRequest: {
            /** @description Builtin tool policy configuration for this agent. */
            builtin?: {
                /**
                 * @description Fallback policy applied to any builtin tool not listed in policies. Defaults to "allow" when omitted.
                 * @enum {string}
                 */
                default_policy?: "allow" | "ask" | "deny";
                /** @description Per-tool policy overrides. Keys are canonical tool names or glob patterns (e.g. "system.*"). Values are "allow", "ask", or "deny". */
                policies?: {
                    [key: string]: "allow" | "ask" | "deny";
                };
                /**
                 * @description Legacy format: "explicit" builds a deny-all policy with allow entries for each name in visible[]. "inherit" sets default_policy=allow. Ignored when default_policy is present.
                 * @enum {string}
                 */
                mode?: "explicit" | "inherit";
                /** @description Legacy format: tool names to allow when mode="explicit". Ignored when default_policy is present. */
                visible?: string[];
            };
            /** @description MCP server bindings for this agent. */
            mcp?: {
                /** @description List of MCP server bindings. */
                servers?: {
                    /** @description MCP server identifier as registered in config.json. */
                    id: string;
                    /** @description Specific tool names to expose from this server. When absent, all tools from the server are available. */
                    tools?: string[];
                }[];
            };
        };
        /** @description Body for POST /agents. Creates a new custom agent. A UUID is assigned by the server. The agent starts in "draft" status (no SOUL.md written yet). */
        AgentCreateRequest: {
            /**
             * @description Display name for the new agent.
             * @example My Custom Agent
             */
            name: string;
            /**
             * @description Short description of the agent's purpose.
             * @example Specialized data analysis assistant
             */
            description?: string;
            /**
             * @description Model name for LLM calls. When omitted, the global agents.defaults.model_name is used.
             * @example claude-sonnet-4-6
             */
            model?: string;
            /**
             * @description Hex color code for the agent avatar.
             * @example #D4AF37
             */
            color?: string;
            /**
             * @description Phosphor icon name for the agent avatar.
             * @example ChartBar
             */
            icon?: string;
            tools_cfg?: components["schemas"]["AgentToolsCfg"];
            /**
             * @description Ordered list of fallback model IDs tried when the primary model returns an error. Each entry may be a bare model name or "provider/model" format.
             * @example [
             *       "anthropic/claude-3.5-haiku"
             *     ]
             */
            fallback_models?: string[];
            /** @description LLM sampling parameters applied to this agent's requests. */
            model_params?: {
                /**
                 * Format: double
                 * @description Sampling temperature (0.0 – 2.0). Lower = more deterministic.
                 * @example 1
                 */
                temperature?: number;
                /**
                 * @description Maximum tokens to generate per turn.
                 * @example 4096
                 */
                max_tokens?: number;
                /**
                 * Format: double
                 * @description Nucleus sampling probability mass. 1.0 disables nucleus sampling.
                 * @example 1
                 */
                top_p?: number;
            };
            /** @description Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies. */
            rate_limits?: {
                /**
                 * @description When true, global rate limits are used and per-agent overrides are ignored.
                 * @example true
                 */
                use_global_defaults?: boolean;
                /**
                 * @description Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
                 * @example 100
                 */
                max_llm_calls_per_hour?: number;
                /**
                 * @description Maximum tool calls per minute for this agent. Absent = no per-agent cap.
                 * @example 60
                 */
                max_tool_calls_per_minute?: number;
                /**
                 * Format: double
                 * @description Maximum USD cost per day for this agent. Absent = no per-agent cap.
                 * @example 5
                 */
                max_cost_per_day?: number;
            };
        };
        /** @description Body for PUT /agents/{id}. All fields are optional — only provided fields are updated. Locked (core) agents reject mutations to name, description, soul, heartbeat, instructions. model, timeout_seconds, max_tool_iterations, steering_mode, tool_feedback, heartbeat_enabled, and heartbeat_interval may be updated on locked agents. At least one field must be present (minProperties: 1) — empty patches are rejected 400. */
        AgentUpdateRequest: {
            /**
             * @description New display name. Rejected on locked agents.
             * @example My Renamed Agent
             */
            name?: string;
            /**
             * @description New description. Rejected on locked agents. Empty string removes it.
             * @example Updated description
             */
            description?: string;
            /**
             * @description New model name. Allowed on all agents.
             * @example gpt-4o
             */
            model?: string;
            /**
             * @description New SOUL.md content (agent system prompt). Rejected on locked agents. Writing this triggers a config reload.
             * @example You are a helpful assistant...
             */
            soul?: string;
            /**
             * @description New HEARTBEAT.md content. Rejected on locked agents. Writing this triggers a config reload.
             * @example Check queue every hour.
             */
            heartbeat?: string;
            /**
             * @description New AGENT.md body (after frontmatter). Rejected on locked agents. Writing this triggers a config reload.
             * @example Focus on Python only.
             */
            instructions?: string;
            /**
             * @description New timeout in seconds per turn. Allowed on all agents.
             * @example 600
             */
            timeout_seconds?: number;
            /**
             * @description New maximum tool calls per turn. Allowed on all agents.
             * @example 100
             */
            max_tool_iterations?: number;
            /**
             * @description New steering mode. Allowed on all agents.
             * @example one-at-a-time
             */
            steering_mode?: string;
            /**
             * @description Enable/disable tool feedback loop. Allowed on all agents.
             * @example true
             */
            tool_feedback?: boolean;
            /**
             * @description Enable/disable heartbeat loop. Allowed on all agents.
             * @example false
             */
            heartbeat_enabled?: boolean;
            /**
             * @description New heartbeat interval in seconds. Allowed on all agents.
             * @example 1800
             */
            heartbeat_interval?: number;
            /**
             * @description New sandbox profile. "off" requires --allow-god-mode at gateway boot (403 otherwise).
             * @example workspace
             * @enum {string}
             */
            sandbox_profile?: "workspace" | "workspace+net" | "host" | "off";
            /** @description Per-agent shell command deny-pattern configuration. */
            shell_policy?: {
                /** @example true */
                enable_deny_patterns?: boolean;
                /**
                 * @description Must each be valid Go regexp patterns (400 on invalid regexp).
                 * @example [
                 *       "rm -rf /"
                 *     ]
                 */
                custom_deny_patterns?: string[];
            };
            /**
             * @description Hex color code for agent avatar display (e.g. "#D4AF37").
             * @example #D4AF37
             */
            color?: string;
            /**
             * @description Phosphor icon name for agent avatar (e.g. "Robot", "Octopus").
             * @example Robot
             */
            icon?: string;
            /**
             * @description Ordered list of fallback model IDs tried when the primary model returns an error. Each entry may be a bare model name or "provider/model" format.
             * @example [
             *       "anthropic/claude-3.5-haiku"
             *     ]
             */
            fallback_models?: string[];
            /** @description LLM sampling parameters applied to this agent's requests. */
            model_params?: {
                /**
                 * Format: double
                 * @description Sampling temperature (0.0 – 2.0). Lower = more deterministic.
                 * @example 1
                 */
                temperature?: number;
                /**
                 * @description Maximum tokens to generate per turn.
                 * @example 4096
                 */
                max_tokens?: number;
                /**
                 * Format: double
                 * @description Nucleus sampling probability mass. 1.0 disables nucleus sampling.
                 * @example 1
                 */
                top_p?: number;
            };
            /** @description Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies. */
            rate_limits?: {
                /**
                 * @description When true, global rate limits are used and per-agent overrides are ignored.
                 * @example true
                 */
                use_global_defaults?: boolean;
                /**
                 * @description Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
                 * @example 100
                 */
                max_llm_calls_per_hour?: number;
                /**
                 * @description Maximum tool calls per minute for this agent. Absent = no per-agent cap.
                 * @example 60
                 */
                max_tool_calls_per_minute?: number;
                /**
                 * Format: double
                 * @description Maximum USD cost per day for this agent. Absent = no per-agent cap.
                 * @example 5
                 */
                max_cost_per_day?: number;
            };
            tools_cfg?: components["schemas"]["AgentToolsCfg"];
            /**
             * @description Whether this agent is the global default that handles inbound messages with no more-specific routing rule. At most one agent is default. Omitting this field leaves the flag unchanged.
             * @example false
             */
            default?: boolean;
        };
        /** @description Minimal session summary as returned by GET /agents/{id}/sessions. Maps to the AgentSession interface in src/lib/api.ts. This is the same underlying session.UnifiedMeta object, but the SPA consumes it through the AgentSession interface which reads id, title, created_at, and updated_at directly. */
        AgentSession: {
            /**
             * @description Session identifier.
             * @example 550e8400-e29b-41d4-a716-446655440000
             */
            id: string;
            /**
             * @description Session title.
             * @example My chat session
             */
            title: string;
            /**
             * Format: date-time
             * @description RFC3339 creation timestamp.
             * @example 2026-05-16T10:00:00Z
             */
            created_at: string;
            /**
             * Format: date-time
             * @description RFC3339 last-update timestamp.
             * @example 2026-05-16T10:05:30Z
             */
            updated_at: string;
        };
        /** @description Body for PUT /security/session-scope. Updates the DM session scoping strategy. */
        SessionScopeRequest: {
            /**
             * @description New DM session scoping strategy. Must be exactly one of the four canonical values. Changes are saved to disk immediately but require a gateway restart to apply (requires_restart will be true in the response).
             * @example per-channel-peer
             * @enum {string}
             */
            dm_scope: "main" | "per-peer" | "per-channel-peer" | "per-account-channel-peer";
        };
        /** @description Response from GET /security/session-scope. */
        SessionScopeResponse: {
            /**
             * @description Current DM session scoping strategy. Controls how incoming direct messages are routed to session threads. Changes require a gateway restart to take effect.
             * @example per-channel-peer
             * @enum {string}
             */
            dm_scope: "main" | "per-peer" | "per-channel-peer" | "per-account-channel-peer";
        };
        /**
         * ToolRegistryEntry
         * @description A single entry in the central tool registry snapshot returned by GET /api/v1/tools (FR-027).
         */
        ToolRegistryEntry: {
            /**
             * @description Canonical tool name (e.g. "workspace.shell", "browser.navigate").
             * @example workspace.shell
             */
            name: string;
            /**
             * @description Human-readable description of what the tool does.
             * @example Run a shell command in the agent workspace.
             */
            description: string;
            /**
             * @description Tool visibility scope.
             * @example general
             * @enum {string}
             */
            scope: "system" | "core" | "general";
            /**
             * @description Tool category prefix derived from the tool name (e.g. "workspace", "browser", "system") or "general".
             * @example workspace
             */
            category: string;
            /**
             * @description Origin of the tool registration. "builtin" = compiled-in Go tool; "mcp" = MCP server tool.
             * @example builtin
             * @enum {string}
             */
            source: "builtin" | "mcp";
        };
        /**
         * AgentToolEntry
         * @description Per-tool entry returned by GET /api/v1/agents/{id}/tools (FR-086, MAJ-008). Exposes both the configured policy and the effective (post-fence) policy so the SPA can display policy downgrades.
         */
        AgentToolEntry: {
            /**
             * @description Canonical tool name.
             * @example workspace.shell
             */
            name: string;
            /**
             * @description The policy as written in the agent's config (before fence application).
             * @example allow
             * @enum {string}
             */
            configured_policy: "allow" | "ask" | "deny";
            /**
             * @description The policy actually enforced at LLM-call time after fence and global policy overrides are applied.
             * @example ask
             * @enum {string}
             */
            effective_policy: "allow" | "ask" | "deny";
            /**
             * @description True when the tool requires admin approval (RequiresAdminAsk=true), the agent type is "custom", and the configured policy was "allow" but was downgraded to "ask" by the admin-ask fence (FR-061).
             * @example true
             */
            fence_applied: boolean;
            /**
             * @description True when the tool's RequiresAdminAsk() returns true — the tool always needs an admin to approve its use.
             * @example true
             */
            requires_admin_ask: boolean;
        };
        /**
         * ToolPolicy
         * @description A policy value governing whether a tool call is allowed, requires approval, or is denied.
         * @example allow
         * @enum {string}
         */
        ToolPolicy: "allow" | "ask" | "deny";
        /**
         * GlobalToolPolicies
         * @description Global tool policy configuration returned by GET /api/v1/security/tool-policies and accepted by PUT /api/v1/security/tool-policies.
         */
        GlobalToolPolicies: {
            /**
             * @description Default policy for any tool not listed in policies.
             * @example allow
             * @enum {string}
             */
            default_policy: "allow" | "ask" | "deny";
            /**
             * @description Per-tool policy overrides. Keys are canonical tool names; values are the policy to apply. Never null — empty object when no overrides are configured.
             * @example {
             *       "exec": "ask",
             *       "browser.evaluate": "deny"
             *     }
             */
            policies: {
                [key: string]: "allow" | "ask" | "deny";
            };
        };
        /**
         * ChannelId
         * @description Stable identifier for a built-in channel.
         * @enum {string}
         */
        ChannelId: "webchat" | "telegram" | "discord" | "slack" | "whatsapp" | "feishu" | "dingtalk" | "wecom" | "weixin" | "line" | "qq" | "onebot" | "irc" | "matrix" | "maixcam";
        /**
         * ChannelEntry
         * @description A communication channel entry returned by GET /api/v1/channels.
         */
        ChannelEntry: {
            /**
             * @description Canonical channel identifier.
             * @example telegram
             */
            id: components["schemas"]["ChannelId"];
            /**
             * @description Human-readable channel name.
             * @example Telegram
             */
            name: string;
            /**
             * @description Transport mechanism used by this channel.
             * @example webhook
             * @enum {string}
             */
            transport: "websocket" | "webhook" | "bridge" | "tcp" | "http" | "serial";
            /**
             * @description Whether this channel is currently enabled.
             * @example false
             */
            enabled: boolean;
            /**
             * @description Short description of the channel.
             * @example Telegram Bot API
             */
            description: string;
        };
        /**
         * RetentionConfig
         * @description Session log retention configuration returned by GET /api/v1/security/retention.
         */
        RetentionConfig: {
            /**
             * @description Number of days to retain session logs. 0 means use the system default (90 days). Only present when a custom retention period is set.
             * @example 30
             */
            session_days?: number;
            /**
             * @description When true, retention sweeps are disabled and session logs are kept forever.
             * @example false
             */
            disabled?: boolean;
        };
        /**
         * RetentionSweepResult
         * @description Result of a POST /api/v1/security/retention/sweep on-demand sweep operation.
         */
        RetentionSweepResult: {
            /**
             * @description Number of session directories removed during the sweep.
             * @example 3
             */
            removed: number;
            /**
             * @description Present when the sweep was skipped without removing anything. Currently only "disabled" (retention is configured as disabled).
             * @example disabled
             */
            skipped_reason?: string;
        };
        /**
         * SandboxConfig
         * @description Sandbox configuration returned by GET /api/v1/security/sandbox-config and as part of PUT /api/v1/security/sandbox-config responses.
         */
        SandboxConfig: {
            /**
             * @description Configured sandbox enforcement mode.
             * @example enforce
             * @enum {string}
             */
            mode?: "off" | "permissive" | "enforce";
            /**
             * @description The mode the gateway is currently enforcing. Differs from `mode` when the operator saved a change but has not restarted yet.
             * @example permissive
             */
            applied_mode?: string;
            /**
             * @description Whether outbound network access is permitted from the sandbox.
             * @example false
             */
            allow_network_outbound?: boolean;
            /**
             * @description File system paths the sandboxed process may access. Empty array means use only default allowed paths.
             * @example [
             *       "/tmp/workspace"
             *     ]
             */
            allowed_paths?: string[];
            /**
             * @description Whether SSRF (server-side request forgery) protection is active.
             * @example true
             */
            ssrf_enabled?: boolean;
            /**
             * @description IP addresses, hostnames, or CIDR ranges that are allowed to receive outbound requests even when SSRF protection is enabled. Empty array means block all internal addresses.
             * @example [
             *       "192.168.1.100"
             *     ]
             */
            ssrf_allow_internal?: string[];
            /** @description Nested SSRF config block for backward-compatible clients. */
            ssrf?: {
                enabled?: boolean;
                allow_internal?: string[];
            };
            /**
             * @description Global fallback sandbox profile applied to new custom agents that do not pick their own profile. Empty string means use hardcoded default.
             * @example workspace
             * @enum {string}
             */
            default_profile?: "" | "none" | "workspace" | "workspace+net" | "host" | "off";
            /**
             * @description Global fallback shell command deny-list (regex entries). Per-agent custom patterns extend this list.
             * @example [
             *       "^curl\\s",
             *       "^wget\\s"
             *     ]
             */
            shell_deny_patterns?: string[];
            /** @description Present in PUT responses. True when the change requires a gateway restart to take effect (mode, allowed_paths, default_profile). */
            requires_restart?: boolean;
            /** @description Present in PUT responses. Always true on success. */
            saved?: boolean;
        };
        /**
         * SandboxStatus
         * @description Runtime sandbox backend status returned by GET /api/v1/security/sandbox-status.
         */
        SandboxStatus: {
            /**
             * @description Name of the active sandbox backend.
             * @example landlock
             */
            backend: string;
            /**
             * @description Whether the backend is available on this platform.
             * @example true
             */
            available: boolean;
            /**
             * @description Whether the backend can enforce at the kernel level. True for Landlock on Linux 5.13+. False for the fallback (app-level) backend.
             * @example true
             */
            kernel_level: boolean;
            /**
             * @description Whether kernel-level enforcement is actually live on this process. A kernel-capable backend may not have policy applied if Apply() was not called yet (e.g. sandbox mode is off).
             * @example true
             */
            policy_applied: boolean;
            /**
             * @description Landlock ABI version. Present on Linux with Landlock support.
             * @example 4
             */
            abi_version?: number;
            /**
             * @description Set when a known kernel incompatibility is flagged. Do NOT hard-code the literal issue number in the SPA.
             * @example https://github.com/dapicom-ai/omnipus/issues/123
             */
            issue_ref?: string;
            /** @description List of syscall names blocked by seccomp (when active). */
            blocked_syscalls?: string[];
            /**
             * @description Whether seccomp BPF filtering is currently active.
             * @example true
             */
            seccomp_enabled: boolean;
            /** @description Landlock feature flags active on this kernel. */
            landlock_features?: string[];
            /** @description Human-readable notes about the sandbox state or limitations. */
            notes?: string[];
            /**
             * @description Current sandbox enforcement mode (from ApplyState).
             * @example enforce
             */
            mode?: string;
            /** @description Reason the sandbox is disabled, if applicable. E.g. "config" or "kernel". */
            disabled_by?: string;
            /** @description Whether Landlock file-system access rules are enforced. */
            landlock_enforced?: boolean;
            /** @description Whether seccomp syscall filtering is enforced. */
            seccomp_enforced?: boolean;
            /** @description True when the sandbox is in permissive (audit-only) mode — policy violations are logged but not blocked. */
            audit_only?: boolean;
            /**
             * @description Number of bind-port allow-list rules installed by the kernel. Zero on FallbackBackend, Mode=Off, or Landlock ABI < 4.
             * @example 2
             */
            bind_ports_count: number;
        };
        /**
         * AuditEntry
         * @description A single audit log record from the JSONL audit log file (~/.omnipus/system/audit.jsonl). Matches the Go pkg/audit.Entry struct.
         */
        AuditEntry: {
            /**
             * Format: date-time
             * @description ISO 8601 UTC timestamp of when the event was recorded.
             * @example 2026-05-16T10:30:00Z
             */
            timestamp: string;
            /**
             * @description Event type identifier. Well-known values: tool_call, exec, file_op, llm_call, policy_eval, rate_limit, ssrf, startup, shutdown. Custom values are permitted for extensibility — must match ^[a-z_]+$ (lowercase letters and underscores only).
             * @example tool_call
             */
            event: string;
            /**
             * @description Outcome of the event evaluation. One of: allow, deny, error. May be absent for informational events.
             * @example allow
             * @enum {string}
             */
            decision?: "allow" | "deny" | "error";
            /**
             * @description ID of the agent that triggered the event. May be absent.
             * @example jim
             */
            agent_id?: string;
            /**
             * @description Session ID associated with the event. May be absent.
             * @example sess_abc123
             */
            session_id?: string;
            /**
             * @description Tool name when the event is a tool call. May be absent.
             * @example workspace.shell
             */
            tool?: string;
            /**
             * @description Command string when the event is an exec event. May be absent.
             * @example ls -la
             */
            command?: string;
            /** @description Tool call parameters or other event-specific key-value pairs. */
            parameters?: {
                [key: string]: unknown;
            };
            /**
             * @description Policy rule that produced this decision. May be absent.
             * @example exec: ask
             */
            policy_rule?: string;
            /** @description Event-specific metadata. Structure varies by event type. */
            details?: {
                [key: string]: unknown;
            };
        };
        /**
         * AuditLogToggle
         * @description Audit log enable/disable state returned by GET /api/v1/security/audit-log. Note: this endpoint controls whether audit logging is enabled at all. GET /api/v1/audit-log (distinct path) returns the actual audit entries.
         */
        AuditLogToggle: {
            /**
             * @description Whether audit logging is currently enabled.
             * @example true
             */
            enabled: boolean;
        };
        /**
         * RateLimitConfig
         * @description Rate limit configuration returned by GET /api/v1/security/rate-limits and accepted by PUT /api/v1/security/rate-limits.
         */
        RateLimitConfig: {
            /**
             * @description True when any rate limit cap is configured. Derived from whether any limit field is non-zero. Only present in GET responses.
             * @example true
             */
            enabled?: boolean;
            /**
             * Format: double
             * @description Current cumulative LLM spending for today (UTC). Only present in GET responses.
             * @example 0.42
             */
            daily_cost_usd?: number;
            /**
             * Format: double
             * @description Maximum allowed daily LLM cost in USD. 0 = unlimited. Only present in GET responses (mapped from daily_cost_cap_usd).
             * @example 5
             */
            daily_cost_cap?: number;
            /**
             * Format: double
             * @description Maximum allowed daily LLM cost in USD. 0 = unlimited. Used in PUT request body.
             * @example 5
             */
            daily_cost_cap_usd?: number;
            /**
             * Format: int64
             * @description Maximum LLM API calls per agent per hour. 0 = unlimited.
             * @example 100
             */
            max_agent_llm_calls_per_hour?: number;
            /**
             * Format: int64
             * @description Maximum tool calls per agent per minute. 0 = unlimited.
             * @example 60
             */
            max_agent_tool_calls_per_minute?: number;
        };
        /**
         * ExecAllowlist
         * @description Exec binary allowlist configuration for GET/PUT /api/v1/security/exec-allowlist (SEC-05).
         */
        ExecAllowlist: {
            /**
             * @description Ordered list of allowed binary name patterns evaluated on every exec call. Patterns are trimmed, deduplicated, and validated server-side. Empty array = block all exec calls.
             * @example [
             *       "git",
             *       "python3",
             *       "node"
             *     ]
             */
            allowed_binaries: string[];
            /**
             * @description Approval mode for exec calls. Reflects config.tools.exec.approval. Only present in GET responses.
             * @example ask
             */
            approval?: string;
            /**
             * @description True in PUT responses — the in-memory agent loop uses the previous allowlist until the gateway restarts (SEC-12).
             * @example true
             */
            restart_required?: boolean;
        };
        /**
         * ExecProxyStatus
         * @description Runtime state of the exec SSRF proxy returned by GET /api/v1/security/exec-proxy-status (SEC-28).
         */
        ExecProxyStatus: {
            /**
             * @description Whether the exec proxy is configured to run (cfg.Tools.Exec.EnableProxy).
             * @example true
             */
            enabled: boolean;
            /**
             * @description Whether the proxy listener is currently bound and running.
             * @example true
             */
            running: boolean;
            /**
             * @description Bound address in "host:port" format. Present only when running is true. Backend handler enforces this invariant; OpenAPI 3.0.3 cannot express conditional required fields.
             * @example 127.0.0.1:19000
             */
            address?: string;
        };
        /**
         * SkillTrustResponse
         * @description Skill trust level returned by GET /api/v1/security/skill-trust.
         */
        SkillTrustResponse: {
            /**
             * @description Current skill trust level. Controls how unverified community skills are handled.
             * @example warn_unverified
             * @enum {string}
             */
            level: "block_unverified" | "warn_unverified" | "allow_all";
        };
        /**
         * PromptGuardResponse
         * @description Prompt injection guard level returned by GET /api/v1/security/prompt-guard.
         */
        PromptGuardResponse: {
            /**
             * @description Current prompt injection detection strictness level.
             * @example medium
             * @enum {string}
             */
            level: "low" | "medium" | "high";
            /**
             * @description Always false — prompt guard is hot-reloaded.
             * @example false
             */
            requires_restart: boolean;
        };
        /**
         * PendingRestartEntry
         * @description A single config key that has been written to disk but not yet applied — the running value diverges from the persisted value. Returned in the array from GET /api/v1/config/pending-restart.
         */
        PendingRestartEntry: {
            /**
             * @description Dotted config key path (e.g. "sandbox.mode", "gateway.port"). Only RestartGatedKeys appear here — hot-reload keys never appear.
             * @example sandbox.mode
             */
            key: string;
            /**
             * @description Value currently on disk (what will be applied after restart).
             * @example enforce
             */
            persisted_value: unknown;
            /**
             * @description Value currently applied to the running process (boot-time snapshot).
             * @example permissive
             */
            applied_value: unknown;
        };
        /**
         * AboutResponse
         * @description Gateway metadata returned by GET /api/v1/about.
         */
        AboutResponse: {
            /**
             * @description Omnipus gateway version string.
             * @example 0.1.0
             */
            version: string;
            /**
             * @description Go runtime version string.
             * @example go1.22.3
             */
            go_version: string;
            /**
             * @description Operating system (GOOS).
             * @example linux
             */
            os: string;
            /**
             * @description CPU architecture (GOARCH).
             * @example amd64
             */
            arch: string;
            /**
             * @description Human-readable uptime string.
             * @example 2h30m15s
             */
            uptime: string;
            /**
             * @description Process uptime in seconds.
             * @example 9015
             */
            uptime_seconds: number;
            /**
             * @description Gateway process ID.
             * @example 12345
             */
            pid: number;
            /**
             * @description Port the preview listener is bound on (FR-009). Default is gateway.port + 1.
             * @example 5001
             */
            preview_port: number;
            /**
             * @description Whether the iframe preview listener is currently bound and serving requests. Absent on old gateway versions (treat as true when absent).
             * @example true
             */
            preview_listener_enabled: boolean;
            /**
             * @description Fully-qualified HTTPS origin operators set via gateway.preview_origin (e.g. "https://preview.acme.com"). Absent when not configured; the SPA constructs the origin from preview_port in that case.
             * @example https://preview.acme.com
             */
            preview_origin?: string;
            /**
             * @description Dev-server warmup timeout from config.
             * @example 30
             */
            warmup_timeout_seconds: number;
            /**
             * @description True when frame-ancestors is in fallback ('*') mode — the host is bound to 0.0.0.0/[::] and public_url is not set, degrading T-04 defence. The SPA can show a warning banner when this is true.
             * @example false
             */
            frame_ancestors_fallback: boolean;
        };
        /**
         * HealthResponse
         * @description Response from GET /health. Returns HTTP 200 when the gateway is up. No authentication required.
         */
        HealthResponse: {
            /**
             * @description Always "ok" when the gateway is healthy.
             * @example ok
             * @enum {string}
             */
            status: "ok";
        };
        /** @description Gateway runtime status as returned by GET /status (polled by the frontend StatusBar every 15 seconds). Summarises the number of configured agents and channels plus a daily cost accumulator. */
        GatewayStatus: {
            /**
             * @description Always true when the gateway is reachable and the agent loop is running.
             * @example true
             */
            online: boolean;
            /**
             * @description Total number of configured agents (core + custom), including the implicit system agent.
             * @example 3
             */
            agent_count: number;
            /**
             * @description Number of enabled channels including the always-available webchat channel.
             * @example 2
             */
            channel_count: number;
            /**
             * Format: double
             * @description Aggregate USD cost accrued today across all agents. Zero when cost tracking is disabled.
             * @example 0.042
             */
            daily_cost: number;
            /**
             * @description Gateway binary version string (e.g. "0.1.0" or the git short-sha for dev builds).
             * @example 0.1.0
             */
            version?: string;
        };
        /** @description A single LLM provider entry as returned by GET /providers and PUT /providers/{id}. Describes the provider's connection status, the resolved model list, and any non-fatal warnings encountered when fetching the upstream model catalogue. */
        Provider: {
            /**
             * @description Provider identifier (e.g. "anthropic", "openai", "openrouter").
             * @example openrouter
             */
            id: string;
            /**
             * @description Human-readable provider name (may be the same as id for unknown providers).
             * @example openrouter
             */
            name: string;
            /**
             * @description Branded display name for UI presentation (e.g. "OpenRouter", "Anthropic"). Falls back to name when absent.
             * @example OpenRouter
             */
            display_name?: string;
            /**
             * @description "connected" when at least one API key is configured for this provider. "disconnected" when no key is available or on the fallback default entry. "error" when the provider is configured but the upstream returned a non-retryable error.
             * @example connected
             * @enum {string}
             */
            status: "connected" | "disconnected" | "error";
            /**
             * @description Alphabetically sorted list of model IDs available from this provider, fetched from the upstream /models endpoint when an API key is present. Empty array when the upstream fetch fails or no key is configured.
             * @example [
             *       "anthropic/claude-3.5-haiku",
             *       "anthropic/claude-sonnet-4-5"
             *     ]
             */
            models: string[];
            /**
             * @description True when the provider has a stored API key in credentials. The key itself is never returned. Absent on legacy entries that predate this field — treat as false when absent.
             * @example true
             */
            has_api_key?: boolean;
            /**
             * @description Non-fatal advisory message (e.g. "could not fetch upstream model list: ..."). Absent when there are no warnings.
             * @example could not fetch upstream model list: status 429
             */
            warning?: string;
            /**
             * @description Fatal error message when status is "error". Absent for connected/disconnected providers.
             * @example upstream returned 403 Forbidden
             */
            error?: string;
        };
        /** @description A single installed skill as returned by GET /skills. Skills are SKILL.md/package bundles loaded from ~/.omnipus/skills/ that extend agent capabilities. Each skill has an ID, version, and human-readable metadata. */
        Skill: {
            /**
             * @description Unique skill identifier (typically the skill directory name or npm package name).
             * @example web-research
             */
            id: string;
            /**
             * @description Human-readable skill name.
             * @example Web Research
             */
            name: string;
            /**
             * @description Semantic version string (e.g. "1.2.3"). Must follow semver format.
             * @example 1.2.3
             */
            version: string;
            /**
             * @description Short description of what the skill does.
             * @example Gives the agent web search and page extraction capabilities.
             */
            description?: string;
            /**
             * @description Skill author or publisher name.
             * @example Omnipus Community
             */
            author?: string;
            /**
             * @description True when the skill has been verified by the Omnipus team. Unverified skills require explicit trust grant before use.
             * @example true
             */
            verified: boolean;
            /**
             * @description "active" when the skill is loaded and its tools are available to agents. "disabled" when the skill has been installed but deactivated. "inactive" when the skill is installed but not currently activated. "error" when the skill failed to load (malformed SKILL.md, missing dependency, etc.).
             * @example active
             * @enum {string}
             */
            status: "active" | "disabled" | "inactive" | "error";
            /**
             * @description ID of the agent this skill is assigned to, when the skill is bound to a specific agent rather than globally available. Absent for globally assigned skills.
             * @example jim
             */
            agent_assignment?: string;
        };
        /** @description A single activity event as returned by GET /activity. Events represent notable runtime occurrences (session starts, task lifecycle changes) from the last 24 hours, returned in reverse-chronological order (max 50 entries). */
        ActivityEvent: {
            /**
             * @description Opaque event identifier derived from the source entity. E.g. "session-<uuid>", "task-c-<id>", "task-u-<id>".
             * @example session-550e8400-e29b-41d4-a716-446655440000
             */
            id: string;
            /**
             * @description Event category. "session_start" = new session began. "task_created" = a task was created. "task_updated" = a task completed or changed status.
             * @example session_start
             * @enum {string}
             */
            type: "session_start" | "task_created" | "task_updated";
            /**
             * @description ID of the agent involved in the event (absent for system events).
             * @example jim
             */
            agent_id?: string;
            /**
             * @description Display name of the agent involved (absent for system events).
             * @example Jim
             */
            agent_name?: string;
            /**
             * Format: date-time
             * @description RFC3339 UTC timestamp when the event occurred.
             * @example 2026-05-17T14:23:00Z
             */
            timestamp: string;
            /**
             * @description Human-readable one-line summary of the event (e.g. session title, task title).
             * @example New session
             */
            summary?: string;
        };
        /** @description Metadata for a single successfully uploaded file, as returned in the POST /upload response body's "files" array. Callers use the path field to construct the /api/v1/uploads/{session_id}/{filename} download URL. */
        UploadedFile: {
            /**
             * @description Sanitised filename as stored on disk.
             * @example screenshot.png
             */
            name: string;
            /**
             * @description Relative path within the uploads directory for constructing a download URL. Format: "uploads/{session_id}/{filename}".
             * @example uploads/550e8400-e29b-41d4-a716-446655440000/screenshot.png
             */
            path: string;
            /**
             * Format: int64
             * @description File size in bytes.
             * @example 204800
             */
            size: number;
            /**
             * @description Detected MIME type of the uploaded file.
             * @example image/png
             */
            content_type: string;
            /**
             * @description media:// ref registered for this file in the media store. Present when the server could register the file (always, for now). The SPA echoes this ref back in the message frame's "media" array so the agent loop can thread the file into the LLM content array as a multimodal content block. Empty if registration failed (the file is still downloadable via path).
             * @example media://550e8400-e29b-41d4-a716-446655440000
             */
            ref?: string;
        };
        /** @description Partial-update body for PUT /security/sandbox-config. All fields are optional — only fields present in the request are updated. At least one field must be supplied (the server returns 400 otherwise). Flat fields take precedence over nested equivalents when both are present in the same request body. mode, allowed_paths, and default_profile are restart-gated (the response includes requires_restart=true when any of these change). ssrf.allow_internal and shell_deny_patterns are hot-reloaded. */
        SandboxConfigUpdate: {
            /**
             * @description Kernel sandbox enforcement mode. "off" = no kernel enforcement (god-mode). "permissive" = log violations but allow. "enforce" = block violations. Restart-gated.
             * @example enforce
             * @enum {string}
             */
            mode?: "off" | "permissive" | "enforce";
            /**
             * @description Allow agent tool calls to make outbound network connections.
             * @example true
             */
            allow_network_outbound?: boolean;
            /**
             * @description List of host filesystem paths the agent is allowed to read/write. Restart-gated. Must be absolute paths; empty list clears all exceptions.
             * @example [
             *       "/home/user/workspace"
             *     ]
             */
            allowed_paths?: string[];
            /**
             * @description Enable SSRF (server-side request forgery) protection for HTTP tool calls.
             * @example true
             */
            ssrf_enabled?: boolean;
            /**
             * @description Flat version of ssrf.allow_internal. Takes precedence when both are present. CIDR ranges or IP addresses the agent may reach despite SSRF blocking.
             * @example [
             *       "10.0.0.1/32"
             *     ]
             */
            ssrf_allow_internal?: string[];
            /** @description Nested SSRF configuration sub-object. Flat fields take precedence. */
            ssrf?: {
                /**
                 * @description CIDR ranges or IP addresses the agent may reach despite SSRF blocking.
                 * @example [
                 *       "10.0.0.1/32"
                 *     ]
                 */
                allow_internal?: string[];
            };
            /**
             * @description Default sandbox profile applied to new custom agents that do not pick their own profile. Restart-gated. Empty string means "inherit global default".
             * @example workspace
             * @enum {string}
             */
            default_profile?: "" | "none" | "workspace" | "workspace+net" | "host" | "off";
            /**
             * @description Global fallback list of Go regexp patterns to block in shell commands. Per-agent custom_deny_patterns extend this list. Hot-reloaded.
             * @example [
             *       "rm -rf /",
             *       "curl.*169\\.254"
             *     ]
             */
            shell_deny_patterns?: string[];
        };
        /**
         * Task
         * @description A task record as returned by GET /tasks, GET /tasks/{id}/subtasks, and POST /tasks. Maps to the task.Task struct on the Go side.
         */
        Task: {
            /**
             * @description Unique task identifier (UUID).
             * @example 550e8400-e29b-41d4-a716-446655440000
             */
            id: string;
            /**
             * @description Human-readable task title.
             * @example Analyze logs
             */
            title: string;
            /**
             * @description Full task description / prompt given to the agent.
             * @example Summarize the last 7 days of gateway logs.
             */
            prompt: string;
            /**
             * @description ID of the agent assigned to this task. Absent when unassigned.
             * @example jim
             */
            agent_id?: string;
            /**
             * @description Display name of the assigned agent. Absent when unassigned.
             * @example Jim
             */
            agent_name?: string;
            /**
             * @description Username of the user who created the task.
             * @example admin
             */
            created_by?: string;
            /**
             * @description ID of the parent task (for subtasks). Absent on top-level tasks.
             * @example parent-task-uuid
             */
            parent_task_id?: string;
            /**
             * @description Task priority (higher = more urgent). Default is 0.
             * @example 5
             */
            priority: number;
            /**
             * @description Current lifecycle status of the task.
             * @example queued
             * @enum {string}
             */
            status: "queued" | "assigned" | "running" | "completed" | "failed";
            /**
             * @description Text result produced by the agent on completion. Absent while running.
             * @example Found 3 anomalies in the log.
             */
            result?: string;
            /**
             * @description Paths to output files or artifact references produced by the task.
             * @example [
             *       "/workspace/report.pdf"
             *     ]
             */
            artifacts?: string[];
            /**
             * @description Session ID created when the task was started.
             * @example session-uuid
             */
            session_id?: string;
            /**
             * @description How the task was triggered.
             * @example manual
             * @enum {string}
             */
            trigger_type: "manual" | "time" | "event";
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the task was created.
             * @example 2026-05-16T10:00:00Z
             */
            created_at?: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the task was started. Absent until started.
             * @example 2026-05-16T10:01:00Z
             */
            started_at?: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the task completed or failed. Absent while running.
             * @example 2026-05-16T10:05:30Z
             */
            completed_at?: string;
        };
        /**
         * McpServer
         * @description An MCP server entry as returned by GET /mcp-servers and POST /mcp-servers.
         */
        McpServer: {
            /**
             * @description Unique MCP server identifier.
             * @example my-mcp-server
             */
            id: string;
            /**
             * @description Human-readable server name.
             * @example My MCP Server
             */
            name: string;
            /**
             * @description Transport mechanism used by this MCP server. "stdio" for local process-based servers, "sse" or "http" for remote HTTP-based servers.
             * @example stdio
             * @enum {string}
             */
            transport: "stdio" | "sse" | "http";
            /**
             * @description Current connection status of the MCP server.
             * @example connected
             * @enum {string}
             */
            status: "connected" | "disconnected" | "error";
            /**
             * @description Number of tools exposed by this server.
             * @example 5
             */
            tool_count: number;
            /**
             * @description List of tool names exposed by this server. Absent when tool_count is 0 or when the server has not yet enumerated its tools.
             * @example [
             *       "search",
             *       "fetch"
             *     ]
             */
            tools?: string[];
        };
        /**
         * McpServerCreate
         * @description Request body for POST /mcp-servers. Adds a new MCP server to the gateway config.
         */
        McpServerCreate: {
            /**
             * @description Human-readable server name.
             * @example My MCP Server
             */
            name: string;
            /**
             * @description Command to start the MCP server process (stdio transport).
             * @example npx @modelcontextprotocol/server-everything
             */
            command: string;
            /**
             * @description Command-line arguments to pass to the server process.
             * @example [
             *       "--port",
             *       "3000"
             *     ]
             */
            args?: string[];
            /**
             * @description Transport mechanism to use for this MCP server. Use "stdio" for local process-based servers, "sse" or "http" for remote HTTP-based servers (both are handled identically by the gateway).
             * @example stdio
             * @enum {string}
             */
            transport: "stdio" | "sse" | "http";
            /**
             * @description Environment variable overrides passed to the MCP server process. Only applicable for stdio transport. Each key-value pair is injected into the server process environment at startup.
             * @example {
             *       "PATH": "/usr/local/bin:/usr/bin"
             *     }
             */
            env?: {
                [key: string]: string;
            };
        };
        /** @description Response from GET /mcp-servers/{id}/tools. Returns the list of tool names exposed by a specific MCP server. */
        McpServerToolsResponse: {
            /**
             * @description List of tool names exposed by the MCP server.
             * @example [
             *       "search",
             *       "fetch"
             *     ]
             */
            tools: string[];
        };
        /**
         * AppState
         * @description Application state returned by GET /api/v1/state. Reflects whether onboarding has been completed and optional diagnostic metadata.
         */
        AppState: {
            /**
             * @description Whether the first-run onboarding wizard has been completed.
             * @example true
             */
            onboarding_complete: boolean;
            /**
             * Format: date-time
             * @description RFC3339 timestamp of the last health-check run. Absent if never run.
             * @example 2026-05-16T10:00:00Z
             */
            last_doctor_run?: string;
            /**
             * @description Score from the last health-check run (0–100, integer). Absent if never run.
             * @example 85
             */
            last_doctor_score?: number;
            /**
             * @description True when the sandbox mode is "off" (no kernel enforcement). Indicates the gateway is running without sandbox protection.
             * @example false
             */
            god_mode_available?: boolean;
            /**
             * @description True when the operator has explicitly opted into god mode (sandbox=off). Distinct from god_mode_available to allow UI differentiation.
             * @example false
             */
            god_mode_opted_in?: boolean;
            /**
             * @description True when gateway.dev_mode_bypass is enabled. Read-only — cannot be set via this endpoint. The SPA uses this to hide controls that are inoperative when bypass is active.
             * @example false
             */
            dev_mode_bypass?: boolean;
        };
        /**
         * ValidateTokenResponse
         * @description Response from GET /api/v1/auth/validate. Confirms the current bearer token is valid and returns the associated user's role.
         */
        ValidateTokenResponse: {
            /**
             * @description The authenticated user's login name.
             * @example admin
             */
            username: string;
            /**
             * @description The RBAC role of the authenticated user.
             * @example admin
             * @enum {string}
             */
            role: "admin" | "user";
        };
        /**
         * DoctorIssue
         * @description A single health-check finding returned as part of a DoctorResult. Each issue has a severity, a human-readable title and description, and an optional actionable link.
         */
        DoctorIssue: {
            /**
             * @description Unique identifier for this issue type.
             * @example no-provider-configured
             */
            id: string;
            /**
             * @description Issue severity level.
             * @example high
             * @enum {string}
             */
            severity: "high" | "medium" | "low";
            /**
             * @description Short human-readable title for the issue.
             * @example No LLM provider configured
             */
            title: string;
            /**
             * @description Full description of the issue and its impact.
             * @example No API provider has been configured. The agent cannot generate responses.
             */
            description: string;
            /**
             * @description Recommended remediation action.
             * @example Go to Settings > Providers and add an API key.
             */
            recommendation: string;
            /**
             * @description Optional URL or SPA route to navigate to for remediation.
             * @example /settings/providers
             */
            action_link?: string;
            /**
             * @description Display label for the action link.
             * @example Configure Provider
             */
            action_label?: string;
        };
        /**
         * DoctorResult
         * @description Health-check result returned by GET /api/v1/doctor and POST /api/v1/doctor. Contains an overall score and a list of individual findings.
         */
        DoctorResult: {
            /**
             * @description Overall health score (0 = critical issues; 100 = fully healthy).
             * @example 85
             */
            score: number;
            /** @description List of health-check findings. Empty when score is 100. Capped at 100 to bound response size. */
            issues: components["schemas"]["DoctorIssue"][];
            /**
             * Format: date-time
             * @description RFC3339 timestamp when this health check was run.
             * @example 2026-05-16T10:00:00Z
             */
            checked_at: string;
        };
        /**
         * DevicePending
         * @description A device pairing request that has not yet been approved. Returned as part of the DevicesResponse from GET /api/v1/devices.
         */
        DevicePending: {
            /**
             * @description Unique device identifier.
             * @example dev_01HXYZ
             */
            device_id: string;
            /**
             * @description Cryptographic fingerprint of the device's public key.
             * @example SHA256:abc123...
             */
            fingerprint: string;
            /**
             * @description Short human-readable pairing code displayed to the user.
             * @example BLUE-TIGER-42
             */
            pairing_code: string;
            /**
             * @description Human-readable device name provided during pairing.
             * @example Alice's MacBook
             */
            device_name: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the pairing request was created.
             * @example 2026-05-16T10:00:00Z
             */
            created_at: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the pairing request expires.
             * @example 2026-05-16T10:10:00Z
             */
            expires_at: string;
        };
        /**
         * DevicePaired
         * @description A device that has been successfully paired. Returned as part of the DevicesResponse from GET /api/v1/devices.
         */
        DevicePaired: {
            /**
             * @description Unique device identifier.
             * @example dev_01HXYZ
             */
            device_id: string;
            /**
             * @description Cryptographic fingerprint of the device's public key.
             * @example SHA256:abc123...
             */
            fingerprint: string;
            /**
             * @description Human-readable device name.
             * @example Alice's MacBook
             */
            device_name: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the device was paired.
             * @example 2026-05-16T10:00:00Z
             */
            paired_at: string;
            /**
             * Format: date-time
             * @description RFC3339 timestamp of the last authenticated request from this device.
             * @example 2026-05-16T11:30:00Z
             */
            last_seen_at: string;
            /**
             * @description Whether this device's access is currently active or revoked.
             * @example active
             * @enum {string}
             */
            status: "active" | "revoked";
        };
        /**
         * DevicesResponse
         * @description Response from GET /api/v1/devices. Lists both pending pairing requests and already-paired devices.
         */
        DevicesResponse: {
            /** @description Pairing requests awaiting approval. Capped at 100. */
            pending: components["schemas"]["DevicePending"][];
            /** @description Devices that have been successfully paired. Capped at 100. */
            paired: components["schemas"]["DevicePaired"][];
        };
        /**
         * BackupEntry
         * @description A single backup archive entry returned by GET /api/v1/backups.
         */
        BackupEntry: {
            /**
             * @description Backup archive filename (e.g. "omnipus-backup-2026-05-16.tar.gz").
             * @example omnipus-backup-2026-05-16T10-00-00Z.tar.gz
             */
            filename: string;
            /**
             * Format: int64
             * @description Archive size in bytes.
             * @example 1048576
             */
            size_bytes: number;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the backup was created.
             * @example 2026-05-16T10:00:00Z
             */
            created_at: string;
        };
        /**
         * StorageStats
         * @description Storage statistics returned by GET /api/v1/storage/stats. Reports session count, workspace disk usage, memory entry count, and any non-fatal warnings encountered while collecting the stats.
         */
        StorageStats: {
            /**
             * Format: int64
             * @description Total size in bytes of all agent workspace directories.
             * @example 52428800
             */
            workspace_size_bytes: number;
            /**
             * @description Total number of sessions across all agent stores.
             * @example 42
             */
            session_count: number;
            /**
             * @description Total number of memory entries across all agent stores.
             * @example 0
             */
            memory_entry_count: number;
            /**
             * Format: date-time
             * @description RFC3339 timestamp of the oldest session. Absent when no sessions exist.
             * @example 2026-01-01T00:00:00Z
             */
            oldest_session_date?: string;
            /**
             * @description Non-fatal errors encountered while collecting stats (e.g. unreadable agent stores). The response is still returned when warnings are present.
             * @example [
             *       "workspace size unavailable: permission denied"
             *     ]
             */
            warnings?: string[];
        };
        /**
         * MeInfo
         * @description Response from GET /api/v1/me. Returns the authenticated user's role, used for RBAC gating in the SPA.
         */
        MeInfo: {
            /**
             * @description RBAC role of the current authenticated user.
             * @example admin
             * @enum {string}
             */
            role: "admin" | "user";
        };
        /**
         * AuditLogToggleRequest
         * @description Request body for PUT /api/v1/security/audit-log. Enables or disables audit logging.
         */
        AuditLogToggleRequest: {
            /**
             * @description Whether audit logging should be enabled.
             * @example true
             */
            enabled: boolean;
        };
        /**
         * AuditLogUpdateResponse
         * @description Response from PUT /api/v1/security/audit-log. Returns save status and the previously active state (restart required to apply).
         */
        AuditLogUpdateResponse: {
            /**
             * @description True when the configuration was successfully persisted to disk.
             * @example true
             */
            saved: boolean;
            /**
             * @description Always true — changing the audit log enabled state requires a restart to swap file handles.
             * @example true
             */
            requires_restart: boolean;
            /**
             * @description The audit log enabled state currently active (before restart takes effect). This is the old value — the new value will take effect after restart.
             * @example true
             */
            applied_enabled: boolean;
        };
        /**
         * SkillTrustUpdateRequest
         * @description Request body for PUT /api/v1/security/skill-trust. Updates the skill trust level; controls how unverified community skills are handled.
         */
        SkillTrustUpdateRequest: {
            /**
             * @description New skill trust level.
             * @example block_unverified
             * @enum {string}
             */
            level: "block_unverified" | "warn_unverified" | "allow_all";
        };
        /**
         * SkillTrustUpdateResponse
         * @description Response from PUT /api/v1/security/skill-trust. Returns save status and the now-active skill trust level.
         */
        SkillTrustUpdateResponse: {
            /**
             * @description True when the configuration was successfully persisted to disk.
             * @example true
             */
            saved: boolean;
            /**
             * @description Always false — skill trust is hot-reloaded.
             * @example false
             */
            requires_restart: boolean;
            /**
             * @description The skill trust level now active.
             * @example warn_unverified
             * @enum {string}
             */
            applied_level: "block_unverified" | "warn_unverified" | "allow_all";
            /**
             * @description Present when allow_all is selected — warns that hash verification is disabled.
             * @example skill_trust=allow_all disables hash verification — configure a trusted skills registry instead
             */
            warning?: string;
        };
        /**
         * PromptGuardUpdateRequest
         * @description Request body for PUT /api/v1/security/prompt-guard. Updates the prompt injection detection strictness level.
         */
        PromptGuardUpdateRequest: {
            /**
             * @description New prompt injection detection strictness level.
             * @example medium
             * @enum {string}
             */
            level: "low" | "medium" | "high";
        };
        /**
         * PromptGuardUpdateResponse
         * @description Response from PUT /api/v1/security/prompt-guard. Returns save status and the currently active level.
         */
        PromptGuardUpdateResponse: {
            /**
             * @description True when the configuration was successfully persisted to disk.
             * @example true
             */
            saved: boolean;
            /**
             * @description False when hot-reload succeeded. True when hot-reload failed (warning will be present).
             * @example false
             */
            requires_restart: boolean;
            /**
             * @description The prompt guard level now active.
             * @example medium
             * @enum {string}
             */
            applied_level: "low" | "medium" | "high";
            /**
             * @description Present when hot-reload failed — config is saved but restart is required.
             * @example config saved to disk but hot-reload failed; restart the gateway to apply
             */
            warning?: string;
        };
        /**
         * RateLimitsResponse
         * @description Response from GET /api/v1/security/rate-limits. Returns the current rate-limit configuration and the live daily LLM cost.
         */
        RateLimitsResponse: {
            /** @example true */
            enabled: boolean;
            /**
             * Format: double
             * @description Live daily LLM cost accumulated so far today.
             * @example 0.42
             */
            daily_cost_usd: number;
            /**
             * Format: double
             * @description Configured daily cost cap in USD. 0 means unlimited.
             * @example 5
             */
            daily_cost_cap: number;
            /**
             * Format: int64
             * @description Maximum LLM calls per hour across all agents. 0 means unlimited.
             * @example 100
             */
            max_agent_llm_calls_per_hour: number;
            /**
             * Format: int64
             * @description Maximum tool calls per minute across all agents. 0 means unlimited.
             * @example 60
             */
            max_agent_tool_calls_per_minute: number;
        };
        /**
         * RateLimitsUpdateRequest
         * @description Request body for PUT /api/v1/security/rate-limits. Partial update — any subset of the three cap fields. Strict type validation rejects JSON strings in numeric fields, floats in integer fields, negative values, NaN/Inf, and overflow. Changes are hot-reloaded.
         */
        RateLimitsUpdateRequest: {
            /**
             * Format: double
             * @description Daily cost cap in USD. 0 = unlimited.
             */
            daily_cost_cap_usd?: number;
            /**
             * Format: int64
             * @description Maximum LLM calls per hour. 0 = unlimited.
             */
            max_agent_llm_calls_per_hour?: number;
            /**
             * Format: int64
             * @description Maximum tool calls per minute. 0 = unlimited.
             */
            max_agent_tool_calls_per_minute?: number;
        };
        /**
         * RateLimitsUpdateResponse
         * @description Response from PUT /api/v1/security/rate-limits. Returns save status and the applied configuration.
         */
        RateLimitsUpdateResponse: {
            /**
             * @description True when the configuration was successfully persisted to disk.
             * @example true
             */
            saved: boolean;
            /**
             * @description Always false for rate limits — they are hot-reloaded. Set to true when hot-reload failed (warning will be present).
             * @example false
             */
            requires_restart: boolean;
            /** @description The effective configuration after the update. Present only when hot-reload succeeded. */
            applied?: {
                /**
                 * Format: double
                 * @description Applied daily cost cap in USD.
                 * @example 5
                 */
                daily_cost_cap_usd?: number;
                /**
                 * Format: int64
                 * @description Applied LLM calls per hour limit.
                 * @example 100
                 */
                max_agent_llm_calls_per_hour?: number;
                /**
                 * Format: int64
                 * @description Applied tool calls per minute limit.
                 * @example 60
                 */
                max_agent_tool_calls_per_minute?: number;
            };
            /**
             * @description Present when hot-reload failed — config is saved but restart is required.
             * @example config saved to disk but hot-reload failed; restart the gateway to apply
             */
            warning?: string;
        };
        /**
         * SessionScopeUpdateResponse
         * @description Response from PUT /api/v1/security/session-scope. Returns save status and the currently active scope (before restart).
         */
        SessionScopeUpdateResponse: {
            /**
             * @description True when the configuration was successfully persisted to disk.
             * @example true
             */
            saved: boolean;
            /**
             * @description Always true — session routing requires a gateway restart to take effect.
             * @example true
             */
            requires_restart: boolean;
            /**
             * @description The dm_scope currently active (the value before restart takes effect).
             * @example per-channel-peer
             */
            applied_dm_scope: string;
            /**
             * @description Present when hot-reload failed — config is saved but restart is required.
             * @example config saved to disk but hot-reload failed; restart the gateway to apply
             */
            warning?: string;
        };
        /**
         * RetentionUpdateResponse
         * @description Response from PUT /api/v1/security/retention. Returns save status and the currently active retention settings.
         */
        RetentionUpdateResponse: {
            /**
             * @description True when the configuration was successfully persisted to disk.
             * @example true
             */
            saved: boolean;
            /**
             * @description Always false — retention config is hot-reloaded.
             * @example false
             */
            requires_restart: boolean;
            /**
             * @description Number of days to retain session logs. 0 = system default (90 days).
             * @example 30
             */
            session_days: number;
            /**
             * @description When true, retention sweeps are disabled and session logs are kept forever.
             * @example false
             */
            disabled: boolean;
        };
        /**
         * AgentToolsResponse
         * @description Response from GET /api/v1/agents/{id}/tools and PUT /api/v1/agents/{id}/tools. Returns the agent's tool policy configuration plus the effective per-tool policy list.
         */
        AgentToolsResponse: {
            config: components["schemas"]["AgentToolsCfg"];
            /** @description Per-tool effective policy entries. */
            tools: components["schemas"]["AgentToolEntry"][];
            /**
             * @description Agent classification: "core", "system", or "custom". Informs the UI whether policy editing is allowed.
             * @example custom
             * @enum {string}
             */
            agent_type?: "core" | "system" | "custom";
        };
        /**
         * ChannelEnabledResponse
         * @description Response from PUT /api/v1/channels/{id}/enable and PUT /api/v1/channels/{id}/disable. Returns the channel ID and its new enabled state.
         */
        ChannelEnabledResponse: {
            /**
             * @description Channel identifier.
             * @example telegram
             */
            id: components["schemas"]["ChannelId"];
            /**
             * @description Whether the channel is now enabled.
             * @example true
             */
            enabled: boolean;
        };
        /**
         * ChannelTestResponse
         * @description Response from POST /api/v1/channels/{id}/test. Returns whether required credentials are configured.
         */
        ChannelTestResponse: {
            /**
             * @description True when all required credential fields are present.
             * @example true
             */
            success: boolean;
            /**
             * @description Human-readable description of the test result.
             * @example channel "telegram" is configured
             */
            message: string;
        };
        /**
         * ChannelRouting
         * @description Routing configuration for a single communication channel. Controls which agent handles inbound messages arriving on this channel.
         */
        ChannelRouting: {
            /**
             * @description ID of the agent that handles this channel's inbound messages. Omitted or empty means fall back to the global default agent.
             * @example 550e8400-e29b-41d4-a716-446655440000
             */
            default_agent_id?: string;
        };
        /**
         * BackupCreateResponse
         * @description Response from POST /api/v1/backup. Returns the path, size, and creation time of the new backup archive.
         */
        BackupCreateResponse: {
            /**
             * @description Absolute path to the backup file.
             * @example /home/user/.omnipus/backups/backup-20260516T103000Z.tar.gz
             */
            path: string;
            /**
             * Format: int64
             * @description Size of the backup file in bytes.
             * @example 1048576
             */
            size_bytes: number;
            /**
             * Format: date-time
             * @description RFC3339 timestamp when the backup was created.
             * @example 2026-05-16T10:30:00Z
             */
            created_at: string;
        };
        /**
         * OnboardingStatusResponse
         * @description Response from PATCH /api/v1/state when marking onboarding complete. Confirms that onboarding has been completed.
         */
        OnboardingStatusResponse: {
            /**
             * @description True when onboarding has been successfully marked as complete.
             * @example true
             */
            onboarding_complete: boolean;
        };
        /**
         * OperationResult
         * @description Generic success/failure envelope for simple admin operations. Used by endpoints that perform an action and return only whether it succeeded.
         */
        OperationResult: {
            /**
             * @description True when the operation succeeded.
             * @example true
             */
            success: boolean;
            /**
             * @description Human-readable error message. Present only when success=false.
             * @example no API key configured for this provider
             */
            error?: string;
        };
        /**
         * ToolApprovalResponse
         * @description Response from POST /api/v1/tool-approvals/{approval_id}. Confirms that the approval action was processed.
         */
        ToolApprovalResponse: {
            /**
             * @description The approval ID that was resolved.
             * @example appr_abc123
             */
            approval_id: string;
            /**
             * @description The action that was applied.
             * @example approve
             * @enum {string}
             */
            action: "approve" | "deny" | "cancel";
            /**
             * @description Result status. Always "ok" when the action was accepted.
             * @example ok
             * @enum {string}
             */
            status: "ok";
        };
        /**
         * UploadFilesResponse
         * @description Response from POST /api/v1/upload (HTTP 201). Returns the list of uploaded files with their metadata.
         */
        UploadFilesResponse: {
            /** @description Uploaded file metadata entries. */
            files: components["schemas"]["UploadedFile"][];
        };
        /**
         * TaskAcceptedResponse
         * @description Response from POST /api/v1/tasks/{id}/start (HTTP 202 Accepted). Confirms that the task has been queued for execution.
         */
        TaskAcceptedResponse: {
            /**
             * @description Acceptance status. Always "accepted".
             * @example accepted
             * @enum {string}
             */
            status: "accepted";
            /**
             * @description The ID of the task that was accepted for execution.
             * @example task_abc123
             */
            task_id: string;
        };
        /**
         * AgentOwnerUpdateResponse
         * @description Response from PATCH /api/v1/agents/{id}/ownership. Confirms the ownership change.
         */
        AgentOwnerUpdateResponse: {
            /**
             * @description True when ownership was successfully updated.
             * @example true
             */
            success: boolean;
            /**
             * @description The agent whose ownership was changed.
             * @example 550e8400-e29b-41d4-a716-446655440000
             */
            agent_id: string;
            /**
             * @description The username of the new owner.
             * @example alice
             */
            owner_username: string;
        };
        /**
         * ActivityEventsResponse
         * @description Response from GET /api/v1/activity when partial data is available with a warning. Returned instead of a plain ActivityEvent array when a session read error occurred.
         */
        ActivityEventsResponse: {
            /** @description Activity events (reverse-chronological, max 50, last 24 hours). */
            events: components["schemas"]["ActivityEvent"][];
            /**
             * @description Present when a non-fatal error occurred while collecting events (e.g. a session store was unreadable). The response is still returned.
             * @example failed to read session store for agent jim: permission denied
             */
            warning?: string;
        };
        /**
         * RotateTokenResponse
         * @description Response from POST /api/v1/config/gateway/rotate-token. Returns the newly generated bearer token. The caller must immediately update any stored token references — the previous token is no longer valid once the gateway processes the next request with the new token active.
         */
        RotateTokenResponse: {
            token: components["schemas"]["BearerToken"];
        };
        /**
         * VersionResponse
         * @description Response from GET /api/v1/version. Returns build identity information. Used by the frontend to detect version drift and show "New version available" prompts (issue #110). No authentication required.
         */
        VersionResponse: {
            /**
             * @description Omnipus gateway version string (e.g. "0.1.0"). Must follow semver format.
             * @example 0.1.0
             */
            version: string;
            /**
             * @description VCS revision SHA embedded at build time via debug.ReadBuildInfo(). Value is "dev" when built outside a version-controlled tree or when vcs.revision is not set (e.g. go run). Otherwise a 7-40 character lowercase hex SHA.
             * @example abc1234
             */
            build_sha: string;
        };
        /**
         * UserContextRequest
         * @description Request body for PUT /api/v1/user-context. Replaces the entire content of USER.md in the default workspace. Passing an empty string clears the file.
         */
        UserContextRequest: {
            /**
             * @description Full replacement content for USER.md. May be empty to clear the file. Maximum 262144 bytes (256 KB). The underlying filesystem write via fileutil.WriteFileAtomic provides the physical limit; this schema constraint enforces a reasonable upper bound at the API layer.
             * @example I am a senior Go developer focused on distributed systems.
             */
            content: string;
        };
        /**
         * UserContextResponse
         * @description Response from GET /api/v1/user-context and PUT /api/v1/user-context. Returns the current content of USER.md in the default workspace. An empty string means the file does not exist or has not been written yet.
         */
        UserContextResponse: {
            /**
             * @description Current content of USER.md. Empty string when the file does not exist or has not been set yet.
             * @example I am a senior Go developer focused on distributed systems.
             */
            content: string;
        };
        /**
         * TaskCreateRequest
         * @description Request body for POST /api/v1/tasks. Creates a new task. The fields name/description are backward-compat aliases for title/prompt.
         */
        TaskCreateRequest: {
            /**
             * @description Task title.
             * @example Analyze logs
             */
            title: string;
            /**
             * @description Task description / prompt for the agent.
             * @example Summarize the last 7 days of gateway logs.
             */
            prompt?: string;
            /**
             * @description Agent to assign the task to.
             * @example jim
             */
            agent_id?: string;
            /**
             * @description Task priority (higher = more urgent). Defaults to 3.
             * @example 5
             */
            priority?: number;
            /**
             * @description Parent task ID (for creating subtasks).
             * @example task-uuid-123
             */
            parent_task_id?: string;
            /**
             * @description How the task was triggered. Defaults to "manual".
             * @example manual
             * @enum {string}
             */
            trigger_type?: "manual" | "time" | "event";
            /**
             * @description Backward-compat alias for title.
             * @example Analyze logs
             */
            name?: string;
            /**
             * @description Backward-compat alias for prompt.
             * @example Summarize the last 7 days.
             */
            description?: string;
        };
        /**
         * TaskUpdateRequest
         * @description Request body for PUT /api/v1/tasks/{id}. Updates fields on an existing task. All fields are optional — only provided fields are updated. The fields name/description are backward-compat aliases for title/result.
         */
        TaskUpdateRequest: {
            /**
             * @description New task status.
             * @example completed
             * @enum {string}
             */
            status?: "queued" | "assigned" | "running" | "completed" | "failed";
            /**
             * @description Task result or output summary.
             * @example Logs analyzed successfully.
             */
            result?: string;
            /**
             * @description List of artifact paths produced by the task.
             * @example [
             *       "output.txt"
             *     ]
             */
            artifacts?: string[];
            /**
             * @description New task title.
             * @example Updated task title
             */
            title?: string;
            /**
             * @description Agent to re-assign the task to.
             * @example jim
             */
            agent_id?: string;
            /**
             * @description New task priority.
             * @example 3
             */
            priority?: number;
            /**
             * Format: date-time
             * @description When the task started execution.
             * @example 2026-05-16T10:00:00Z
             */
            started_at?: string;
            /**
             * Format: date-time
             * @description When the task completed execution.
             * @example 2026-05-16T10:05:00Z
             */
            completed_at?: string;
            /**
             * @description Backward-compat alias for title.
             * @example Updated task title
             */
            name?: string;
            /**
             * @description Backward-compat alias for result.
             * @example Logs analyzed successfully.
             */
            description?: string;
        };
        /**
         * ProviderUpdateRequest
         * @description Request body for PUT /api/v1/providers/{id}. Adds or updates an LLM provider configuration. On new providers, api_key is required. On existing providers, api_key may be omitted to keep the current key.
         */
        ProviderUpdateRequest: {
            /**
             * @description API key for the provider. Stored encrypted (AES-256-GCM) in credentials.json. Required when adding a new provider; optional when updating an existing one (omit to leave the current key unchanged).
             * @example sk-abc123
             */
            api_key?: string;
            /**
             * @description Default model to use for this provider. Defaults to "default" when not specified on new providers.
             * @example gpt-4o
             */
            model?: string;
        };
        /**
         * AppStatePatchRequest
         * @description Request body for PATCH /api/v1/state. Partial update to application state. Currently only supports marking onboarding as complete (onboarding_complete must be true — setting it to false is rejected 400).
         */
        AppStatePatchRequest: {
            /**
             * @description Mark onboarding as complete. Must be true — false is rejected with 400.
             * @example true
             */
            onboarding_complete?: boolean;
        };
        /**
         * SkillInstallRequest
         * @description Request body for POST /api/v1/skills/install. Installs a skill from the ClawHub registry by name.
         */
        SkillInstallRequest: {
            /**
             * @description Skill name to install from the ClawHub registry.
             * @example web-search
             */
            name: string;
        };
        /**
         * SseChatRequest
         * @description Request body for POST /api/v1/chat (SSE streaming endpoint). Sends a user message to the agent and streams the response via Server-Sent Events.
         */
        SseChatRequest: {
            /**
             * @description The user message to send to the agent. Must not be empty.
             * @example Hello, what can you help me with today?
             */
            message: string;
        };
        /**
         * ToolApprovalActionRequest
         * @description Request body for POST /api/v1/tool-approvals/{approval_id}. Resolves a pending tool call approval by approving, denying, or cancelling it. For tools with RequiresAdminAsk=true the caller must hold the admin role (FR-015).
         */
        ToolApprovalActionRequest: {
            /**
             * @description Action to take on this approval.
             * @example approve
             * @enum {string}
             */
            action: "approve" | "deny" | "cancel";
        };
        /**
         * CredentialSetRequest
         * @description Request body for POST /api/v1/credentials. Stores an encrypted credential. The key must be non-empty; the value is stored AES-256-GCM encrypted.
         */
        CredentialSetRequest: {
            /**
             * @description Credential key name.
             * @example OPENAI_API_KEY
             */
            key: string;
            /**
             * @description Credential value (stored encrypted).
             * @example sk-abc123...
             */
            value: string;
        };
        /**
         * RestoreBackupRequest
         * @description Request body for POST /api/v1/restore. Extracts a backup tar.gz archive over ~/.omnipus/, skipping config.json to preserve current settings.
         */
        RestoreBackupRequest: {
            /**
             * @description Name of the backup file (without path). Must not contain path separators or traversal sequences. Must end with .tar.gz.
             * @example omnipus-backup-20260516T103000Z.tar.gz
             */
            filename: string;
        };
        /**
         * AgentOwnershipUpdateRequest
         * @description Request body for PATCH /api/v1/agents/{id}/ownership. Updates the owner_username field on a custom agent. Admin-only. System and core agents cannot have an owner assigned. Clearing the owner (empty string) requires the X-Confirm-Demote: 1 header.
         */
        AgentOwnershipUpdateRequest: {
            /**
             * @description Username of the new owner. Empty string clears ownership (requires X-Confirm-Demote: 1 header to prevent accidents).
             * @example alice
             */
            owner_username?: string;
        };
        /**
         * BearerToken
         * @description Canonical opaque bearer token format used by Omnipus. The prefix "omnipus_" (8 characters) followed by 64 lowercase hex characters (32 random bytes), giving a total length of 72 characters. Used in Authorization headers, WS AuthFrame, and rotate-token responses.
         * @example omnipus_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
         */
        BearerToken: string;
        /**
         * ChannelConfigureRequest
         * @description Request body for PUT /api/v1/channels/{id}/configure. Merges the supplied fields into the channel's config section. The "enabled" field is reserved and silently removed — use the separate enable/disable endpoints instead. Field names and value types are channel-specific; unknown fields are stored as-is and passed through to the channel implementation.
         */
        ChannelConfigureRequest: {
            /** @description Channel authentication token (e.g. Telegram bot token, Discord bot token). */
            token?: string;
            /** @description Alias for token used by some channels. */
            bot_token?: string;
            /** @description Application ID (used by Slack, Discord). */
            app_id?: string;
            /** @description Application secret / signing secret. */
            app_secret?: string;
            /** @description HMAC secret for verifying incoming webhook payloads. */
            webhook_secret?: string;
        } & {
            [key: string]: unknown;
        };
        /**
         * RetentionUpdateRequest
         * @description Request body for PUT /api/v1/security/retention. Partial update — any subset of the two retention fields. Strict type validation rejects JSON strings for session_days, floats with fractional parts for session_days, and non-boolean values for disabled. An empty body {} is accepted as a no-op.
         */
        RetentionUpdateRequest: {
            /**
             * @description Number of days to retain session logs. 0 means use the system default (90 days). Floats and strings are rejected with 400.
             * @example 30
             */
            session_days?: number;
            /**
             * @description When true, retention sweeps are disabled and session logs are kept forever. Strings ("true"/"false") and numbers are rejected with 400.
             * @example false
             */
            disabled?: boolean;
        };
        /**
         * McpToolsListResponse
         * @description Response from GET /api/v1/tools/mcp. Returns all configured MCP servers with their status for the agent tool picker UI.
         */
        McpToolsListResponse: ({
            /** @description Unique MCP server identifier (same as the config key name). */
            id: string;
            /** @description Display name for the MCP server. */
            name: string;
            /** @description Whether the MCP server is currently enabled. */
            enabled: boolean;
            /** @description The command used to start the MCP server. */
            command?: string;
            /** @description Arguments passed to the MCP server command. */
            args?: string[];
        } & {
            [key: string]: unknown;
        })[];
        /**
         * McpToolCallRequest
         * @description Request body for POST /api/v1/tools/mcp. Invokes a tool on a specific MCP server by name, passing optional arguments.
         */
        McpToolCallRequest: {
            /**
             * @description The MCP server ID to invoke the tool on.
             * @example filesystem
             */
            server_id: string;
            /**
             * @description The name of the tool to call on the MCP server.
             * @example read_file
             */
            tool_name: string;
            /**
             * @description Key-value arguments to pass to the tool. Shape is tool-specific.
             * @example {
             *       "path": "/home/user/document.txt"
             *     }
             */
            arguments?: {
                [key: string]: unknown;
            };
        };
        /**
         * McpToolCallResponse
         * @description Response from POST /api/v1/tools/mcp. Contains the result returned by the MCP server tool.
         */
        McpToolCallResponse: {
            /** @description The tool's return value. Shape is tool-specific; may be any JSON type. */
            result: unknown;
            /**
             * @description Error message if the tool call failed on the MCP server side. Only present when the call returned an error result.
             * @example file not found: /home/user/missing.txt
             */
            error?: string;
        };
    };
    responses: {
        /** @description Bad request — missing or invalid field. */
        "400BadRequest": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Authentication required or credentials invalid. */
        "401Unauthorized": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Insufficient permissions or CSRF validation failed. */
        "403Forbidden": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Resource not found. */
        "404NotFound": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Conflict — e.g. resource already exists, or last-admin guard triggered. */
        "409Conflict": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Validation failed — semantically invalid input. */
        "422UnprocessableEntity": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Rate limit exceeded. */
        "429TooManyRequests": {
            headers: {
                /** @description Seconds until the rate limit window resets. */
                "Retry-After"?: number;
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Internal server error. */
        "500InternalServerError": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
        /** @description Service unavailable — e.g. credential store locked. */
        "503ServiceUnavailable": {
            headers: {
                [name: string]: unknown;
            };
            content: {
                "application/json": components["schemas"]["ErrorResponse"];
            };
        };
    };
    parameters: never;
    requestBodies: never;
    headers: never;
    pathItems: never;
}
export type $defs = Record<string, never>;
export interface operations {
    login: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["LoginRequest"];
            };
        };
        responses: {
            /** @description Authentication successful. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["LoginResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            429: components["responses"]["429TooManyRequests"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    logout: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Session revoked successfully. No response body. */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            401: components["responses"]["401Unauthorized"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    validateToken: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Token is valid. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ValidateTokenResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            429: components["responses"]["429TooManyRequests"];
        };
    };
    registerAdmin: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["RegisterAdminRequest"];
            };
        };
        responses: {
            /** @description Admin user created. Token ready to use. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["LoginResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            409: components["responses"]["409Conflict"];
            429: components["responses"]["429TooManyRequests"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    changePassword: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ChangePasswordRequest"];
            };
        };
        responses: {
            /** @description Password changed successfully. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["OperationResult"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    completeOnboarding: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["OnboardingCompleteRequest"];
            };
        };
        responses: {
            /** @description Onboarding completed successfully. Bearer token ready. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["LoginResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            409: components["responses"]["409Conflict"];
            429: components["responses"]["429TooManyRequests"];
            500: components["responses"]["500InternalServerError"];
            503: components["responses"]["503ServiceUnavailable"];
        };
    };
    probeProvider: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ProbeProviderRequest"];
            };
        };
        responses: {
            /** @description Always HTTP 200. Check success field to determine if the probe succeeded or failed at the provider level. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ProbeProviderResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            409: components["responses"]["409Conflict"];
        };
    };
    listSessions: {
        parameters: {
            query?: {
                /**
                 * @description Filter by agent ID.
                 * @example jim
                 */
                agent_id?: string;
                /**
                 * @description Filter by session type.
                 * @example chat
                 */
                type?: "chat" | "task" | "channel";
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description List of sessions. When partial errors occur, the response body is {"sessions": [...], "partial_errors": ["agent=X: session_list_failed"]}. When no errors, the response body is a plain JSON array of Session objects. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Session"][] | {
                        sessions: components["schemas"]["Session"][];
                        /** @description Opaque error tokens (agent ID + sanitized reason). */
                        partial_errors: string[];
                    };
                };
            };
            401: components["responses"]["401Unauthorized"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    createSession: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SessionCreateRequest"];
            };
        };
        responses: {
            /** @description Session created successfully. */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Session"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getSession: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Session ID.
                 * @example 550e8400-e29b-41d4-a716-446655440000
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Session detail with transcript. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SessionDetail"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    renameSession: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Session ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SessionRenameRequest"];
            };
        };
        responses: {
            /** @description Session renamed. Returns updated session metadata. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Session"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    deleteSession: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Session ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Session deleted. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        /** @example true */
                        success: boolean;
                    };
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getSessionMessages: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Session ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Ordered list of transcript entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Message"][];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getToolResult: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Session ID that produced the tool result. */
                session_id: string;
                /** @description Opaque ref id from the matching ToolResultRef sentinel. */
                ref: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description The original tool result body. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": unknown;
                };
            };
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    listUsers: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of user accounts. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["User"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            500: components["responses"]["500InternalServerError"];
            503: components["responses"]["503ServiceUnavailable"];
        };
    };
    createUser: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserCreateRequest"];
            };
        };
        responses: {
            /** @description User created successfully. */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserCreateResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            409: components["responses"]["409Conflict"];
            500: components["responses"]["500InternalServerError"];
            503: components["responses"]["503ServiceUnavailable"];
        };
    };
    deleteUser: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Username to delete.
                 * @example alice
                 */
                username: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description User deleted. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserDeleteResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            404: components["responses"]["404NotFound"];
            409: components["responses"]["409Conflict"];
            500: components["responses"]["500InternalServerError"];
            503: components["responses"]["503ServiceUnavailable"];
        };
    };
    changeUserRole: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Username whose role will change.
                 * @example alice
                 */
                username: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserRoleChangeRequest"];
            };
        };
        responses: {
            /** @description Role changed. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserRoleChangeResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            404: components["responses"]["404NotFound"];
            409: components["responses"]["409Conflict"];
            500: components["responses"]["500InternalServerError"];
            503: components["responses"]["503ServiceUnavailable"];
        };
    };
    resetUserPassword: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Username whose password will be reset.
                 * @example alice
                 */
                username: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserResetPasswordRequest"];
            };
        };
        responses: {
            /** @description Password reset successfully. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserResetPasswordResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
            503: components["responses"]["503ServiceUnavailable"];
        };
    };
    listAgents: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of agent configurations. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Agent"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    createAgent: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AgentCreateRequest"];
            };
        };
        responses: {
            /** @description Agent created successfully. */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Agent"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            422: components["responses"]["422UnprocessableEntity"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getAgent: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example jim
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Agent configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Agent"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    updateAgent: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example 550e8400-e29b-41d4-a716-446655440000
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AgentUpdateRequest"];
            };
        };
        responses: {
            /** @description Agent updated. Returns the complete updated agent object. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Agent"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    patchAgentOwnership: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example 550e8400-e29b-41d4-a716-446655440000
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AgentOwnershipUpdateRequest"];
            };
        };
        responses: {
            /** @description Ownership updated. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AgentOwnerUpdateResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    listAgentSessions: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example jim
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of session summaries for this agent. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Session"][];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getAgentTools: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example jim
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Agent tool configuration and effective policy list. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AgentToolsResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    updateAgentTools: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example 550e8400-e29b-41d4-a716-446655440000
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AgentToolsUpdateRequest"];
            };
        };
        responses: {
            /** @description Tools configuration updated. Returns the effective tool list. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AgentToolsResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getSessionScope: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current session scope configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SessionScopeResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    updateSessionScope: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SessionScopeRequest"];
            };
        };
        responses: {
            /** @description Session scope saved. Restart required to apply. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SessionScopeUpdateResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    getHealth: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Gateway is healthy. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["HealthResponse"];
                };
            };
            /** @description Not used — gateway is always healthy or not reachable. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getAbout: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Gateway metadata. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AboutResponse"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getVersion: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Version information. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["VersionResponse"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getToolRegistry: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of tool registry entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ToolRegistryEntry"][];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getBuiltinToolsDeprecated: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Not returned — this endpoint always returns 404. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Endpoint removed — use GET /api/v1/tools instead. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    postToolApproval: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description The approval ID from the WS tool_approval_request frame.
                 * @example appr_abc123
                 */
                approval_id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ToolApprovalActionRequest"];
            };
        };
        responses: {
            /** @description Action processed successfully. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ToolApprovalResponse"];
                };
            };
            /** @description Malformed body or unknown action. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required (RequiresAdminAsk tool). */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Approval ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Approval already resolved (FR-018). */
            410: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getGlobalToolPolicies: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current global tool policies. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["GlobalToolPolicies"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateGlobalToolPolicies: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["GlobalToolPolicies"];
            };
        };
        responses: {
            /** @description Updated global tool policies. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["GlobalToolPolicies"];
                };
            };
            /** @description Invalid policy values. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getExecAllowlist: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current exec allowlist. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ExecAllowlist"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateExecAllowlist: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": {
                    /** @description List of allowed binary name patterns. */
                    allowed_binaries: string[];
                };
            };
        };
        responses: {
            /** @description Updated allowlist (restart required). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ExecAllowlist"];
                };
            };
            /** @description Invalid pattern (empty, too long, or too many entries). */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getExecProxyStatus: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Exec proxy runtime state. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ExecProxyStatus"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getSkillTrust: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current skill trust level. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SkillTrustResponse"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateSkillTrust: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SkillTrustUpdateRequest"];
            };
        };
        responses: {
            /** @description Updated skill trust level. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SkillTrustUpdateResponse"];
                };
            };
            /** @description Invalid trust level value. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getPromptGuard: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current prompt guard level. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["PromptGuardResponse"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updatePromptGuard: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["PromptGuardUpdateRequest"];
            };
        };
        responses: {
            /** @description Updated prompt guard level. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["PromptGuardUpdateResponse"];
                };
            };
            /** @description Invalid level value. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getRateLimits: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current rate limits and live cost. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RateLimitsResponse"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateRateLimits: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["RateLimitsUpdateRequest"];
            };
        };
        responses: {
            /** @description Updated rate limit configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RateLimitsUpdateResponse"];
                };
            };
            /** @description Invalid field types or values. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getSandboxConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current sandbox configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SandboxConfig"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Agent loop not initialized. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateSandboxConfig: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SandboxConfigUpdate"];
            };
        };
        responses: {
            /** @description Updated sandbox configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SandboxConfig"];
                };
            };
            /** @description Validation error (invalid mode, profile, or path). */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description dev_mode_bypass is active (RequireNotBypass guard). */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getSandboxStatus: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Sandbox backend runtime status. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["SandboxStatus"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Agent loop not initialized. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getAuditLog: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Audit log entries (reverse-chronological, max 100). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuditEntry"][];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getAuditLogToggle: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Audit log enable state. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuditLogToggle"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateAuditLogToggle: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AuditLogToggleRequest"];
            };
        };
        responses: {
            /** @description Audit log state saved (restart required). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AuditLogUpdateResponse"];
                };
            };
            /** @description Missing or invalid enabled field. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getRetention: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current retention configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RetentionConfig"];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateRetention: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["RetentionConfig"];
            };
        };
        responses: {
            /** @description Updated retention configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RetentionUpdateResponse"];
                };
            };
            /** @description Type mismatch (float for session_days, string for disabled). */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    triggerRetentionSweep: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Sweep result. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RetentionSweepResult"];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Sweep already in progress. */
            409: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    listChannels: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of channel entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ChannelEntry"][];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getChannelConfig: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Channel configuration (credentials redacted). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        [key: string]: unknown;
                    };
                };
            };
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    enableChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Channel enable state updated. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ChannelEnabledResponse"];
                };
            };
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    disableChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Channel disable state updated. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ChannelEnabledResponse"];
                };
            };
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    configureChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        /** @description Channel-specific configuration fields to merge. Structure varies by channel type. */
        requestBody: {
            content: {
                "application/json": {
                    [key: string]: unknown;
                };
            };
        };
        responses: {
            /** @description Updated channel configuration (credentials redacted). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        [key: string]: unknown;
                    };
                };
            };
            /** @description Invalid JSON body. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    testChannel: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Test result. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ChannelTestResponse"];
                };
            };
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getChannelRouting: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Channel routing configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ChannelRouting"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            500: components["responses"]["500InternalServerError"];
        };
    };
    setChannelRouting: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Channel ID.
                 * @example telegram
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ChannelRouting"];
            };
        };
        responses: {
            /** @description Updated channel routing configuration. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ChannelRouting"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            /** @description Channel ID not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            500: components["responses"]["500InternalServerError"];
        };
    };
    rotateGatewayToken: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description New gateway token (valid immediately). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["RotateTokenResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            500: components["responses"]["500InternalServerError"];
        };
    };
    getPendingRestart: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of pending restart entries (may be empty). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["PendingRestartEntry"][];
                };
            };
            /** @description Admin role required. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getWorkspaceFile: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example jim
                 */
                agent_id: string;
                /**
                 * @description File path relative to the agent's workspace root.
                 * @example output/report.html
                 */
                path: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description File content with appropriate Content-Type header. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/octet-stream": string;
                };
            };
            /** @description Invalid agent ID or missing file path. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Not authenticated. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Path outside agent workspace or access denied. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Agent or file not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Agent has no owner and must be reassigned. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getPreview: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Agent ID.
                 * @example jim
                 */
                agent_id: string;
                /**
                 * @description One-time preview token minted by the web_serve tool. The token is the only credential required.
                 * @example abc123def456ghij
                 */
                token: string;
                /**
                 * @description File path or sub-path within the preview root.
                 * @example index.html
                 */
                path: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Preview file content. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/octet-stream": string;
                };
            };
            /** @description Malformed URL. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Token does not match the agent. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Token not found or expired. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    listCredentials: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of credential key names. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": string[];
                };
            };
            /** @description Missing or invalid bearer token. */
            401: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    setCredential: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["CredentialSetRequest"];
            };
        };
        responses: {
            /** @description Credential stored. */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        /** @example OPENAI_API_KEY */
                        key: string;
                    };
                };
            };
            /** @description Invalid JSON body. */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Key field is required (empty key). */
            422: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Credential store locked. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    deleteCredential: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Credential key name.
                 * @example OPENAI_API_KEY
                 */
                key: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Credential removed. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        /**
                         * @example removed
                         * @enum {string}
                         */
                        status: "removed";
                        /** @example OPENAI_API_KEY */
                        key: string;
                    };
                };
            };
            /** @description Credential key not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Credential store locked. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    createBackup: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Backup created. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["BackupCreateResponse"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    listBackups: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description List of backup archive entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        /** @example backup-20260516T103000Z.tar.gz */
                        filename: string;
                        /**
                         * Format: int64
                         * @example 1048576
                         */
                        size_bytes: number;
                        /**
                         * Format: date-time
                         * @example 2026-05-16T10:30:00Z
                         */
                        created_at: string;
                    }[];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    restoreBackup: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["RestoreBackupRequest"];
            };
        };
        responses: {
            /** @description Backup restored. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        /**
                         * @example restored
                         * @enum {string}
                         */
                        status: "restored";
                        /** @example backup-20260516T103000Z.tar.gz */
                        filename: string;
                    };
                };
            };
            /** @description Invalid filename (path traversal, missing .tar.gz). */
            400: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Backup file not found. */
            404: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Filename field is required. */
            422: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getStorageStats: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Storage statistics. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["StorageStats"];
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    clearAllSessions: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Sessions cleared. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": {
                        /**
                         * @example cleared
                         * @enum {string}
                         */
                        status: "cleared";
                        /** @example 15 */
                        count: number;
                        /** @description Per-agent errors (non-fatal — partial removal possible). */
                        warnings?: string[];
                    };
                };
            };
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getGatewayStatus: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Gateway runtime status. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["GatewayStatus"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    listProviders: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of provider entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Provider"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    updateProvider: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Provider identifier (e.g. "anthropic", "openai", "openrouter").
                 * @example anthropic
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["ProviderUpdateRequest"];
            };
        };
        responses: {
            /** @description Provider updated. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Provider"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            /** @description api_key required for new providers. */
            422: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Credential store locked. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    testProvider: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Provider identifier (e.g. "anthropic", "openai").
                 * @example anthropic
                 */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Provider test result. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["OperationResult"];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    listSkills: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of installed skills. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Skill"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    installSkill: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SkillInstallRequest"];
            };
        };
        responses: {
            /** @description Skill installed. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Skill"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            /** @description Not yet implemented. */
            501: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    postChat: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["SseChatRequest"];
            };
        };
        responses: {
            /** @description SSE stream of agent response frames. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "text/event-stream": string;
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
        };
    };
    getActivity: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Activity events (reverse-chronological, max 50, last 24 hours). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ActivityEvent"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    uploadFiles: {
        parameters: {
            query?: {
                /**
                 * @description Session ID to associate the uploaded files with. May also be supplied as a multipart form field.
                 * @example 550e8400-e29b-41d4-a716-446655440000
                 */
                session_id?: string;
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "multipart/form-data": {
                    /** @description Session ID (alternative to query parameter). */
                    session_id?: string;
                    /** @description One or more files to upload. */
                    files?: string[];
                };
            };
        };
        responses: {
            /** @description Files uploaded successfully. */
            201: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UploadFilesResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    getAppState: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Application state. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AppState"];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    patchAppState: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["AppStatePatchRequest"];
            };
        };
        responses: {
            /** @description State updated. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["AppState"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
        };
    };
    getUserContext: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current USER.md content (may be empty string). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserContextResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            500: components["responses"]["500InternalServerError"];
        };
    };
    putUserContext: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["UserContextRequest"];
            };
        };
        responses: {
            /** @description Updated USER.md content (echoed back). */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["UserContextResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            500: components["responses"]["500InternalServerError"];
        };
    };
    getMe: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Current user information. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["MeInfo"];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    getDoctorResults: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Health check results, or an empty object when no check has been run yet. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["DoctorResult"];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    runDoctor: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Health check results. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["DoctorResult"];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    listDevices: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Devices response. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["DevicesResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            403: components["responses"]["403Forbidden"];
        };
    };
    listTasks: {
        parameters: {
            query?: {
                /** @description Filter tasks by status. */
                status?: "queued" | "assigned" | "running" | "completed" | "failed";
            };
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of tasks. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Task"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    createTask: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["TaskCreateRequest"];
            };
        };
        responses: {
            /** @description Created task. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Task"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
        };
    };
    updateTask: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Task ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["TaskUpdateRequest"];
            };
        };
        responses: {
            /** @description Updated task. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Task"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    deleteTask: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Task ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Task deleted. */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    listSubtasks: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Parent task ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of subtasks. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["Task"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    startTask: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description Task ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Task accepted and queued for execution. */
            202: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["TaskAcceptedResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    listMcpServers: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of MCP server entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["McpServer"][];
                };
            };
            401: components["responses"]["401Unauthorized"];
        };
    };
    addMcpServer: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["McpServerCreate"];
            };
        };
        responses: {
            /** @description Created MCP server entry. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["McpServer"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
        };
    };
    deleteMcpServer: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description MCP server ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description MCP server deleted. */
            204: {
                headers: {
                    [name: string]: unknown;
                };
                content?: never;
            };
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    listMcpServerTools: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /** @description MCP server ID. */
                id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Tool names for the MCP server. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["McpServerToolsResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
        };
    };
    listMcpTools: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Array of MCP server entries. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["McpToolsListResponse"];
                };
            };
            401: components["responses"]["401Unauthorized"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    callMcpTool: {
        parameters: {
            query?: never;
            header?: never;
            path?: never;
            cookie?: never;
        };
        requestBody: {
            content: {
                "application/json": components["schemas"]["McpToolCallRequest"];
            };
        };
        responses: {
            /** @description Tool call result. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["McpToolCallResponse"];
                };
            };
            400: components["responses"]["400BadRequest"];
            401: components["responses"]["401Unauthorized"];
            404: components["responses"]["404NotFound"];
            500: components["responses"]["500InternalServerError"];
        };
    };
    serveUpload: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description Session ID the file was uploaded under.
                 * @example 550e8400-e29b-41d4-a716-446655440000
                 */
                session_id: string;
                /**
                 * @description Sanitized filename as returned by the upload endpoint.
                 * @example screenshot.png
                 */
                filename: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description File content streamed with appropriate Content-Type. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/octet-stream": string;
                };
            };
            400: components["responses"]["400BadRequest"];
            404: components["responses"]["404NotFound"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
    serveMedia: {
        parameters: {
            query?: never;
            header?: never;
            path: {
                /**
                 * @description The opaque media reference ID (not a path — no slashes or dots).
                 * @example a1b2c3d4e5f6
                 */
                ref_id: string;
            };
            cookie?: never;
        };
        requestBody?: never;
        responses: {
            /** @description Media file content streamed with appropriate Content-Type. */
            200: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/octet-stream": string;
                };
            };
            400: components["responses"]["400BadRequest"];
            /** @description Forbidden — invalid or path-traversal ref_id. */
            403: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            404: components["responses"]["404NotFound"];
            /** @description Method not allowed. */
            405: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
            /** @description Media store not available. */
            503: {
                headers: {
                    [name: string]: unknown;
                };
                content: {
                    "application/json": components["schemas"]["ErrorResponse"];
                };
            };
        };
    };
}

// ── Named type re-exports from components.schemas ────────────────────────────
// Convenience exports so consumers can write `import type { Agent } from "./openapi-types"`
// rather than `components["schemas"]["Agent"]`.

export type ErrorResponse = components["schemas"]["ErrorResponse"];
export type LoginRequest = components["schemas"]["LoginRequest"];
export type LoginResponse = components["schemas"]["LoginResponse"];
export type RegisterAdminRequest = components["schemas"]["RegisterAdminRequest"];
export type ChangePasswordRequest = components["schemas"]["ChangePasswordRequest"];
export type OnboardingCompleteRequest = components["schemas"]["OnboardingCompleteRequest"];
export type OnboardingCompleteResponse = components["schemas"]["OnboardingCompleteResponse"];
export type ProbeProviderRequest = components["schemas"]["ProbeProviderRequest"];
export type ProbeProviderResponse = components["schemas"]["ProbeProviderResponse"];
export type User = components["schemas"]["User"];
export type UserCreateRequest = components["schemas"]["UserCreateRequest"];
export type UserCreateResponse = components["schemas"]["UserCreateResponse"];
export type UserDeleteResponse = components["schemas"]["UserDeleteResponse"];
export type UserRoleChangeRequest = components["schemas"]["UserRoleChangeRequest"];
export type UserRoleChangeResponse = components["schemas"]["UserRoleChangeResponse"];
export type UserResetPasswordRequest = components["schemas"]["UserResetPasswordRequest"];
export type UserResetPasswordResponse = components["schemas"]["UserResetPasswordResponse"];
export type Session = components["schemas"]["Session"];
export type SessionStats = components["schemas"]["SessionStats"];
export type SessionDetail = components["schemas"]["SessionDetail"];
export type SessionCreateRequest = components["schemas"]["SessionCreateRequest"];
export type SessionRenameRequest = components["schemas"]["SessionRenameRequest"];
export type Message = components["schemas"]["Message"];
export type ToolCall = components["schemas"]["ToolCall"];
export type Attachment = components["schemas"]["Attachment"];
export type Agent = components["schemas"]["Agent"];
export type AgentModelParams = components["schemas"]["AgentModelParams"];
export type AgentRateLimits = components["schemas"]["AgentRateLimits"];
export type AgentStats = components["schemas"]["AgentStats"];
export type AgentShellPolicy = components["schemas"]["AgentShellPolicy"];
export type AgentToolsCfg = components["schemas"]["AgentToolsCfg"];
export type AgentToolsUpdateRequest = components["schemas"]["AgentToolsUpdateRequest"];
export type AgentCreateRequest = components["schemas"]["AgentCreateRequest"];
export type AgentUpdateRequest = components["schemas"]["AgentUpdateRequest"];
export type AgentSession = components["schemas"]["AgentSession"];
export type SessionScopeRequest = components["schemas"]["SessionScopeRequest"];
export type SessionScopeResponse = components["schemas"]["SessionScopeResponse"];
export type ToolRegistryEntry = components["schemas"]["ToolRegistryEntry"];
export type AgentToolEntry = components["schemas"]["AgentToolEntry"];
export type ToolPolicy = components["schemas"]["ToolPolicy"];
export type GlobalToolPolicies = components["schemas"]["GlobalToolPolicies"];
export type ChannelId = components["schemas"]["ChannelId"];
export type ChannelEntry = components["schemas"]["ChannelEntry"];
export type RetentionConfig = components["schemas"]["RetentionConfig"];
export type RetentionSweepResult = components["schemas"]["RetentionSweepResult"];
export type SandboxConfig = components["schemas"]["SandboxConfig"];
export type SandboxStatus = components["schemas"]["SandboxStatus"];
export type AuditEntry = components["schemas"]["AuditEntry"];
export type AuditLogToggle = components["schemas"]["AuditLogToggle"];
export type RateLimitConfig = components["schemas"]["RateLimitConfig"];
export type ExecAllowlist = components["schemas"]["ExecAllowlist"];
export type ExecProxyStatus = components["schemas"]["ExecProxyStatus"];
export type SkillTrustResponse = components["schemas"]["SkillTrustResponse"];
export type PromptGuardResponse = components["schemas"]["PromptGuardResponse"];
export type PendingRestartEntry = components["schemas"]["PendingRestartEntry"];
export type AboutResponse = components["schemas"]["AboutResponse"];
export type HealthResponse = components["schemas"]["HealthResponse"];
export type GatewayStatus = components["schemas"]["GatewayStatus"];
export type Provider = components["schemas"]["Provider"];
export type Skill = components["schemas"]["Skill"];
export type ActivityEvent = components["schemas"]["ActivityEvent"];
export type UploadedFile = components["schemas"]["UploadedFile"];
export type SandboxConfigUpdate = components["schemas"]["SandboxConfigUpdate"];
export type Task = components["schemas"]["Task"];
export type McpServer = components["schemas"]["McpServer"];
export type McpServerCreate = components["schemas"]["McpServerCreate"];
export type McpServerToolsResponse = components["schemas"]["McpServerToolsResponse"];
export type AppState = components["schemas"]["AppState"];
export type ValidateTokenResponse = components["schemas"]["ValidateTokenResponse"];
export type DoctorIssue = components["schemas"]["DoctorIssue"];
export type DoctorResult = components["schemas"]["DoctorResult"];
export type DevicePending = components["schemas"]["DevicePending"];
export type DevicePaired = components["schemas"]["DevicePaired"];
export type DevicesResponse = components["schemas"]["DevicesResponse"];
export type BackupEntry = components["schemas"]["BackupEntry"];
export type StorageStats = components["schemas"]["StorageStats"];
export type MeInfo = components["schemas"]["MeInfo"];
export type AuditLogToggleRequest = components["schemas"]["AuditLogToggleRequest"];
export type AuditLogUpdateResponse = components["schemas"]["AuditLogUpdateResponse"];
export type SkillTrustUpdateRequest = components["schemas"]["SkillTrustUpdateRequest"];
export type SkillTrustUpdateResponse = components["schemas"]["SkillTrustUpdateResponse"];
export type PromptGuardUpdateRequest = components["schemas"]["PromptGuardUpdateRequest"];
export type PromptGuardUpdateResponse = components["schemas"]["PromptGuardUpdateResponse"];
export type RateLimitsResponse = components["schemas"]["RateLimitsResponse"];
export type RateLimitsUpdateRequest = components["schemas"]["RateLimitsUpdateRequest"];
export type RateLimitsUpdateResponse = components["schemas"]["RateLimitsUpdateResponse"];
export type SessionScopeUpdateResponse = components["schemas"]["SessionScopeUpdateResponse"];
export type RetentionUpdateResponse = components["schemas"]["RetentionUpdateResponse"];
export type AgentToolsResponse = components["schemas"]["AgentToolsResponse"];
export type ChannelEnabledResponse = components["schemas"]["ChannelEnabledResponse"];
export type ChannelTestResponse = components["schemas"]["ChannelTestResponse"];
export type ChannelRouting = components["schemas"]["ChannelRouting"];
export type BackupCreateResponse = components["schemas"]["BackupCreateResponse"];
export type OnboardingStatusResponse = components["schemas"]["OnboardingStatusResponse"];
export type OperationResult = components["schemas"]["OperationResult"];
export type ToolApprovalResponse = components["schemas"]["ToolApprovalResponse"];
export type UploadFilesResponse = components["schemas"]["UploadFilesResponse"];
export type TaskAcceptedResponse = components["schemas"]["TaskAcceptedResponse"];
export type AgentOwnerUpdateResponse = components["schemas"]["AgentOwnerUpdateResponse"];
export type ActivityEventsResponse = components["schemas"]["ActivityEventsResponse"];
export type RotateTokenResponse = components["schemas"]["RotateTokenResponse"];
export type VersionResponse = components["schemas"]["VersionResponse"];
export type UserContextRequest = components["schemas"]["UserContextRequest"];
export type UserContextResponse = components["schemas"]["UserContextResponse"];
export type TaskCreateRequest = components["schemas"]["TaskCreateRequest"];
export type TaskUpdateRequest = components["schemas"]["TaskUpdateRequest"];
export type ProviderUpdateRequest = components["schemas"]["ProviderUpdateRequest"];
export type AppStatePatchRequest = components["schemas"]["AppStatePatchRequest"];
export type SkillInstallRequest = components["schemas"]["SkillInstallRequest"];
export type SseChatRequest = components["schemas"]["SseChatRequest"];
export type ToolApprovalActionRequest = components["schemas"]["ToolApprovalActionRequest"];
export type CredentialSetRequest = components["schemas"]["CredentialSetRequest"];
export type RestoreBackupRequest = components["schemas"]["RestoreBackupRequest"];
export type AgentOwnershipUpdateRequest = components["schemas"]["AgentOwnershipUpdateRequest"];
export type BearerToken = components["schemas"]["BearerToken"];
export type ChannelConfigureRequest = components["schemas"]["ChannelConfigureRequest"];
export type RetentionUpdateRequest = components["schemas"]["RetentionUpdateRequest"];
export type McpToolsListResponse = components["schemas"]["McpToolsListResponse"];
export type McpToolCallRequest = components["schemas"]["McpToolCallRequest"];
export type McpToolCallResponse = components["schemas"]["McpToolCallResponse"];
