import {
  AddResourceRequestSchema,
  AddUpstreamKeyRequestSchema,
  AgentDeletedResponseSchema,
  AgentListResponseSchema,
  AgentSchema,
  ApiKeyActivityResponseSchema,
  ApiKeyCreatedSchema,
  ApiKeyListResponseSchema,
  ApiKeyRevokedResponseSchema,
  ApiKeySchema,
  ApiMetricsResponseSchema,
  AuditListResponseSchema,
  BatchRequestSchema,
  BatchResponseSchema,
  CreateAgentRequestSchema,
  CreateApiKeyRequestSchema,
  CreateCredentialRequestSchema,
  CreateEnvironmentRequestSchema,
  CreateMemoryRequestSchema,
  CreateMemoryStoreRequestSchema,
  CreateSessionRequestSchema,
  CreateSkillVersionRequestSchema,
  CreateTenantRequestSchema,
  CreateVaultRequestSchema,
  CredentialDeletedResponseSchema,
  CredentialListResponseSchema,
  EnrollmentUrlRequestSchema,
  EnrollmentUrlResponseSchema,
  EnvironmentDeletedResponseSchema,
  EnvironmentListResponseSchema,
  EnvironmentSchema,
  ErrorEnvelopeSchema,
  EventListResponseSchema,
  FileDeletedResponseSchema,
  FileListResponseSchema,
  FileRecordSchema,
  LicenseResponseSchema,
  MemoryDeletedResponseSchema,
  MemoryListResponseSchema,
  MemorySchema,
  MemoryStoreDeletedResponseSchema,
  MemoryStoreListResponseSchema,
  MemoryStoreSchema,
  MetricsResponseSchema,
  ModelListResponseSchema,
  PatchApiKeyRequestSchema,
  PatchTenantRequestSchema,
  PatchUpstreamKeyRequestSchema,
  ProviderStatusResponseSchema,
  PutSettingRequestSchema,
  ResourceDeletedResponseSchema,
  ResourceListResponseSchema,
  SessionDeletedResponseSchema,
  SessionListResponseSchema,
  SessionResourceSchema,
  SessionSchema,
  SessionStatusSchema,
  SetVaultEntryRequestSchema,
  SettingResponseSchema,
  SkillDeletedResponseSchema,
  SkillListResponseSchema,
  SkillSchema,
  SkillVersionDeletedResponseSchema,
  SkillVersionListResponseSchema,
  SkillVersionSchema,
  SkillsCatalogResponseSchema,
  SkillsSourcesResponseSchema,
  SkillsStatsResponseSchema,
  TenantArchivedResponseSchema,
  TenantListResponseSchema,
  TenantSchema,
  TraceDetailSchema,
  TraceExportResponseSchema,
  TraceListResponseSchema,
  UpdateAgentRequestSchema,
  UpdateCredentialRequestSchema,
  UpdateEnvironmentRequestSchema,
  UpdateMemoryRequestSchema,
  UpdateSessionRequestSchema,
  UpdateVaultRequestSchema,
  UpstreamKeyDeletedResponseSchema,
  UpstreamKeyListResponseSchema,
  UpstreamKeySchema,
  UserEventAppendResponseSchema,
  UserEventBatchRequestSchema,
  UserProfileCreateSchema,
  UserProfileListSchema,
  UserProfileSchema,
  UserProfileUpdateSchema,
  VaultCredentialSchema,
  VaultDeletedResponseSchema,
  VaultEntryDeletedResponseSchema,
  VaultEntryListResponseSchema,
  VaultEntrySchema,
  VaultListResponseSchema,
  VaultSchema,
  WhoamiResponseSchema
} from "./chunk-LOP4BAYL.js";
import {
  registry
} from "./chunk-7346CKTF.js";

// src/openapi/spec.ts
import { z } from "zod";
import { OpenApiGeneratorV31 } from "@asteasolutions/zod-to-openapi";
registry.registerComponent("securitySchemes", "ApiKey", {
  type: "apiKey",
  in: "header",
  name: "x-api-key",
  description: "Gateway-issued API key (`ck_*`). When passthrough is enabled, `sk-ant-api*` keys are also accepted on Anthropic-mirror routes and forwarded transparently to api.anthropic.com."
});
var ErrorResponses = {
  400: { description: "Bad request", content: { "application/json": { schema: ErrorEnvelopeSchema } } },
  401: {
    description: "Missing or invalid API key",
    content: { "application/json": { schema: ErrorEnvelopeSchema } }
  },
  404: {
    description: "Resource not found",
    content: { "application/json": { schema: ErrorEnvelopeSchema } }
  },
  409: {
    description: "Conflict (e.g. environment has attached sessions)",
    content: { "application/json": { schema: ErrorEnvelopeSchema } }
  },
  500: {
    description: "Server error",
    content: { "application/json": { schema: ErrorEnvelopeSchema } }
  }
};
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/agents",
  tags: ["Agents"],
  summary: "Create an agent",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateAgentRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Agent created",
      content: { "application/json": { schema: AgentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/agents",
  tags: ["Agents"],
  summary: "List agents",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional(),
      order: z.enum(["asc", "desc"]).optional(),
      page: z.string().optional().describe("ULID cursor for pagination"),
      include_archived: z.enum(["true", "false"]).optional()
    })
  },
  responses: {
    200: {
      description: "A page of agents",
      content: { "application/json": { schema: AgentListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/agents/{id}",
  tags: ["Agents"],
  summary: "Retrieve an agent (optionally a specific version)",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    query: z.object({ version: z.coerce.number().int().optional() })
  },
  responses: {
    200: {
      description: "Agent retrieved",
      content: { "application/json": { schema: AgentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/agents/{id}",
  tags: ["Agents"],
  summary: "Update an agent (creates a new version)",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UpdateAgentRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Agent updated",
      content: { "application/json": { schema: AgentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/agents/{id}",
  tags: ["Agents"],
  summary: "Archive an agent",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Agent archived",
      content: { "application/json": { schema: AgentDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/agents/{id}/archive",
  tags: ["Agents"],
  summary: "Archive an agent (returns the archived agent)",
  description: "Archives the agent and returns the full agent object with `archived_at` set.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Agent archived",
      content: { "application/json": { schema: AgentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/agents/{id}/versions",
  tags: ["Agents"],
  summary: "List agent versions",
  description: "Returns a paginated list of all versions of this agent, ordered by version number descending.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional(),
      page: z.string().optional().describe("Cursor for pagination (base64url-encoded version number)")
    })
  },
  responses: {
    200: {
      description: "A page of agent versions",
      content: { "application/json": { schema: AgentListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/environments",
  tags: ["Environments"],
  summary: "Create an environment",
  description: 'Returns immediately with `state: "preparing"`. Poll `GET /v1/environments/{id}` until `state` becomes `ready` before creating a session against it.',
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateEnvironmentRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Environment created; async setup in progress",
      content: { "application/json": { schema: EnvironmentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/environments",
  tags: ["Environments"],
  summary: "List environments",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional(),
      order: z.enum(["asc", "desc"]).optional(),
      page: z.string().optional(),
      include_archived: z.enum(["true", "false"]).optional()
    })
  },
  responses: {
    200: {
      description: "A page of environments",
      content: { "application/json": { schema: EnvironmentListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/environments/{id}",
  tags: ["Environments"],
  summary: "Retrieve an environment",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Environment retrieved",
      content: { "application/json": { schema: EnvironmentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/environments/{id}",
  tags: ["Environments"],
  summary: "Update an environment",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UpdateEnvironmentRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Environment updated",
      content: { "application/json": { schema: EnvironmentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/environments/{id}",
  tags: ["Environments"],
  summary: "Delete an environment",
  description: "Returns 409 if the environment has non-terminated sessions still attached.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Environment deleted",
      content: { "application/json": { schema: EnvironmentDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/environments/{id}/archive",
  tags: ["Environments"],
  summary: "Archive an environment",
  description: "Returns 409 if the environment has non-terminated sessions still attached (same guard as DELETE).",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Environment archived",
      content: { "application/json": { schema: EnvironmentSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/sessions",
  tags: ["Sessions"],
  summary: "Create a session",
  description: "Creates a session idle and pinned to the specified agent version + environment. A sandbox is NOT allocated until the first user.message event.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateSessionRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Session created",
      content: { "application/json": { schema: SessionSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions",
  tags: ["Sessions"],
  summary: "List sessions",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional(),
      order: z.enum(["asc", "desc"]).optional(),
      page: z.string().optional().describe("ULID cursor for pagination"),
      include_archived: z.enum(["true", "false"]).optional(),
      agent_id: z.string().optional(),
      agent_version: z.coerce.number().int().optional(),
      environment_id: z.string().optional(),
      status: SessionStatusSchema.optional().describe("Filter by single status (deprecated, use statuses)"),
      statuses: z.string().optional().describe("Comma-separated or repeated status filter, e.g. statuses=idle,running"),
      "created_at[gt]": z.string().optional(),
      "created_at[gte]": z.string().optional(),
      "created_at[lt]": z.string().optional(),
      "created_at[lte]": z.string().optional()
    })
  },
  responses: {
    200: {
      description: "A page of sessions",
      content: { "application/json": { schema: SessionListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions/{id}",
  tags: ["Sessions"],
  summary: "Retrieve a session",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Session retrieved",
      content: { "application/json": { schema: SessionSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/sessions/{id}",
  tags: ["Sessions"],
  summary: "Update session title / metadata",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UpdateSessionRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Session updated",
      content: { "application/json": { schema: SessionSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/sessions/{id}",
  tags: ["Sessions"],
  summary: "Delete (terminate) a session",
  description: 'Interrupts any in-flight turn, releases the sandbox, and flips the session to `terminated` with `stop_reason:"deleted"`.',
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Session deleted",
      content: { "application/json": { schema: SessionDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/sessions/{id}/archive",
  tags: ["Sessions"],
  summary: "Archive a session",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Session archived",
      content: { "application/json": { schema: SessionSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/sessions/{id}/events",
  tags: ["Events"],
  summary: "Append user events to a session",
  description: "Atomically appends a batch of user events. `user.message` events buffered while a turn is running are drained as a subsequent turn. Supports `user.message`, `user.interrupt`, `user.custom_tool_result`, `user.tool_confirmation` (requires confirmation_mode), and `user.define_outcome` (triggers grader loop).",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    headers: z.object({
      "idempotency-key": z.string().optional().describe("Per-event key is built as `<idempotency-key>:<batch index>`.")
    }),
    body: {
      required: true,
      content: { "application/json": { schema: UserEventBatchRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Events appended",
      content: { "application/json": { schema: UserEventAppendResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions/{id}/events",
  tags: ["Events"],
  summary: "List a session's event history",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    query: z.object({
      limit: z.coerce.number().int().min(1).max(500).optional(),
      order: z.enum(["asc", "desc"]).optional(),
      after_seq: z.coerce.number().int().optional()
    })
  },
  responses: {
    200: {
      description: "A page of events",
      content: { "application/json": { schema: EventListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions/{id}/events/stream",
  tags: ["Events"],
  summary: "Stream a session's events via Server-Sent Events",
  description: 'Long-lived `text/event-stream` response. Each emitted event sets an `id:` field with the monotonic `seq`, so `EventSource` clients resume automatically via `Last-Event-ID`. A `data: {"type":"ping"}` keepalive is written every 15 seconds. On reconnect, the server backfills events with `seq > Last-Event-ID` from the DB before tailing live.',
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    headers: z.object({
      "last-event-id": z.string().optional().describe("EventSource auto-populates this on reconnect; falls back to ?after_seq")
    }),
    query: z.object({
      after_seq: z.coerce.number().int().optional()
    })
  },
  responses: {
    200: {
      description: "SSE stream opened",
      content: {
        "text/event-stream": {
          schema: z.string().openapi({
            description: "Each frame is `id: <seq>\\nevent: <type>\\ndata: <json>\\n\\n`. JSON shape conforms to ManagedEvent."
          })
        }
      }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions/{id}/threads",
  tags: ["Sessions"],
  summary: "List child thread sessions",
  description: "Returns sessions spawned as child threads of this session via the spawn_agent tool.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional(),
      order: z.enum(["asc", "desc"]).optional()
    })
  },
  responses: {
    200: {
      description: "Child thread sessions",
      content: { "application/json": { schema: SessionListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/sessions/{id}/resources",
  tags: ["Resources"],
  summary: "Add a resource to a session",
  description: "Attaches a resource (URI, text, file, or GitHub repo) to a session. Resources are provisioned into the container at turn start.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: AddResourceRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Resource added",
      content: { "application/json": { schema: SessionResourceSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions/{id}/resources",
  tags: ["Resources"],
  summary: "List session resources",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Session resources",
      content: { "application/json": { schema: ResourceListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/sessions/{id}/resources/{rid}",
  tags: ["Resources"],
  summary: "Get a single session resource",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), rid: z.string() }) },
  responses: {
    200: {
      description: "Resource retrieved",
      content: { "application/json": { schema: SessionResourceSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/sessions/{id}/resources/{rid}",
  tags: ["Resources"],
  summary: "Remove a resource from a session",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), rid: z.string() }) },
  responses: {
    200: {
      description: "Resource removed",
      content: { "application/json": { schema: ResourceDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/files",
  tags: ["Files"],
  summary: "Upload a file",
  description: "Accepts multipart/form-data with a `file` field, or a raw body with the file content. Use `?scope_id=<session_id>` to scope to a session.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      filename: z.string().optional().describe("Filename for raw body uploads."),
      scope_id: z.string().optional().describe("Session ID to scope the file to."),
      scope_type: z.string().optional().describe("Scope type. Defaults to 'session'.")
    })
  },
  responses: {
    201: {
      description: "File uploaded",
      content: { "application/json": { schema: FileRecordSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/files",
  tags: ["Files"],
  summary: "List files",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().min(1).max(500).optional(),
      scope_id: z.string().optional().describe("Session ID to filter by scope."),
      after_id: z.string().optional().describe("Cursor: return files after this ID (for forward pagination)."),
      before_id: z.string().optional().describe("Cursor: return files before this ID (for backward pagination).")
    })
  },
  responses: {
    200: {
      description: "List of file records with pagination",
      content: { "application/json": { schema: FileListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/files/{id}",
  tags: ["Files"],
  summary: "Get file metadata",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "File metadata",
      content: { "application/json": { schema: FileRecordSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/files/{id}/content",
  tags: ["Files"],
  summary: "Download file content",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "File content as binary stream",
      content: {
        "application/octet-stream": {
          schema: z.string().openapi({ description: "Raw file bytes." })
        }
      }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/files/{id}",
  tags: ["Files"],
  summary: "Delete a file",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "File deleted",
      content: { "application/json": { schema: FileDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/vaults",
  tags: ["Vaults"],
  summary: "Create a vault",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateVaultRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Vault created",
      content: { "application/json": { schema: VaultSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/vaults",
  tags: ["Vaults"],
  summary: "List vaults",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      agent_id: z.string().optional().describe("Filter by agent ID")
    })
  },
  responses: {
    200: {
      description: "A list of vaults",
      content: { "application/json": { schema: VaultListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/vaults/{id}",
  tags: ["Vaults"],
  summary: "Retrieve a vault",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Vault retrieved",
      content: { "application/json": { schema: VaultSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/vaults/{id}",
  tags: ["Vaults"],
  summary: "Update a vault",
  description: "Updates vault display_name and/or metadata.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UpdateVaultRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Vault updated",
      content: { "application/json": { schema: VaultSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/vaults/{id}",
  tags: ["Vaults"],
  summary: "Delete a vault and all its entries",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Vault deleted",
      content: { "application/json": { schema: VaultDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/vaults/{id}/archive",
  tags: ["Vaults"],
  summary: "Archive a vault",
  description: "Archives the vault and returns the full vault object with `archived_at` set.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Vault archived",
      content: { "application/json": { schema: VaultSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/vaults/{id}/credentials",
  tags: ["Credentials"],
  summary: "Create a vault credential",
  description: "Creates a credential in the vault for MCP server authentication or plain API key storage. The token is encrypted at rest and never returned in responses. When `mcp_server_url` is provided, the credential is automatically injected as MCP auth during sessions. Without `mcp_server_url`, the token is injected as an env var derived from `display_name`.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: CreateCredentialRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Credential created",
      content: { "application/json": { schema: VaultCredentialSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/vaults/{id}/credentials",
  tags: ["Credentials"],
  summary: "List vault credentials",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Credential list",
      content: { "application/json": { schema: CredentialListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/vaults/{id}/credentials/{credId}",
  tags: ["Credentials"],
  summary: "Get a vault credential",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), credId: z.string() }) },
  responses: {
    200: {
      description: "Credential retrieved",
      content: { "application/json": { schema: VaultCredentialSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/vaults/{id}/credentials/{credId}",
  tags: ["Credentials"],
  summary: "Update a vault credential",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string(), credId: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UpdateCredentialRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Credential updated",
      content: { "application/json": { schema: VaultCredentialSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/vaults/{id}/credentials/{credId}",
  tags: ["Credentials"],
  summary: "Delete a vault credential",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), credId: z.string() }) },
  responses: {
    200: {
      description: "Credential deleted",
      content: { "application/json": { schema: CredentialDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/vaults/{id}/entries",
  tags: ["Vaults"],
  summary: "List vault entries",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "A list of vault entries",
      content: { "application/json": { schema: VaultEntryListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/vaults/{id}/entries/{key}",
  tags: ["Vaults"],
  summary: "Get a vault entry",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), key: z.string() }) },
  responses: {
    200: {
      description: "Vault entry retrieved",
      content: { "application/json": { schema: VaultEntrySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "put",
  path: "/anthropic/v1/vaults/{id}/entries/{key}",
  tags: ["Vaults"],
  summary: "Set a vault entry",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string(), key: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: SetVaultEntryRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Entry set",
      content: { "application/json": { schema: VaultEntrySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/anthropic/v1/vaults/{id}/entries/{key}",
  tags: ["Vaults"],
  summary: "Delete a vault entry",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), key: z.string() }) },
  responses: {
    200: {
      description: "Entry deleted",
      content: { "application/json": { schema: VaultEntryDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/memory_stores",
  tags: ["Memory"],
  summary: "Create a memory store",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateMemoryStoreRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Memory store created",
      content: { "application/json": { schema: MemoryStoreSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/memory_stores",
  tags: ["Memory"],
  summary: "List memory stores",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      agent_id: z.string().optional().describe("Filter by agent ID")
    })
  },
  responses: {
    200: {
      description: "Memory store list",
      content: { "application/json": { schema: MemoryStoreListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/memory_stores/{id}",
  tags: ["Memory"],
  summary: "Get a memory store",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Memory store retrieved",
      content: { "application/json": { schema: MemoryStoreSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/memory_stores/{id}",
  tags: ["Memory"],
  summary: "Delete a memory store",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Memory store deleted",
      content: { "application/json": { schema: MemoryStoreDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/memory_stores/{id}/memories",
  tags: ["Memory"],
  summary: "Create or upsert a memory",
  description: "Creates a new memory at the given path, or upserts if the path already exists in this store.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: CreateMemoryRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Memory created",
      content: { "application/json": { schema: MemorySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/memory_stores/{id}/memories",
  tags: ["Memory"],
  summary: "List memories in a store",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Memory list",
      content: { "application/json": { schema: MemoryListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/memory_stores/{id}/memories/{memId}",
  tags: ["Memory"],
  summary: "Get a memory",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), memId: z.string() }) },
  responses: {
    200: {
      description: "Memory retrieved",
      content: { "application/json": { schema: MemorySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "patch",
  path: "/v1/memory_stores/{id}/memories/{memId}",
  tags: ["Memory"],
  summary: "Update a memory's content",
  description: "Updates the content of a memory. Optionally provide `content_sha256` for optimistic concurrency \u2014 returns 409 if the hash doesn't match.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string(), memId: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UpdateMemoryRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Memory updated",
      content: { "application/json": { schema: MemorySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/memory_stores/{id}/memories/{memId}",
  tags: ["Memory"],
  summary: "Delete a memory",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string(), memId: z.string() }) },
  responses: {
    200: {
      description: "Memory deleted",
      content: { "application/json": { schema: MemoryDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/catalog",
  tags: ["Skills"],
  summary: "Get skills catalog (legacy feed)",
  description: "Returns top skills from the feed, grouped by leaderboard.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      leaderboard: z.enum(["trending", "hot", "allTime"]).optional().describe("Leaderboard to query. Defaults to 'trending'."),
      limit: z.coerce.number().int().optional()
    })
  },
  responses: {
    200: {
      description: "Skills catalog",
      content: { "application/json": { schema: SkillsCatalogResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills",
  tags: ["Skills"],
  summary: "List the caller's uploaded skills",
  description: "Returns a paginated list of skills uploaded by this tenant. Anthropic Managed Agents convention. The community catalog (skills.sh index) lives at /v1/skills/catalog \u2014 see also /v1/skills/feed, /sources, /stats. To search the catalog, use /v1/skills/index?q=\u2026",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional().describe("Page size (default 20)."),
      after_id: z.string().optional().describe("Pagination cursor."),
      include_archived: z.coerce.boolean().optional().describe("Include archived skills (default false).")
    })
  },
  responses: {
    200: {
      description: "Paginated list of skills",
      content: { "application/json": { schema: SkillListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/skills",
  tags: ["Skills"],
  summary: "Create a skill (multipart upload)",
  description: "Uploads a SKILL.md or .zip bundle as a new standalone skill. The first version is created automatically (1.0.0). Use POST /v1/skills/{id}/versions to add subsequent versions. The multipart body matches Anthropic's deploy-managed-agent.sh shape (`display_title` + `files=@path` or `files[]=@path`); a JSON body with `{ name, description?, content, tenant_id? }` is also accepted.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      content: {
        "multipart/form-data": {
          schema: z.object({
            display_title: z.string(),
            files: z.unknown().openapi({ format: "binary", description: "SKILL.md or .zip bundle. `files[]` is also accepted." })
          })
        },
        "application/json": {
          schema: z.object({
            name: z.string(),
            description: z.string().optional(),
            content: z.string(),
            tenant_id: z.string().optional()
          })
        }
      }
    }
  },
  responses: {
    201: {
      description: "Skill created",
      content: { "application/json": { schema: SkillSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/{id}",
  tags: ["Skills"],
  summary: "Get a skill by id",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Skill",
      content: { "application/json": { schema: SkillSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/skills/{id}",
  tags: ["Skills"],
  summary: "Delete a skill",
  description: "Hard-deletes the skill and all its versions.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Skill deleted",
      content: { "application/json": { schema: SkillDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/{id}/versions",
  tags: ["Skills"],
  summary: "List versions of a skill",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    query: z.object({
      limit: z.coerce.number().int().min(1).max(100).optional(),
      after_id: z.string().optional()
    })
  },
  responses: {
    200: {
      description: "Paginated list of skill versions",
      content: { "application/json": { schema: SkillVersionListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/skills/{id}/versions",
  tags: ["Skills"],
  summary: "Create a new version of a skill",
  description: "Appends a new version. Auto-increments from the current version if no explicit `version` is supplied.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: { content: { "application/json": { schema: CreateSkillVersionRequestSchema } } }
  },
  responses: {
    201: {
      description: "Skill version created",
      content: { "application/json": { schema: SkillVersionSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/{id}/versions/{version}",
  tags: ["Skills"],
  summary: "Get a specific version of a skill",
  description: 'Returns version metadata + content. Pass `version: latest` to resolve to the skill\'s current version without pinning to a specific string \u2014 the recommended pattern for agent tool refs `{ type: "custom", skill_id, version: "latest" }`.',
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({
      id: z.string(),
      version: z.string().describe("Version string or the literal `latest`.")
    })
  },
  responses: {
    200: {
      description: "Skill version",
      content: { "application/json": { schema: SkillVersionSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/skills/{id}/versions/{version}",
  tags: ["Skills"],
  summary: "Delete a specific version of a skill",
  description: "Cannot delete the skill's `current_version` \u2014 promote another version first.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string(), version: z.string() })
  },
  responses: {
    200: {
      description: "Version deleted",
      content: { "application/json": { schema: SkillVersionDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/{id}/versions/{version}/content",
  tags: ["Skills"],
  summary: "Download raw skill content",
  description: "Returns the SKILL.md content as `text/markdown` with a Content-Disposition attachment header.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({
      id: z.string(),
      version: z.string().describe("Version string or the literal `latest`.")
    })
  },
  responses: {
    200: {
      description: "Raw skill content",
      content: { "text/markdown": { schema: z.string() } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/stats",
  tags: ["Skills"],
  summary: "Get skills statistics",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "Skills stats",
      content: { "application/json": { schema: SkillsStatsResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/sources",
  tags: ["Skills"],
  summary: "List skill sources",
  description: "Returns aggregated source repositories sorted by install count.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().optional(),
      offset: z.coerce.number().int().optional()
    })
  },
  responses: {
    200: {
      description: "Skill sources",
      content: { "application/json": { schema: SkillsSourcesResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/index",
  tags: ["Skills"],
  summary: "Get the full skills index",
  description: "Returns the complete skills index as raw data.",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "Full skills index",
      content: { "application/json": { schema: z.record(z.unknown()).openapi({ description: "Raw skills index data." }) } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/skills/feed",
  tags: ["Skills"],
  summary: "Get raw skills feed data",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "Raw feed data",
      content: { "application/json": { schema: z.record(z.unknown()).openapi({ description: "Raw feed data including topTrending, topHot, topAllTime." }) } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "put",
  path: "/v1/settings",
  tags: ["Settings"],
  summary: "Update a setting",
  description: "Persists a setting value. Secret settings (API keys, tokens) are stored encrypted and never returned in plaintext.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: PutSettingRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Setting saved",
      content: { "application/json": { schema: z.object({ ok: z.literal(true) }) } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/settings/{key}",
  tags: ["Settings"],
  summary: "Read a setting",
  description: "Returns the setting value. Secret keys return a masked preview (e.g. 'sk-an........lAQR') with `masked: true`.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ key: z.string() }) },
  responses: {
    200: {
      description: "Setting value",
      content: { "application/json": { schema: SettingResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/providers/status",
  tags: ["Providers"],
  summary: "Get provider availability status",
  description: "Checks availability of all supported container providers (local: Docker, Apple Container, Podman; cloud: Sprites, E2B, Vercel, Daytona, Fly, Modal).",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "Provider status map",
      content: { "application/json": { schema: ProviderStatusResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/models",
  tags: ["Models"],
  summary: "List available models",
  description: "Returns models available from configured provider APIs (Anthropic, OpenAI, Google, Ollama, OpenRouter). Results are cached for 4 hours. Supports filtering by engine, provider, and free-text search.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      engine: z.string().optional().describe("Filter to models compatible with this engine (claude, opencode, codex, gemini, factory, pi)."),
      provider: z.string().optional().describe("Filter by source provider (anthropic, openai, google, ollama, openrouter)."),
      q: z.string().optional().describe("Free-text search on model ID.")
    })
  },
  responses: {
    200: {
      description: "List of available models",
      content: { "application/json": { schema: ModelListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/traces",
  tags: ["Traces"],
  summary: "List recent traces",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      session_id: z.string().optional().describe("Filter by session ID."),
      limit: z.coerce.number().int().min(1).max(100).optional()
    })
  },
  responses: {
    200: {
      description: "List of traces",
      content: { "application/json": { schema: TraceListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/traces/{id}",
  tags: ["Traces"],
  summary: "Get a trace with full event log and span tree",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    query: z.object({
      limit: z.coerce.number().int().optional().describe("Max events to return. Defaults to 2000.")
    })
  },
  responses: {
    200: {
      description: "Trace detail",
      content: { "application/json": { schema: TraceDetailSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/traces/{id}/export",
  tags: ["Traces"],
  summary: "Export a trace via OTLP",
  description: "Triggers a synchronous OTLP export for the trace, bypassing the auto-export hook.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Export result",
      content: { "application/json": { schema: TraceExportResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/metrics",
  tags: ["Metrics"],
  summary: "Get session-level metrics",
  description: "On-read aggregation over sessions + events tables. Supports grouping by agent, environment, backend, hour, day, or api_key. Time-series mode available with `time_bucket` param.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      group_by: z.enum(["agent", "environment", "backend", "hour", "day", "api_key", "none"]).optional(),
      from: z.coerce.number().optional().describe("Start of window in ms since epoch. Defaults to 0."),
      to: z.coerce.number().optional().describe("End of window in ms since epoch. Defaults to now."),
      agent_id: z.string().optional(),
      environment_id: z.string().optional(),
      time_bucket: z.enum(["hour", "day", "week"]).optional().describe("Time-series bucket size. Only used with group_by=api_key.")
    })
  },
  responses: {
    200: {
      description: "Metrics snapshot",
      content: { "application/json": { schema: MetricsResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/metrics/api",
  tags: ["Metrics"],
  summary: "Get API throughput and latency metrics",
  description: "Global-admin-only. Returns real-time API throughput, latency percentiles, and status code distribution from an in-process ring buffer.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      window_minutes: z.coerce.number().int().min(1).max(60).optional().describe("Rolling window in minutes. Defaults to 60.")
    })
  },
  responses: {
    200: {
      description: "API metrics snapshot",
      content: { "application/json": { schema: ApiMetricsResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/api-keys",
  tags: ["API Keys"],
  summary: "Create an API key",
  description: "Admin-only. Creates a new virtual API key. The raw key value is returned ONCE in the response and must be stored by the caller.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateApiKeyRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "API key created (includes raw key)",
      content: { "application/json": { schema: ApiKeyCreatedSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/api-keys",
  tags: ["API Keys"],
  summary: "List API keys",
  description: "Admin-only. Returns all non-revoked API keys (without raw key values).",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "API key list",
      content: { "application/json": { schema: ApiKeyListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/api-keys/{id}",
  tags: ["API Keys"],
  summary: "Get an API key",
  description: "Admin-only.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "API key details",
      content: { "application/json": { schema: ApiKeySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "patch",
  path: "/v1/api-keys/{id}",
  tags: ["API Keys"],
  summary: "Update an API key's permissions",
  description: "Admin-only.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: PatchApiKeyRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "API key updated",
      content: { "application/json": { schema: ApiKeySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/api-keys/{id}",
  tags: ["API Keys"],
  summary: "Revoke an API key",
  description: "Admin-only. A key cannot revoke itself.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "API key revoked",
      content: { "application/json": { schema: ApiKeyRevokedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/api-keys/{id}/activity",
  tags: ["API Keys"],
  summary: "Get API key activity and cost attribution",
  description: "Admin-only (enterprise). Returns recent sessions, total cost, and error counts for a specific API key.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Key activity",
      content: { "application/json": { schema: ApiKeyActivityResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/upstream-keys",
  tags: ["Upstream Keys"],
  summary: "Add an upstream key to the pool",
  description: "Global-admin-only (enterprise). Adds a provider API key to the round-robin pool. Value is encrypted at rest.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: AddUpstreamKeyRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Upstream key added",
      content: { "application/json": { schema: UpstreamKeySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/upstream-keys",
  tags: ["Upstream Keys"],
  summary: "List upstream keys",
  description: "Global-admin-only (enterprise).",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      provider: z.string().optional().describe("Filter by provider (anthropic, openai, gemini).")
    })
  },
  responses: {
    200: {
      description: "Upstream key list",
      content: { "application/json": { schema: UpstreamKeyListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/upstream-keys/{id}",
  tags: ["Upstream Keys"],
  summary: "Get an upstream key",
  description: "Global-admin-only (enterprise).",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Upstream key details",
      content: { "application/json": { schema: UpstreamKeySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "patch",
  path: "/v1/upstream-keys/{id}",
  tags: ["Upstream Keys"],
  summary: "Enable or disable an upstream key",
  description: "Global-admin-only (enterprise).",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: PatchUpstreamKeyRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Upstream key updated",
      content: { "application/json": { schema: UpstreamKeySchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/upstream-keys/{id}",
  tags: ["Upstream Keys"],
  summary: "Delete an upstream key from the pool",
  description: "Global-admin-only (enterprise).",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Upstream key deleted",
      content: { "application/json": { schema: UpstreamKeyDeletedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/tenants",
  tags: ["Tenants"],
  summary: "Create a tenant",
  description: "Global-admin-only (enterprise). Creates a new tenant for multi-tenant isolation.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: CreateTenantRequestSchema } }
    }
  },
  responses: {
    201: {
      description: "Tenant created",
      content: { "application/json": { schema: TenantSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/tenants",
  tags: ["Tenants"],
  summary: "List tenants",
  description: "Global-admin-only (enterprise).",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      include_archived: z.enum(["true", "false"]).optional()
    })
  },
  responses: {
    200: {
      description: "Tenant list",
      content: { "application/json": { schema: TenantListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/tenants/{id}",
  tags: ["Tenants"],
  summary: "Get a tenant",
  description: "Global-admin-only (enterprise).",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Tenant details",
      content: { "application/json": { schema: TenantSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "patch",
  path: "/v1/tenants/{id}",
  tags: ["Tenants"],
  summary: "Update a tenant",
  description: "Global-admin-only (enterprise). Currently supports renaming.",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: PatchTenantRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "Tenant updated",
      content: { "application/json": { schema: TenantSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "delete",
  path: "/v1/tenants/{id}",
  tags: ["Tenants"],
  summary: "Archive a tenant",
  description: "Global-admin-only (enterprise). Cannot archive the default tenant.",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "Tenant archived",
      content: { "application/json": { schema: TenantArchivedResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/audit-log",
  tags: ["Audit"],
  summary: "List audit log entries",
  description: "Admin-only. Returns the append-only admin audit trail. Global admins see all entries; tenant admins see entries for their own tenant.",
  security: [{ ApiKey: [] }],
  request: {
    query: z.object({
      limit: z.coerce.number().int().optional(),
      page: z.string().optional().describe("ULID cursor for pagination."),
      action: z.string().optional().describe("Filter by action, e.g. 'tenants.create'."),
      actor_key_id: z.string().optional(),
      resource_type: z.string().optional(),
      resource_id: z.string().optional(),
      outcome: z.enum(["success", "denied", "failure"]).optional(),
      "created_at[gte]": z.string().optional().describe("Start of time range (ms or ISO string)."),
      "created_at[lte]": z.string().optional().describe("End of time range (ms or ISO string).")
    })
  },
  responses: {
    200: {
      description: "Audit log entries",
      content: { "application/json": { schema: AuditListResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/whoami",
  tags: ["Auth"],
  summary: "Get caller identity",
  description: "Returns the minimal auth context for the authenticated API key: name, tenant, admin status, and permissions.",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "Caller identity",
      content: { "application/json": { schema: WhoamiResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/v1/license",
  tags: ["Auth"],
  summary: "Get license info",
  description: "Returns the plan tier (community/enterprise) and enabled features. No auth required. The raw license key is never returned.",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "License info",
      content: { "application/json": { schema: LicenseResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/user_profiles",
  tags: ["User Profiles"],
  summary: "Create user profile",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: UserProfileCreateSchema } }
    }
  },
  responses: {
    201: {
      description: "Created",
      content: { "application/json": { schema: UserProfileSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/user_profiles",
  tags: ["User Profiles"],
  summary: "List user profiles",
  security: [{ ApiKey: [] }],
  responses: {
    200: {
      description: "OK",
      content: { "application/json": { schema: UserProfileListSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "get",
  path: "/anthropic/v1/user_profiles/{id}",
  tags: ["User Profiles"],
  summary: "Get user profile",
  security: [{ ApiKey: [] }],
  request: { params: z.object({ id: z.string() }) },
  responses: {
    200: {
      description: "OK",
      content: { "application/json": { schema: UserProfileSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/user_profiles/{id}",
  tags: ["User Profiles"],
  summary: "Update user profile",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: UserProfileUpdateSchema } }
    }
  },
  responses: {
    200: {
      description: "OK",
      content: { "application/json": { schema: UserProfileSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/anthropic/v1/user_profiles/{id}/enrollment_url",
  tags: ["User Profiles"],
  summary: "Generate OAuth enrollment URL",
  security: [{ ApiKey: [] }],
  request: {
    params: z.object({ id: z.string() }),
    body: {
      required: true,
      content: { "application/json": { schema: EnrollmentUrlRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "OK",
      content: { "application/json": { schema: EnrollmentUrlResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/v1/batch",
  tags: ["Batch"],
  summary: "Execute multiple operations atomically",
  description: "Wraps all operations in a single SQLite transaction. On any error, the transaction rolls back and the error is returned.",
  security: [{ ApiKey: [] }],
  request: {
    body: {
      required: true,
      content: { "application/json": { schema: BatchRequestSchema } }
    }
  },
  responses: {
    200: {
      description: "All operations succeeded",
      content: { "application/json": { schema: BatchResponseSchema } }
    },
    ...ErrorResponses
  }
});
registry.registerPath({
  method: "post",
  path: "/google/v1beta/interactions",
  tags: ["Google Compat"],
  summary: "Create interaction (Google compat)",
  description: "Google Interactions API compatibility. Accepts google-genai SDK format.",
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "get",
  path: "/google/v1beta/interactions/{id}",
  tags: ["Google Compat"],
  summary: "Get interaction (Google compat)",
  request: { params: z.object({ id: z.string() }) },
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "delete",
  path: "/google/v1beta/interactions/{id}",
  tags: ["Google Compat"],
  summary: "Delete interaction (Google compat)",
  request: { params: z.object({ id: z.string() }) },
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "post",
  path: "/google/v1beta/interactions/{id}/cancel",
  tags: ["Google Compat"],
  summary: "Cancel interaction (Google compat)",
  request: { params: z.object({ id: z.string() }) },
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "post",
  path: "/google/v1beta/agents",
  tags: ["Google Compat"],
  summary: "Create agent (Google compat)",
  responses: { 201: { description: "Created" } }
});
registry.registerPath({
  method: "get",
  path: "/google/v1beta/agents",
  tags: ["Google Compat"],
  summary: "List agents (Google compat)",
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "get",
  path: "/google/v1beta/agents/{id}",
  tags: ["Google Compat"],
  summary: "Get agent (Google compat)",
  request: { params: z.object({ id: z.string() }) },
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "delete",
  path: "/google/v1beta/agents/{id}",
  tags: ["Google Compat"],
  summary: "Delete agent (Google compat)",
  request: { params: z.object({ id: z.string() }) },
  responses: { 200: { description: "OK" } }
});
registry.registerPath({
  method: "get",
  path: "/google/v1beta/files/{fileRef}",
  tags: ["Google Compat"],
  summary: "Download environment files (Google compat)",
  request: { params: z.object({ fileRef: z.string() }) },
  responses: { 200: { description: "Tar archive", content: { "application/x-tar": { schema: z.string().openapi({ description: "Raw tar archive bytes." }) } } } }
});
function buildOpenApiDocument(opts) {
  const generator = new OpenApiGeneratorV31(registry.definitions);
  const meta = surfaceMetadata(opts.pathPrefix);
  const doc = generator.generateDocument({
    openapi: "3.1.0",
    info: {
      title: meta.title,
      version: "0.4.16",
      description: meta.description
    },
    servers: [{ url: opts.serverUrl, description: "This host" }],
    security: [{ ApiKey: [] }],
    tags: [
      { name: "Agents", description: "Agent CRUD and versioning" },
      { name: "Environments", description: "Container environment management" },
      { name: "Sessions", description: "Session lifecycle management" },
      { name: "Events", description: "Event append, history, and streaming" },
      { name: "Resources", description: "Session resource attachments" },
      { name: "Files", description: "File upload, download, and management" },
      { name: "Vaults", description: "Secret vault management" },
      { name: "Credentials", description: "Vault credential CRUD (structured auth)" },
      { name: "Memory", description: "Memory stores and memories" },
      { name: "Skills", description: "Skills catalog, search, and management" },
      { name: "Settings", description: "Gateway configuration settings" },
      { name: "Providers", description: "Container provider status" },
      { name: "Models", description: "Dynamic model registry" },
      { name: "Traces", description: "Distributed tracing and span trees" },
      { name: "Metrics", description: "Session and API metrics" },
      { name: "API Keys", description: "Virtual API key management (admin-only)" },
      { name: "Upstream Keys", description: "Upstream provider key pool (global-admin-only)" },
      { name: "Tenants", description: "Multi-tenant isolation (global-admin-only)" },
      { name: "Audit", description: "Admin audit trail" },
      { name: "Auth", description: "Caller identity and license info" },
      { name: "Batch", description: "Atomic batch operations" },
      { name: "User Profiles", description: "User profile management and OAuth enrollment" },
      { name: "Google Compat", description: "Google Interactions API compatibility layer" }
    ]
  });
  if (opts.pathPrefix) {
    const prefix = opts.pathPrefix;
    const filteredPaths = {};
    const allPaths = doc.paths ?? {};
    for (const [pathKey, pathDef] of Object.entries(allPaths)) {
      if (pathKey === prefix || pathKey.startsWith(prefix + "/")) {
        filteredPaths[pathKey] = pathDef;
      }
    }
    doc.paths = filteredPaths;
  }
  return doc;
}
function surfaceMetadata(pathPrefix) {
  switch (pathPrefix) {
    case "/anthropic/v1":
      return {
        title: "AgentStep \u2014 Anthropic Managed Agents API",
        description: "Anthropic Managed Agents API surface. Drop-in compatible with the official Anthropic Managed Agents API \u2014 change the baseURL on your Anthropic SDK and stay on the same shapes (agents, sessions, vaults, environments, files, threads, resources, user_profiles, oauth)."
      };
    case "/google/v1beta":
      return {
        title: "AgentStep \u2014 Google Interactions API",
        description: "Google Interactions API compatibility surface. Drop-in compatible with Google's Interactions API shape."
      };
    case "/v1":
      return {
        title: "AgentStep \u2014 Gateway-native API",
        description: "Gateway-native API surface: settings, api-keys, metrics, audit, tenants, upstream-keys, license, traces, providers, models, batch, skills, whoami, memory_stores, work. Anthropic-shaped resources live under /anthropic/v1/* and have their own spec at /anthropic/v1/openapi.json."
      };
    default:
      return {
        title: "AgentStep Gateway",
        description: "Open-source, drop-in replacement for the Claude Managed Agents API. Self-hosted agent gateway with 7 agent harnesses and 11 sandbox providers. Use with `@agentstep/agent-sdk` or the official Anthropic SDK \u2014 just change the baseURL."
      };
  }
}

export {
  buildOpenApiDocument
};
