@spec add(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}

Adds an MCP server for the owner's agents. Returns whether they can call it now.

@spec ceilings(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}

Lists the org's ceilings, with what its agents have spent in the current period.

@spec connect(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}

Returns that the account is connected, or where the owner signs in to connect it.

@spec connections(Wardrik.Scope.t(), map()) :: {:ok, map()}

Lists the accounts the owner can connect, and whether each is connected.

These are Wardrik's OAuth providers, plus each server the owner added that uses browser sign-in. A server replaces a provider of the same name.

@spec delete_secret(Wardrik.Scope.t(), map()) ::
  {:ok, nil} | {:error, Wardrik.Error.t()}

Removes one of the owner's secrets. Succeeds if there's none.

@spec disconnect(Wardrik.Scope.t(), map()) ::
  {:ok, map()} | {:error, Wardrik.Error.t()}

Disconnects an account. The next call that needs it asks the owner to sign in again.

@spec put_secret(Wardrik.Scope.t(), map()) :: {:ok, nil} | {:error, Wardrik.Error.t()}

Seals a secret for the owner, replacing any with the same name.

@spec remove(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}

Removes an MCP server the owner added, and its sign-ins. Returns the removed server.

@spec secrets(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}

Lists the owner's secrets by name, with each one's kind: a secret or a connected account.

@spec servers(Wardrik.Scope.t(), map()) :: {:ok, map()}

Lists the MCP servers the owner added.