fix(policies): rename CreateVersionDto to avoid swagger collision with automations

[tofikwest]

Problem

The create-policy-version MCP tool is completely broken. Callers either hit a 400 error from the API ("property scriptKey should not exist", "property version should not exist") or are blocked by the MCP client schema validation before the call even goes out. There's no valid path to use this tool.

Root cause

Two DTO classes share the name CreateVersionDto: one in the policies module (with sourceVersionId and changelog) and one in the automations module (with version and scriptKey). NestJS Swagger keys schema components by class name, so they collide in the OpenAPI spec. The merged component ended up with version+scriptKey marked as required. Speakeasy then generated the MCP tool from that collision, making those fields required. But the live policies endpoint validates inbound DTOs with a whitelist that rejects those two fields, causing the 400.

Fix

Gave the policies DTO a distinct OpenAPI component name via @ApiSchema({ name: 'CreatePolicyVersionDto' }). The class itself stays CreateVersionDto — only its Swagger component name changes — which is enough to remove the name collision with the automations DTO, so the policies endpoint gets its own correct schema (optional sourceVersionId + changelog).

Also regenerated packages/docs/openapi.json, the artifact Speakeasy builds the MCP server from, so the corrected schema actually reaches the generated create-policy-version tool. The regen is additive only: it introduces CreatePolicyVersionDto, repoints the policies versions endpoint to it, and catches the spec up to already-merged endpoints whose PRs never regenerated it (ISMS bulk measurements, four trust-portal request bodies, extra optional ISMS register fields). No existing component shape changed and nothing was removed.

Explicitly NOT touched

No changes to endpoint handlers, validation pipe config, auth, RBAC, billing, or automations module. The automations CreateVersionDto remains as-is.

Verification

✅ Unit tests for policies version creation pass locally with the distinct OpenAPI component name
✅ Added regression test asserting that the policy version endpoint accepts sourceVersionId and changelog and rejects version/scriptKey in the request body

Fixes CS-761

---

Summary by cubic

Fixes the create-policy-version MCP tool by renaming the policies DTO to avoid an OpenAPI component collision and regenerating the spec so the tool uses the correct schema. Restores the proper request shape (sourceVersionId, changelog) and removes 400s and client-side schema blocking. Addresses CS-761.

• Bug Fixes
  • Assigned a unique Swagger name via @ApiSchema({ name: 'CreatePolicyVersionDto' }) to stop @nestjs/swagger component collision with automations’ CreateVersionDto.
  • Regenerated packages/docs/openapi.json so the MCP tool is built from CreatePolicyVersionDto; also pulls in additive spec updates (ISMS bulk measurements, trust-portal request bodies, extra ISMS fields).
  • Added OpenAPI tests to ensure distinct components and verify policies only expose sourceVersionId and changelog (no version/scriptKey).

^{Written for commit c303de2. Summary will update on new commits.}

[linear]

CS-761

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Jul 22, 2026 2:52am
comp-framework-editor	Ready	Preview, Comment	Jul 22, 2026 2:52am
portal	Ready	Preview, Comment	Jul 22, 2026 2:52am

[cubic-dev-ai]

cubic analysis

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Linked issue analysis

Linked issue: CS-761: [Bug] - create-policy-version MCP Tool Schema Out of Sync with comp.ai API

Status	Acceptance criteria	Notes
✅	Eliminate OpenAPI component name collision so the policies DTO is distinct from automations' CreateVersionDto	The policies DTO was given an explicit OpenAPI name and the new OpenAPI test asserts the policy and automation request-body components are distinct.
✅	OpenAPI schema for POST /v1/policies/{id}/versions exposes sourceVersionId and changelog and does not include/require version or scriptKey	The OpenAPI-level test verifies the properties and required arrays to ensure the policies shape contains sourceVersionId/changelog and lacks version/scriptKey.
⚠️	create-policy-version MCP tool is unblocked end-to-end (no client-side schema blocking or API 400s due to scriptKey/version)	Server-side DTO rename and OpenAPI tests fix the root cause that produced client/schema mismatches; however the PR does not include a regenerated MCP client or an end-to-end call demonstrating the tool now succeeds, so full end-to-end evidence is not present in the diff.

_{Re-trigger cubic}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
CompAI	🟢 Ready	View Preview	Jul 21, 2026, 10:44 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[claudfuen]

🎉 This PR is included in version 3.106.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀