@archildata/api-types 0.0.1

package/index.d.ts

@@ -0,0 +1,1448 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/api/disks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List all disks
+         * @description Returns all disks owned by the authenticated account.
+         */
+        get: operations["listDisks"];
+        put?: never;
+        /**
+         * Create a new disk
+         * @description Creates a new disk with the specified configuration. A default token
+         *     user is automatically generated and returned in the response, so the
+         *     disk is immediately mountable. The one-time token appears in
+         *     `authorizedUsers[].token` and cannot be retrieved again.
+         *
+         *     To provide your own users instead, pass the deprecated `authMethods`
+         *     field or call AddDiskUser after creation.
+         */
+        post: operations["createDisk"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/disks/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get disk details
+         * @description Returns detailed information about a specific disk.
+         */
+        get: operations["getDisk"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete a disk
+         * @description Deletes a disk and all associated resources.
+         */
+        delete: operations["deleteDisk"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/disks/{id}/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add user to disk
+         * @description Adds an authorized user to a disk. Users can authenticate via:
+         *     - **token**: A shared token with a nickname and 4-character suffix
+         *     - **awssts**: AWS STS role assumption with an IAM principal ARN
+         */
+        post: operations["addDiskUser"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/disks/{id}/users/{userType}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove user from disk
+         * @description Removes an authorized user from a disk.
+         */
+        delete: operations["removeDiskUser"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/disks/{id}/allowed-ips": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get IP allowlist
+         * @description Returns the current IP allowlist for a disk.
+         */
+        get: operations["getAllowedIPs"];
+        /**
+         * Set IP allowlist
+         * @description Replaces the IP allowlist for a disk. When non-empty, only clients connecting from listed IPs or CIDR ranges can mount the disk. Pass an empty array to remove all restrictions.
+         */
+        put: operations["setAllowedIPs"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/disks/{id}/exec": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Execute a command on a disk
+         * @description Launches a container with the specified disk mounted, runs the given
+         *     command to completion, and shuts down the container. Returns immediately
+         *     with the container info; poll the container endpoint for completion.
+         */
+        post: operations["execDisk"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/disks/{id}/grep": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Constant-time parallel grep over a directory on a disk
+         * @description Searches files under a directory on the disk for lines matching a
+         *     regular expression. Listing and matching are fanned out across
+         *     ephemeral exec containers, so the request finishes within the user's
+         *     time budget regardless of the size of the directory.
+         *
+         *     The user controls cost and latency with three knobs:
+         *
+         *     - `maxDurationSeconds` is the wall-clock deadline.
+         *     - `concurrency` is the maximum number of parallel grep workers.
+         *       Higher concurrency finishes larger datasets within the deadline;
+         *       the controlplane clamps to the runtime fleet's current capacity.
+         *     - `maxResults` causes the search to short-circuit after the
+         *       aggregator has collected this many matches.
+         *
+         *     With `recursive: false` only files directly under `directory` are
+         *     searched. With `recursive: true` subdirectories are walked
+         *     breadth-first and grep workers are dispatched as soon as each level
+         *     finishes listing — listing and matching overlap.
+         *
+         *     The matches returned when stopping early on `maxResults` are a sample
+         *     of whichever workers reported first, not the lexicographically first
+         *     N. The response surfaces `stoppedReason` so callers can distinguish
+         *     completion from early termination.
+         */
+        post: operations["grepDisk"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/exec": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Execute a command with multiple disks mounted
+         * @description Launches a container with the supplied set of disks each mounted at its
+         *     own relative path under `/mnt/archil`, runs the command to completion,
+         *     and shuts down the container. Activation is atomic: every disk mounts
+         *     or none of them do.
+         *
+         *     Relative paths must be non-empty, non-absolute, and contain no `.` /
+         *     `..` segments. Mounting two disks at the same relative path is an
+         *     error.
+         */
+        post: operations["exec"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List API tokens
+         * @description Returns all API tokens for the authenticated account.
+         */
+        get: operations["listApiTokens"];
+        put?: never;
+        /**
+         * Create API token
+         * @description Creates a new API token for programmatic access. The full token value
+         *     is only returned once at creation time.
+         */
+        post: operations["createApiToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/tokens/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Delete API token
+         * @description Revokes and deletes an API token.
+         */
+        delete: operations["deleteApiToken"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        ErrorResponse: {
+            /** @example false */
+            success: boolean;
+            /** @example Invalid request parameters */
+            error: string;
+        };
+        ApiResponse_Empty: {
+            /** @example true */
+            success: boolean;
+        };
+        ApiResponse_Message: {
+            /** @example true */
+            success: boolean;
+            data: {
+                message?: string;
+            };
+        };
+        CreateDiskRequest: {
+            /**
+             * @description Disk name (alphanumeric, dashes, underscores)
+             * @example my-data-disk
+             */
+            name: string;
+            /** @description Storage mount to attach. Omit for archil-managed storage. */
+            mounts?: components["schemas"]["MountConfig"][];
+            /**
+             * @description IP allowlist for mount access. When non-empty, only clients connecting from these IPs or CIDR ranges can mount the disk. An empty list (default) allows all IPs.
+             * @example [
+             *       "203.0.113.0/24",
+             *       "198.51.100.42"
+             *     ]
+             */
+            allowedIps?: string[];
+            /**
+             * @deprecated
+             * @description Deprecated. Use AddDiskUser after creation instead. When provided, suppresses the default auto-generated token user.
+             */
+            authMethods?: components["schemas"]["DiskUser"][];
+        };
+        MountConfig: components["schemas"]["S3Mount"] | components["schemas"]["GCSMount"] | components["schemas"]["R2Mount"] | components["schemas"]["S3CompatibleMount"] | components["schemas"]["AzureBlobMount"];
+        /**
+         * S3
+         * @description Mount configuration for Amazon S3 buckets
+         */
+        S3Mount: {
+            /**
+             * @description Mount type identifier (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            type: "s3";
+            /**
+             * @description S3 bucket name
+             * @example my-bucket
+             */
+            bucketName: string;
+            /** @description AWS access key ID (optional for public buckets or IAM role auth) */
+            accessKeyId?: string;
+            /**
+             * Format: password
+             * @description AWS secret access key
+             */
+            secretAccessKey?: string;
+            /** @description Session token for temporary credentials */
+            sessionToken?: string;
+            /**
+             * @description Prefix within the bucket
+             * @example data/
+             */
+            bucketPrefix?: string;
+        };
+        /**
+         * Google Cloud Storage
+         * @description Mount configuration for Google Cloud Storage buckets
+         */
+        GCSMount: {
+            /**
+             * @description Mount type identifier (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            type: "gcs";
+            /**
+             * @description GCS bucket name
+             * @example my-gcs-bucket
+             */
+            bucketName: string;
+            /** @description HMAC access key ID */
+            accessKeyId: string;
+            /**
+             * Format: password
+             * @description HMAC secret access key
+             */
+            secretAccessKey: string;
+            /**
+             * @description Prefix within the bucket (optional)
+             * @example data/
+             */
+            bucketPrefix?: string;
+        };
+        /**
+         * Cloudflare R2
+         * @description Mount configuration for Cloudflare R2 buckets
+         */
+        R2Mount: {
+            /**
+             * @description Mount type identifier (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            type: "r2";
+            /**
+             * @description R2 bucket name
+             * @example my-r2-bucket
+             */
+            bucketName: string;
+            /**
+             * @description R2 endpoint URL
+             * @example https://accountid.r2.cloudflarestorage.com
+             */
+            bucketEndpoint: string;
+            /** @description R2 access key ID */
+            accessKeyId: string;
+            /**
+             * Format: password
+             * @description R2 secret access key
+             */
+            secretAccessKey: string;
+            /**
+             * @description Prefix within the bucket (optional)
+             * @example data/
+             */
+            bucketPrefix?: string;
+        };
+        /**
+         * S3-Compatible
+         * @description Mount configuration for S3-compatible storage (MinIO, Backblaze B2, etc.)
+         */
+        S3CompatibleMount: {
+            /**
+             * @description Mount type identifier (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            type: "s3-compatible";
+            /**
+             * @description Bucket name
+             * @example my-bucket
+             */
+            bucketName: string;
+            /**
+             * @description S3-compatible endpoint URL
+             * @example https://s3.us-west-001.backblazeb2.com
+             */
+            bucketEndpoint: string;
+            /** @description Access key ID */
+            accessKeyId: string;
+            /**
+             * Format: password
+             * @description Secret access key
+             */
+            secretAccessKey: string;
+            /**
+             * @description Prefix within the bucket (optional)
+             * @example data/
+             */
+            bucketPrefix?: string;
+        };
+        /**
+         * Azure Blob Storage
+         * @description Mount configuration for Azure Blob Storage containers
+         */
+        AzureBlobMount: {
+            /**
+             * @description Mount type identifier (enum property replaced by openapi-typescript)
+             * @enum {string}
+             */
+            type: "azure-blob";
+            /**
+             * @description Azure blob container name
+             * @example my-container
+             */
+            containerName: string;
+            /**
+             * @description Azure blob endpoint URL (optional if storageAccountName provided)
+             * @example https://myaccount.blob.core.windows.net
+             */
+            endpoint?: string;
+            /**
+             * @description Azure storage account name (used to derive endpoint if not provided)
+             * @example myaccount
+             */
+            storageAccountName?: string;
+            /** @description Azure AD tenant ID */
+            tenantId: string;
+            /** @description Azure AD application client ID */
+            clientId: string;
+            /**
+             * Format: password
+             * @description Azure AD application client secret
+             */
+            clientSecret: string;
+            /**
+             * @description Prefix within the container
+             * @example data/
+             */
+            bucketPrefix?: string;
+        };
+        TokenUser: {
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "token";
+            /**
+             * @deprecated
+             * @description Deprecated. Client-provided token. If omitted, the server generates a cryptographically secure token and returns it in the response.
+             */
+            principal?: string;
+            nickname: string;
+            /**
+             * @deprecated
+             * @description Deprecated. Last 4 characters of the token. Required when principal is provided; ignored when the server generates the token.
+             */
+            tokenSuffix?: string;
+        };
+        AwsStsUser: {
+            /**
+             * @description discriminator enum property added by openapi-typescript
+             * @enum {string}
+             */
+            type: "awssts";
+            /** @description IAM principal ARN */
+            principal: string;
+        };
+        DiskUser: components["schemas"]["TokenUser"] | components["schemas"]["AwsStsUser"];
+        DiskResponse: {
+            /**
+             * @description Disk ID
+             * @example dsk-0123456789abcdef
+             */
+            id: string;
+            /** @description Disk name */
+            name: string;
+            /** @description Owning organization ID */
+            organization: string;
+            /**
+             * @description Disk status
+             * @enum {string}
+             */
+            status: "available" | "creating" | "deleting" | "deleted" | "failed";
+            /** @description Filesystem handler status */
+            fsHandlerStatus?: string;
+            /** @description Cloud provider */
+            provider: string;
+            /** @description Disk region (e.g., aws-us-east-1, gcp-us-central1) */
+            region: string;
+            /**
+             * Format: date-time
+             * @description Creation timestamp
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Last access timestamp
+             */
+            lastAccessed?: string;
+            /**
+             * Format: int64
+             * @description Total data size in bytes
+             */
+            dataSize?: number;
+            /** @description Monthly usage amount formatted as a currency string (e.g., "$1.23") */
+            monthlyUsage?: string;
+            mounts?: components["schemas"]["MountResponse"][];
+            metrics?: components["schemas"]["DiskMetrics"];
+            connectedClients?: components["schemas"]["ConnectedClient"][];
+            authorizedUsers?: components["schemas"]["AuthorizedUser"][];
+            /**
+             * @description IP allowlist for mount access. Empty means all IPs are allowed.
+             * @example [
+             *       "203.0.113.0/24"
+             *     ]
+             */
+            allowedIps?: string[];
+            /**
+             * @description Capabilities supported by this disk. Determined at creation
+             *     time and immutable thereafter. Defined values:
+             *
+             *     * `checkpoints` — checkpoints can be created on this disk. Not
+             *       available for disks with bring-your-own buckets.
+             * @example [
+             *       "checkpoints"
+             *     ]
+             */
+            capabilities?: "checkpoints"[];
+        };
+        MountResponse: {
+            /** @description Mount identifier */
+            id?: string;
+            /**
+             * @description Storage backend type
+             * @enum {string}
+             */
+            type?: "s3" | "gcs" | "r2" | "s3-compatible" | "azure-blob";
+            /** @description Mount path */
+            path?: string;
+            /** @description Bucket/container name */
+            name?: string;
+            /**
+             * @description Access mode
+             * @example rw
+             * @enum {string}
+             */
+            accessMode?: "rw" | "ro";
+            config?: components["schemas"]["MountConfigResponse"];
+            /**
+             * @description Current connection status
+             * @enum {string}
+             */
+            connectionStatus?: "connected" | "disconnected";
+            /** @description Authentication error message (if disconnected) */
+            authError?: string;
+            /**
+             * @description How the mount authenticates to the storage backend
+             * @enum {string}
+             */
+            authorizationType?: "iam" | "accessKeys" | "oauth";
+        };
+        /** @description Mount configuration details (secrets omitted) */
+        MountConfigResponse: {
+            /** @description Bucket name */
+            bucketName?: string;
+            /** @description Storage endpoint URL */
+            bucketEndpoint?: string;
+            /** @description Prefix within the bucket */
+            bucketPrefix?: string;
+            /** @description Session identifier for IAM-authorized mounts */
+            sessionId?: string;
+        };
+        DiskMetrics: {
+            /** @description Data transfer amount with unit (e.g., "1.5 GB") */
+            dataTransfer?: string;
+            /** @description Total request count as a formatted string (e.g., "1,234") */
+            requests?: string;
+            /** @description Average response time with unit (e.g., "45ms") */
+            avgResponseTime?: string;
+        };
+        ConnectedClient: {
+            id?: string;
+            ipAddress?: string;
+            /** Format: date-time */
+            connectedAt?: string;
+        };
+        AuthorizedUser: {
+            /** @enum {string} */
+            type?: "token" | "awssts";
+            /**
+             * @deprecated
+             * @description Use identifier instead. Only populated for awssts type (the IAM ARN).
+             */
+            principal?: string;
+            nickname?: string;
+            tokenSuffix?: string;
+            /** @description The generated mount token. Only present in the response when the server generates the token (i.e. principal was not provided). This value is shown exactly once and cannot be retrieved again. */
+            token?: string;
+            /** @description Stable identifier for this user, returned in creation and list responses. Use this value with DELETE /api/disks/{id}/users/{type}?identifier={identifier} to remove the user. For awssts users, this is the IAM ARN. */
+            identifier?: string;
+            /** Format: date-time */
+            createdAt?: string;
+        };
+        /** @description All API responses use a standard envelope with `success: boolean` and `data` (on success) or `error: string` (on failure). The ApiResponse_* schemas each define the specific `data` shape for their endpoint. */
+        ApiResponse_DiskList: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["DiskResponse"][];
+        };
+        ApiResponse_Disk: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["DiskResponse"];
+        };
+        ApiResponse_CreateDisk: {
+            /** @example true */
+            success: boolean;
+            data: {
+                /** @example dsk-0123456789abcdef */
+                diskId?: string;
+                authorizedUsers?: components["schemas"]["AuthorizedUser"][];
+            };
+        };
+        ApiResponse_AuthorizedUser: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["AuthorizedUser"];
+        };
+        ApiResponse_AllowedIPs: {
+            /** @example true */
+            success: boolean;
+            data: {
+                /**
+                 * @example [
+                 *       "203.0.113.0/24",
+                 *       "198.51.100.42"
+                 *     ]
+                 */
+                allowedIps: string[];
+            };
+        };
+        CreateApiTokenRequest: {
+            /** @description Token name */
+            name: string;
+            /** @description Token description */
+            description?: string;
+        };
+        ApiTokenResponse: {
+            /** @description Token hash/ID */
+            id?: string;
+            name?: string;
+            description?: string;
+            /** @description Last 4 characters of the token */
+            tokenSuffix?: string;
+            /** Format: date-time */
+            createdAt?: string;
+            /** Format: date-time */
+            lastUsedAt?: string;
+        };
+        ApiResponse_TokenList: {
+            /** @example true */
+            success: boolean;
+            data: {
+                tokens?: components["schemas"]["ApiTokenResponse"][];
+            };
+        };
+        ApiResponse_TokenCreated: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["ApiTokenResponse"] & {
+                /**
+                 * @description Full token value (only shown at creation)
+                 * @example key-abc123...
+                 */
+                token?: string;
+            };
+        };
+        ExecDiskRequest: {
+            /**
+             * @description Shell command to execute inside the container
+             * @example ls -la /mnt/archil
+             */
+            command: string;
+        };
+        ExecDiskResult: {
+            /**
+             * @description Exit code of the command (0 = success)
+             * @example 0
+             */
+            exitCode: number;
+            /** @description Standard output from the command */
+            stdout: string;
+            /** @description Standard error from the command */
+            stderr: string;
+            timing: components["schemas"]["ExecTiming"];
+        };
+        /** @description Server-measured timings for an exec request. */
+        ExecTiming: {
+            /**
+             * @description End-to-end wall clock measured on the server, from request arrival to response.
+             * @example 2450
+             */
+            totalMs: number;
+            /**
+             * @description Time spent queueing, scheduling, booting/claiming a VM, and mounting the filesystem before the command started running.
+             * @example 150
+             */
+            queueMs: number;
+            /**
+             * @description Time the user's command itself ran, measured by the runtime.
+             * @example 2300
+             */
+            executeMs: number;
+        };
+        ApiResponse_ExecDisk: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["ExecDiskResult"];
+        };
+        ExecRequest: {
+            /**
+             * @description Map of relative path under `/mnt/archil` to the disk to mount
+             *     there. At least one entry is required. Relative paths must be
+             *     non-empty, non-absolute, and contain no `.` or `..` segments.
+             *
+             *     Each value is either a plain disk ID string (mounts the disk's
+             *     root, read-write) or an object that additionally selects a
+             *     subdirectory of the disk and/or marks the mount as read-only,
+             *     conditional, or requests delegation checkouts before the command
+             *     starts. `checkoutPaths` are relative to that disk's exposed mount
+             *     root. `queueMs` is an optional timeout for delegation acquisition;
+             *     with `checkoutPaths`, it applies to each requested checkout, and
+             *     without `checkoutPaths`, the mount root is acquired during mount
+             *     setup. Delegation checkout options are rejected with `readOnly:
+             *     true`.
+             * @example {
+             *       "data": "dsk-abc123",
+             *       "logs": {
+             *         "disk": "dsk-def456",
+             *         "subdirectory": "app/logs",
+             *         "readOnly": true
+             *       }
+             *     }
+             */
+            disks: {
+                [key: string]: string | components["schemas"]["ExecMount"];
+            };
+            /**
+             * @description Shell command to execute inside the container
+             * @example ls -la /mnt/archil/data /mnt/archil/logs
+             */
+            command: string;
+        };
+        ExecMount: {
+            /**
+             * @description Disk ID to mount at this relative path
+             * @example dsk-abc123
+             */
+            disk: string;
+            /**
+             * @description Subdirectory of the disk to expose at the mountpoint. Must be a
+             *     relative path with no `.` or `..` segments. When omitted, the
+             *     disk's root is exposed.
+             * @example app/logs
+             */
+            subdirectory?: string;
+            /**
+             * @description When true, the disk is mounted read-only inside the container.
+             *     Writes against the mount fail with EROFS.
+             * @default false
+             */
+            readOnly: boolean;
+            /**
+             * @description When true, the disk is mounted in conditional mode, where mutating
+             *     operations are sent directly to the server without a delegation
+             *     checkout. This enables concurrent writes from multiple clients to
+             *     the same disk.
+             * @default false
+             */
+            conditional: boolean;
+            /**
+             * Format: uint64
+             * @description Optional delegation checkout queue timeout, in milliseconds. With
+             *     `checkoutPaths`, it applies to each requested checkout. Without
+             *     `checkoutPaths`, the exposed mount root is acquired during mount
+             *     setup. Rejected with `readOnly: true`.
+             */
+            queueMs?: number;
+            /**
+             * @description Paths relative to this disk's exposed mount root to check out before
+             *     the command starts. May be set without `queueMs`; those checkouts
+             *     try immediately without waiting in the delegation queue. Rejected
+             *     with `readOnly: true`.
+             * @example [
+             *       "src",
+             *       "tmp/cache"
+             *     ]
+             */
+            checkoutPaths?: string[];
+        };
+        ApiResponse_Exec: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["ExecDiskResult"];
+        };
+        GrepDiskRequest: {
+            /**
+             * @description Directory on the disk to search, relative to the disk root.
+             *     An empty string or "/" means the disk root.
+             * @example data/logs
+             */
+            directory: string;
+            /**
+             * @description Extended regular expression (passed to `grep -E`)
+             * @example ERROR|FATAL
+             */
+            pattern: string;
+            /**
+             * @description When true, walks subdirectories breadth-first.
+             * @default false
+             */
+            recursive: boolean;
+            /**
+             * @description Wall-clock deadline for the entire request. Capped at 30
+             *     seconds because the runtime exec container itself is bounded
+             *     at ~30s; longer requests would have their workers killed
+             *     mid-scan.
+             * @default 30
+             */
+            maxDurationSeconds: number;
+            /**
+             * @description Maximum number of parallel grep workers. Higher values finish
+             *     larger datasets within the deadline but consume more runtime
+             *     capacity. The controlplane clamps this to the fleet's
+             *     currently-available capacity.
+             * @default 50
+             */
+            concurrency: number;
+            /**
+             * @description Stop scanning once the aggregator has this many matches.
+             *     Returned matches are a sample of whichever workers reported
+             *     first, not the lexicographically first N.
+             * @default 1000
+             */
+            maxResults: number;
+        };
+        GrepMatch: {
+            /**
+             * @description Path to the file (relative to the disk root).
+             * @example data/logs/2026-05-03.log
+             */
+            file: string;
+            /**
+             * @description 1-based line number where the match occurred.
+             * @example 142
+             */
+            line: number;
+            /** @description The matching line. */
+            text: string;
+        };
+        /**
+         * @description Why the search stopped.
+         *     - `completed`: every file under the directory was scanned successfully.
+         *     - `incomplete`: pipeline ran to its natural end but one or more
+         *       batches errored (invalid regex, unreadable file, runtime issue).
+         *       Results may be partial or wrong; do not rely on completeness.
+         *     - `max_results`: hit `maxResults` before scanning everything.
+         *     - `deadline`: hit `maxDurationSeconds`.
+         *     - `list_failed`: directory listing failed; partial results
+         *       may be present.
+         * @enum {string}
+         */
+        GrepStoppedReason: "completed" | "incomplete" | "max_results" | "deadline" | "list_failed";
+        GrepDiskResult: {
+            matches: components["schemas"]["GrepMatch"][];
+            stoppedReason: components["schemas"]["GrepStoppedReason"];
+            /** @description Files actually fed to a grep container. */
+            filesScanned: number;
+            /** @description Number of grep containers started for this request. */
+            containersDispatched: number;
+            /**
+             * Format: double
+             * @description Sum of per-container execution time in seconds, measured by the
+             *     runtime. Approximates billable container-seconds.
+             */
+            computeSecondsUsed: number;
+            /** @description End-to-end wall clock measured by the server. */
+            durationMs: number;
+            /**
+             * @description Wall-clock time spent enumerating files via listObjects, from
+             *     the request's start to the moment listing fully drained (or
+             *     was canceled). Listing and matching overlap, so listingMs +
+             *     grepMs typically exceeds durationMs.
+             */
+            listingMs: number;
+            /**
+             * @description Wall-clock time spent matching, from the first grep container
+             *     being dispatched to the last container reporting results. 0 if
+             *     no batches ran.
+             */
+            grepMs: number;
+        };
+        ApiResponse_GrepDisk: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["GrepDiskResult"];
+        };
+    };
+    responses: {
+        /** @description Invalid or missing authentication credentials */
+        Unauthorized: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+        /** @description Validation error */
+        ValidationError: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+        /** @description Resource not found */
+        NotFound: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+        /** @description Internal server error */
+        InternalError: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorResponse"];
+            };
+        };
+    };
+    parameters: {
+        /** @description Disk ID (format `dsk-{16 hex chars}`) */
+        DiskId: string;
+        /** @description Maximum number of items to return */
+        Limit: number;
+        /** @description Pagination cursor from a previous response */
+        Cursor: string;
+    };
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    listDisks: {
+        parameters: {
+            query?: {
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["Limit"];
+                /** @description Pagination cursor from a previous response */
+                cursor?: components["parameters"]["Cursor"];
+                /** @description Filter disks by exact name match. */
+                name?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of disks */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_DiskList"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    createDisk: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateDiskRequest"];
+            };
+        };
+        responses: {
+            /** @description Disk with this name already exists and configuration matches (idempotent) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_CreateDisk"];
+                };
+            };
+            /** @description Disk created successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_CreateDisk"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            /** @description Access denied (e.g., preview region not enabled) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Disk with this name already exists but configuration differs */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            500: components["responses"]["InternalError"];
+        };
+    };
+    getDisk: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Disk details */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_Disk"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    deleteDisk: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Disk deleted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_Empty"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    addDiskUser: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DiskUser"];
+            };
+        };
+        responses: {
+            /** @description User added successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_AuthorizedUser"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    removeDiskUser: {
+        parameters: {
+            query?: {
+                /** @description Identifier of the user to remove, as returned in the creation or list response. For awssts users, this is the IAM ARN. */
+                identifier?: string;
+                /**
+                 * @deprecated
+                 * @description Use identifier instead.
+                 */
+                principal?: string;
+            };
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+                /** @description The type of user authentication */
+                userType: "token" | "awssts";
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User removed successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_Message"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    getAllowedIPs: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Current IP allowlist */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_AllowedIPs"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    setAllowedIPs: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description List of IPs or CIDR ranges. Empty array removes restrictions.
+                     * @example [
+                     *       "203.0.113.0/24",
+                     *       "198.51.100.42"
+                     *     ]
+                     */
+                    allowedIps: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Allowlist updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_AllowedIPs"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    execDisk: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ExecDiskRequest"];
+            };
+        };
+        responses: {
+            /** @description Command completed */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_ExecDisk"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+            /** @description Command timed out */
+            504: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    grepDisk: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Disk ID (format `dsk-{16 hex chars}`) */
+                id: components["parameters"]["DiskId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["GrepDiskRequest"];
+            };
+        };
+        responses: {
+            /** @description Grep completed (possibly stopped early) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_GrepDisk"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    exec: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ExecRequest"];
+            };
+        };
+        responses: {
+            /** @description Command completed */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_Exec"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+            /** @description Command timed out */
+            504: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    listApiTokens: {
+        parameters: {
+            query?: {
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["Limit"];
+                /** @description Pagination cursor from a previous response */
+                cursor?: components["parameters"]["Cursor"];
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description List of API tokens */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_TokenList"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    createApiToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateApiTokenRequest"];
+            };
+        };
+        responses: {
+            /** @description Token created successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_TokenCreated"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+    deleteApiToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The token ID (hash) */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Token deleted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_Message"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+        };
+    };
+}