@artifact-keeper/sdk 1.3.0 → 1.4.0

package/src/types.gen.ts

@@ -52,6 +52,32 @@ export type AdvancedSearchResponse = {
     pagination: PaginationInfo;
 };
 
+export type AgeGateConfigResponse = {
+    enabled: boolean;
+    min_age_days: number;
+    repository_key: string;
+};
+
+export type AgeGateReviewListResponse = {
+    items: Array<AgeGateReviewResponse>;
+    pagination: Pagination;
+};
+
+export type AgeGateReviewResponse = {
+    id: string;
+    last_requested_at: string;
+    package_name: string;
+    package_version: string;
+    repository_key: string;
+    request_count: number;
+    requested_at: string;
+    review_reason?: string | null;
+    reviewed_at?: string | null;
+    reviewed_by?: string | null;
+    status: string;
+    upstream_published_at?: string | null;
+};
+
 /**
  * Alert state for a service.
  */
@@ -218,6 +244,19 @@ export type ArtifactMetadataResponse = {
 };
 
 export type ArtifactResponse = {
+    /**
+     * Whether this artifact can have an SBOM generated or a security scan
+     * run against it. `false` for proxy-cached (Remote) objects: those are
+     * listed with a synthetic, SHA-256-derived id (see
+     * [`cached_artifact_id`]) and have no row in the `artifacts` table
+     * (#1280/#1278), so SBOM/scan lookups by `artifacts.id` cannot resolve
+     * them and `sbom_documents`/`scan_results` cannot reference them.
+     * `true` for hosted artifacts, which carry a real DB id. The web UI
+     * uses this to hide/disable the "Generate SBOM" / "Scan" actions where
+     * they cannot work; clients that predate the field should treat an
+     * absent value as `true` so hosted artifacts are never hidden. (#2227)
+     */
+    analyzable: boolean;
     /**
      * When the proxy cache entry for this artifact was last written.
      * Only populated for Remote (proxy) repositories whose proxy service is
@@ -552,6 +591,67 @@ export type ChunkResponse = {
     chunks_remaining: number;
 };
 
+export type CiOidcMappingResponse = {
+    allowed_repo_ids?: Array<string> | null;
+    claim_filters: unknown;
+    created_at: string;
+    id: string;
+    is_enabled: boolean;
+    name: string;
+    priority: number;
+    provider_id: string;
+    updated_at: string;
+};
+
+export type CiOidcProviderResponse = {
+    audience: string;
+    created_at: string;
+    id: string;
+    is_enabled: boolean;
+    issuer_url: string;
+    mapping_count: number;
+    name: string;
+    provider_type: string;
+    updated_at: string;
+};
+
+/**
+ * Body for toggle endpoint.
+ */
+export type CiOidcToggleRequest = {
+    enabled: boolean;
+};
+
+export type CiTokenRequest = {
+    /**
+     * UUID of the `ci_oidc_providers` row to use for validation.
+     */
+    provider_id: string;
+};
+
+export type CiTokenResponse = {
+    /**
+     * Short-lived Artifact Keeper access token.
+     */
+    access_token: string;
+    /**
+     * Lifetime in seconds (default 900 = 15 min).
+     *
+     * Docker caches credentials and does not auto-refresh. Re-exchange the
+     * CI JWT before each `docker push` step if the pipeline runs longer
+     * than this window.
+     */
+    expires_in: number;
+    token_type: string;
+    /**
+     * The provisioned CI service-account username.
+     *
+     * Use this directly as `docker login --username` — no separate
+     * `GET /api/v1/auth/me` call is needed.
+     */
+    username: string;
+};
+
 export type CleanupRequest = {
     cleanup_audit_logs?: boolean | null;
     cleanup_old_backups?: boolean | null;
@@ -689,6 +789,22 @@ export type CreateBuildRequest = {
     vcs_url?: string | null;
 };
 
+export type CreateCiOidcMappingRequest = {
+    allowed_repo_ids?: Array<string> | null;
+    claim_filters: unknown;
+    is_enabled?: boolean | null;
+    name: string;
+    priority?: number | null;
+};
+
+export type CreateCiOidcProviderRequest = {
+    audience?: string | null;
+    is_enabled?: boolean | null;
+    issuer_url: string;
+    name: string;
+    provider_type?: string | null;
+};
+
 export type CreateConnectionRequest = {
     auth_type: string;
     credentials: ConnectionCredentials;
@@ -778,6 +894,14 @@ export type CreateMigrationRequest = {
 };
 
 export type CreateOidcConfigRequest = {
+    /**
+     * Opt-in compatibility flag (migration 144): when `true` the provider
+     * accepts ID tokens signed with RSA keys shorter than 2048 bits via a
+     * restricted RS256/384/512 PKCS#1 v1.5 fallback path. Defaults to
+     * `false`. Below the OWASP ASVS 4.0 baseline; only enable for legacy
+     * IdPs such as Lark AnyCross.
+     */
+    allow_legacy_rsa_keys?: boolean | null;
     attribute_mapping?: {
         [key: string]: unknown;
     } | null;
@@ -891,6 +1015,19 @@ export type CreateRepositoryRequest = {
      * Defaults to false (no behavior change for existing repositories).
      */
     promotion_only?: boolean | null;
+    /**
+     * Override the PyPI simple-index prefix for upstreams that do not follow
+     * the standard PEP 503 `/simple/` layout (issue #1546).
+     *
+     * - Omit or `"simple"` — standard PEP 503 (pypi.org, devpi, Nexus). Default.
+     * - `""` (empty) — flat CDN (e.g. `https://download.pytorch.org/whl/cpu`):
+     * package files are served directly under the upstream root with no prefix.
+     * - Any other non-empty string — custom index prefix.
+     *
+     * Stored in `repository_config` under `pypi_upstream_index_path`.
+     * Only meaningful for PyPI / Poetry / Conda Remote repositories.
+     */
+    pypi_upstream_index_path?: string | null;
     quota_bytes?: number | null;
     repo_type: string;
     /**
@@ -2441,6 +2578,13 @@ export type OciBlobRepoFootprint = {
 };
 
 export type OidcConfigResponse = {
+    /**
+     * Opt-in compatibility flag (migration 144): when true the OIDC
+     * provider accepts ID tokens signed with RSA keys shorter than
+     * 2048 bits via a restricted RS256/384/512 PKCS#1 v1.5 path.
+     * Below the OWASP ASVS 4.0 baseline; only enable for legacy IdPs.
+     */
+    allow_legacy_rsa_keys: boolean;
     attribute_mapping: {
         [key: string]: unknown;
     };
@@ -3227,6 +3371,17 @@ export type RestoreResponse = {
     tables_restored: Array<string>;
 };
 
+export type ReviewActionRequest = {
+    reason?: string | null;
+};
+
+export type ReviewListQuery = {
+    page?: number | null;
+    per_page?: number | null;
+    repository_key?: string | null;
+    status?: string | null;
+};
+
 export type ReviewRequest = {
     /**
      * Optional reviewer notes
@@ -4120,6 +4275,11 @@ export type UninstallQuery = {
     force?: boolean | null;
 };
 
+export type UpdateAgeGateConfigRequest = {
+    enabled: boolean;
+    min_age_days: number;
+};
+
 export type UpdateAnalysisBody = {
     component_uuid: string;
     details?: string | null;
@@ -4140,6 +4300,22 @@ export type UpdateChunkAvailabilityBody = {
     total_chunks: number;
 };
 
+export type UpdateCiOidcMappingRequest = {
+    allowed_repo_ids?: Array<string> | null;
+    claim_filters?: unknown;
+    is_enabled?: boolean | null;
+    name?: string | null;
+    priority?: number | null;
+};
+
+export type UpdateCiOidcProviderRequest = {
+    audience?: string | null;
+    is_enabled?: boolean | null;
+    issuer_url?: string | null;
+    name?: string | null;
+    provider_type?: string | null;
+};
+
 export type UpdateCveStatusRequest = {
     reason?: string | null;
     status: string;
@@ -4182,6 +4358,7 @@ export type UpdateLdapConfigRequest = {
 };
 
 export type UpdateOidcConfigRequest = {
+    allow_legacy_rsa_keys?: boolean | null;
     /**
      * Partial update for `attribute_mapping`. Keys present in this object
      * overwrite the matching keys in the stored mapping. Keys not present
@@ -4267,6 +4444,13 @@ export type UpdateRepositoryRequest = {
      * repository (admin-only). When omitted, the flag is left unchanged.
      */
     promotion_only?: boolean | null;
+    /**
+     * Update the PyPI simple-index prefix (stored in `repository_config` under
+     * `pypi_upstream_index_path`). Pass `""` for flat CDN layout, `"simple"` to
+     * restore the PEP 503 default, or any other non-empty string for a custom prefix.
+     * Only meaningful for PyPI / Poetry / Conda Remote repositories.
+     */
+    pypi_upstream_index_path?: string | null;
     /**
      * Quarantine hold duration in minutes for this repository.
      * Stored in `repository_config` under `quarantine_duration_minutes`.
@@ -4473,7 +4657,7 @@ export type WasmPluginResponse = {
 /**
  * Webhook event types
  */
-export type WebhookEvent = 'artifact_uploaded' | 'artifact_deleted' | 'repository_created' | 'repository_deleted' | 'user_created' | 'user_deleted' | 'build_started' | 'build_completed' | 'build_failed';
+export type WebhookEvent = 'artifact_uploaded' | 'artifact_deleted' | 'repository_created' | 'repository_deleted' | 'user_created' | 'user_deleted' | 'build_started' | 'build_completed' | 'build_failed' | 'age_gate_queued' | 'age_gate_approved' | 'age_gate_rejected';
 
 export type WebhookListResponse = {
     items: Array<WebhookResponse>;
@@ -4532,6 +4716,69 @@ export type WebhookSecretCreatedResponse = WebhookResponse & {
     secret?: string | null;
 };
 
+export type ListReviewsData = {
+    body?: never;
+    path?: never;
+    query?: {
+        repository_key?: string;
+        status?: string;
+        page?: number;
+        per_page?: number;
+    };
+    url: '/api/v1/admin/age-gate/reviews';
+};
+
+export type ListReviewsResponses = {
+    200: AgeGateReviewListResponse;
+};
+
+export type ListReviewsResponse = ListReviewsResponses[keyof ListReviewsResponses];
+
+export type GetReviewData = {
+    body?: never;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/age-gate/reviews/{id}';
+};
+
+export type GetReviewResponses = {
+    200: AgeGateReviewResponse;
+};
+
+export type GetReviewResponse = GetReviewResponses[keyof GetReviewResponses];
+
+export type ApproveReviewData = {
+    body: ReviewActionRequest;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/age-gate/reviews/{id}/approve';
+};
+
+export type ApproveReviewResponses = {
+    200: AgeGateReviewResponse;
+};
+
+export type ApproveReviewResponse = ApproveReviewResponses[keyof ApproveReviewResponses];
+
+export type RejectReviewData = {
+    body: ReviewActionRequest;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/age-gate/reviews/{id}/reject';
+};
+
+export type RejectReviewResponses = {
+    200: AgeGateReviewResponse;
+};
+
+export type RejectReviewResponse = RejectReviewResponses[keyof RejectReviewResponses];
+
 export type GetStaleArtifactsData = {
     body?: never;
     path?: never;
@@ -4713,167 +4960,641 @@ export type CreateBackupResponses = {
     200: BackupResponse;
 };
 
-export type CreateBackupResponse = CreateBackupResponses[keyof CreateBackupResponses];
+export type CreateBackupResponse = CreateBackupResponses[keyof CreateBackupResponses];
+
+export type DeleteBackupData = {
+    body?: never;
+    path: {
+        /**
+         * Backup ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/backups/{id}';
+};
+
+export type DeleteBackupErrors = {
+    /**
+     * Backup not found
+     */
+    404: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type DeleteBackupResponses = {
+    /**
+     * Backup deleted
+     */
+    200: unknown;
+};
+
+export type GetBackupData = {
+    body?: never;
+    path: {
+        /**
+         * Backup ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/backups/{id}';
+};
+
+export type GetBackupErrors = {
+    /**
+     * Backup not found
+     */
+    404: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type GetBackupResponses = {
+    /**
+     * Backup details
+     */
+    200: BackupResponse;
+};
+
+export type GetBackupResponse = GetBackupResponses[keyof GetBackupResponses];
+
+export type CancelBackupData = {
+    body?: never;
+    path: {
+        /**
+         * Backup ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/backups/{id}/cancel';
+};
+
+export type CancelBackupErrors = {
+    /**
+     * Backup not found
+     */
+    404: unknown;
+    /**
+     * Backup is not in a cancellable state
+     */
+    409: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type CancelBackupResponses = {
+    /**
+     * Backup cancelled
+     */
+    200: unknown;
+};
+
+export type ExecuteBackupData = {
+    body?: never;
+    path: {
+        /**
+         * Backup ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/backups/{id}/execute';
+};
+
+export type ExecuteBackupErrors = {
+    /**
+     * Backup not found
+     */
+    404: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type ExecuteBackupResponses = {
+    /**
+     * Backup executed
+     */
+    200: BackupResponse;
+};
+
+export type ExecuteBackupResponse = ExecuteBackupResponses[keyof ExecuteBackupResponses];
+
+export type RestoreBackupData = {
+    body: RestoreRequest;
+    path: {
+        /**
+         * Backup ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/backups/{id}/restore';
+};
+
+export type RestoreBackupErrors = {
+    /**
+     * Backup not found
+     */
+    404: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type RestoreBackupResponses = {
+    /**
+     * Backup restored
+     */
+    200: RestoreResponse;
+};
+
+export type RestoreBackupResponse = RestoreBackupResponses[keyof RestoreBackupResponses];
+
+export type CiOidcListProvidersData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/';
+};
+
+export type CiOidcListProvidersErrors = {
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+};
+
+export type CiOidcListProvidersError = CiOidcListProvidersErrors[keyof CiOidcListProvidersErrors];
+
+export type CiOidcListProvidersResponses = {
+    /**
+     * List CI OIDC providers
+     */
+    200: Array<CiOidcProviderResponse>;
+};
+
+export type CiOidcListProvidersResponse = CiOidcListProvidersResponses[keyof CiOidcListProvidersResponses];
+
+export type CreateProviderData = {
+    body: CreateCiOidcProviderRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/';
+};
+
+export type CreateProviderErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+};
+
+export type CreateProviderError = CreateProviderErrors[keyof CreateProviderErrors];
+
+export type CreateProviderResponses = {
+    /**
+     * Create CI OIDC provider
+     */
+    200: CiOidcProviderResponse;
+};
+
+export type CreateProviderResponse = CreateProviderResponses[keyof CreateProviderResponses];
+
+export type DeleteProviderData = {
+    body?: never;
+    path: {
+        /**
+         * CI OIDC provider ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/{id}';
+};
+
+export type DeleteProviderErrors = {
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Provider not found
+     */
+    404: ErrorResponse;
+};
+
+export type DeleteProviderError = DeleteProviderErrors[keyof DeleteProviderErrors];
+
+export type DeleteProviderResponses = {
+    /**
+     * Delete CI OIDC provider
+     */
+    200: unknown;
+};
+
+export type GetProviderData = {
+    body?: never;
+    path: {
+        /**
+         * CI OIDC provider ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/{id}';
+};
+
+export type GetProviderErrors = {
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Provider not found
+     */
+    404: ErrorResponse;
+};
+
+export type GetProviderError = GetProviderErrors[keyof GetProviderErrors];
+
+export type GetProviderResponses = {
+    /**
+     * Get CI OIDC provider
+     */
+    200: CiOidcProviderResponse;
+};
+
+export type GetProviderResponse = GetProviderResponses[keyof GetProviderResponses];
+
+export type UpdateProviderData = {
+    body: UpdateCiOidcProviderRequest;
+    path: {
+        /**
+         * CI OIDC provider ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/{id}';
+};
+
+export type UpdateProviderErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Provider not found
+     */
+    404: ErrorResponse;
+};
+
+export type UpdateProviderError = UpdateProviderErrors[keyof UpdateProviderErrors];
+
+export type UpdateProviderResponses = {
+    /**
+     * Update CI OIDC provider
+     */
+    200: CiOidcProviderResponse;
+};
+
+export type UpdateProviderResponse = UpdateProviderResponses[keyof UpdateProviderResponses];
+
+export type ListMappingsData = {
+    body?: never;
+    path: {
+        /**
+         * CI OIDC provider ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/{id}/mappings';
+};
+
+export type ListMappingsErrors = {
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Provider not found
+     */
+    404: ErrorResponse;
+};
+
+export type ListMappingsError = ListMappingsErrors[keyof ListMappingsErrors];
+
+export type ListMappingsResponses = {
+    /**
+     * List identity mappings for provider
+     */
+    200: Array<CiOidcMappingResponse>;
+};
+
+export type ListMappingsResponse = ListMappingsResponses[keyof ListMappingsResponses];
+
+export type CreateMappingData = {
+    body: CreateCiOidcMappingRequest;
+    path: {
+        /**
+         * CI OIDC provider ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/ci-oidc/{id}/mappings';
+};
+
+export type CreateMappingErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Unauthorized
+     */
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Provider not found
+     */
+    404: ErrorResponse;
+};
+
+export type CreateMappingError = CreateMappingErrors[keyof CreateMappingErrors];
+
+export type CreateMappingResponses = {
+    /**
+     * Create identity mapping
+     */
+    200: CiOidcMappingResponse;
+};
+
+export type CreateMappingResponse = CreateMappingResponses[keyof CreateMappingResponses];
 
-export type DeleteBackupData = {
+export type DeleteMappingData = {
     body?: never;
     path: {
         /**
-         * Backup ID
+         * CI OIDC provider ID
          */
         id: string;
+        /**
+         * Identity mapping ID
+         */
+        mid: string;
     };
     query?: never;
-    url: '/api/v1/admin/backups/{id}';
+    url: '/api/v1/admin/ci-oidc/{id}/mappings/{mid}';
 };
 
-export type DeleteBackupErrors = {
+export type DeleteMappingErrors = {
     /**
-     * Backup not found
+     * Unauthorized
      */
-    404: unknown;
+    401: ErrorResponse;
     /**
-     * Internal server error
+     * Admin required
      */
-    500: unknown;
+    403: ErrorResponse;
+    /**
+     * Mapping not found
+     */
+    404: ErrorResponse;
 };
 
-export type DeleteBackupResponses = {
+export type DeleteMappingError = DeleteMappingErrors[keyof DeleteMappingErrors];
+
+export type DeleteMappingResponses = {
     /**
-     * Backup deleted
+     * Delete identity mapping
      */
     200: unknown;
 };
 
-export type GetBackupData = {
+export type GetMappingData = {
     body?: never;
     path: {
         /**
-         * Backup ID
+         * CI OIDC provider ID
          */
         id: string;
+        /**
+         * Identity mapping ID
+         */
+        mid: string;
     };
     query?: never;
-    url: '/api/v1/admin/backups/{id}';
+    url: '/api/v1/admin/ci-oidc/{id}/mappings/{mid}';
 };
 
-export type GetBackupErrors = {
+export type GetMappingErrors = {
     /**
-     * Backup not found
+     * Unauthorized
      */
-    404: unknown;
+    401: ErrorResponse;
     /**
-     * Internal server error
+     * Admin required
      */
-    500: unknown;
+    403: ErrorResponse;
+    /**
+     * Mapping not found
+     */
+    404: ErrorResponse;
 };
 
-export type GetBackupResponses = {
+export type GetMappingError = GetMappingErrors[keyof GetMappingErrors];
+
+export type GetMappingResponses = {
     /**
-     * Backup details
+     * Get identity mapping
      */
-    200: BackupResponse;
+    200: CiOidcMappingResponse;
 };
 
-export type GetBackupResponse = GetBackupResponses[keyof GetBackupResponses];
+export type GetMappingResponse = GetMappingResponses[keyof GetMappingResponses];
 
-export type CancelBackupData = {
-    body?: never;
+export type UpdateMappingData = {
+    body: UpdateCiOidcMappingRequest;
     path: {
         /**
-         * Backup ID
+         * CI OIDC provider ID
          */
         id: string;
+        /**
+         * Identity mapping ID
+         */
+        mid: string;
     };
     query?: never;
-    url: '/api/v1/admin/backups/{id}/cancel';
+    url: '/api/v1/admin/ci-oidc/{id}/mappings/{mid}';
 };
 
-export type CancelBackupErrors = {
+export type UpdateMappingErrors = {
     /**
-     * Backup not found
+     * Invalid request
      */
-    404: unknown;
+    400: ErrorResponse;
     /**
-     * Backup is not in a cancellable state
+     * Unauthorized
      */
-    409: unknown;
+    401: ErrorResponse;
     /**
-     * Internal server error
+     * Admin required
      */
-    500: unknown;
+    403: ErrorResponse;
+    /**
+     * Mapping not found
+     */
+    404: ErrorResponse;
 };
 
-export type CancelBackupResponses = {
+export type UpdateMappingError = UpdateMappingErrors[keyof UpdateMappingErrors];
+
+export type UpdateMappingResponses = {
     /**
-     * Backup cancelled
+     * Update identity mapping
      */
-    200: unknown;
+    200: CiOidcMappingResponse;
 };
 
-export type ExecuteBackupData = {
-    body?: never;
+export type UpdateMappingResponse = UpdateMappingResponses[keyof UpdateMappingResponses];
+
+export type ToggleMappingData = {
+    body: CiOidcToggleRequest;
     path: {
         /**
-         * Backup ID
+         * CI OIDC provider ID
          */
         id: string;
+        /**
+         * Identity mapping ID
+         */
+        mid: string;
     };
     query?: never;
-    url: '/api/v1/admin/backups/{id}/execute';
+    url: '/api/v1/admin/ci-oidc/{id}/mappings/{mid}/toggle';
 };
 
-export type ExecuteBackupErrors = {
+export type ToggleMappingErrors = {
     /**
-     * Backup not found
+     * Invalid request
      */
-    404: unknown;
+    400: ErrorResponse;
     /**
-     * Internal server error
+     * Unauthorized
      */
-    500: unknown;
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Mapping not found
+     */
+    404: ErrorResponse;
 };
 
-export type ExecuteBackupResponses = {
+export type ToggleMappingError = ToggleMappingErrors[keyof ToggleMappingErrors];
+
+export type ToggleMappingResponses = {
     /**
-     * Backup executed
+     * Toggle identity mapping
      */
-    200: BackupResponse;
+    200: CiOidcMappingResponse;
 };
 
-export type ExecuteBackupResponse = ExecuteBackupResponses[keyof ExecuteBackupResponses];
+export type ToggleMappingResponse = ToggleMappingResponses[keyof ToggleMappingResponses];
 
-export type RestoreBackupData = {
-    body: RestoreRequest;
+export type ToggleProviderData = {
+    body: CiOidcToggleRequest;
     path: {
         /**
-         * Backup ID
+         * CI OIDC provider ID
          */
         id: string;
     };
     query?: never;
-    url: '/api/v1/admin/backups/{id}/restore';
+    url: '/api/v1/admin/ci-oidc/{id}/toggle';
 };
 
-export type RestoreBackupErrors = {
+export type ToggleProviderErrors = {
     /**
-     * Backup not found
+     * Invalid request
      */
-    404: unknown;
+    400: ErrorResponse;
     /**
-     * Internal server error
+     * Unauthorized
      */
-    500: unknown;
+    401: ErrorResponse;
+    /**
+     * Admin required
+     */
+    403: ErrorResponse;
+    /**
+     * Provider not found
+     */
+    404: ErrorResponse;
 };
 
-export type RestoreBackupResponses = {
+export type ToggleProviderError = ToggleProviderErrors[keyof ToggleProviderErrors];
+
+export type ToggleProviderResponses = {
     /**
-     * Backup restored
+     * Toggle CI OIDC provider
      */
-    200: RestoreResponse;
+    200: CiOidcProviderResponse;
 };
 
-export type RestoreBackupResponse = RestoreBackupResponses[keyof RestoreBackupResponses];
+export type ToggleProviderResponse = ToggleProviderResponses[keyof ToggleProviderResponses];
 
 export type RunCleanupData = {
     body: CleanupRequest;
@@ -6510,6 +7231,35 @@ export type GetArtifactStatsResponses = {
 
 export type GetArtifactStatsResponse = GetArtifactStatsResponses[keyof GetArtifactStatsResponses];
 
+export type ExchangeCiTokenData = {
+    body: CiTokenRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/auth/ci/token';
+};
+
+export type ExchangeCiTokenErrors = {
+    /**
+     * Invalid CI token or provider configuration
+     */
+    401: ErrorResponse;
+    /**
+     * CI OIDC provider not found
+     */
+    404: ErrorResponse;
+};
+
+export type ExchangeCiTokenError = ExchangeCiTokenErrors[keyof ExchangeCiTokenErrors];
+
+export type ExchangeCiTokenResponses = {
+    /**
+     * CI token exchange successful
+     */
+    200: CiTokenResponse;
+};
+
+export type ExchangeCiTokenResponse = ExchangeCiTokenResponses[keyof ExchangeCiTokenResponses];
+
 export type LoginData = {
     body: LoginRequest;
     path?: never;
@@ -6968,6 +7718,13 @@ export type ListBuildsData = {
     url: '/api/v1/builds';
 };
 
+export type ListBuildsErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+};
+
 export type ListBuildsResponses = {
     /**
      * List of builds
@@ -7010,6 +7767,13 @@ export type GetBuildDiffData = {
     url: '/api/v1/builds/diff';
 };
 
+export type GetBuildDiffErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+};
+
 export type GetBuildDiffResponses = {
     /**
      * Diff between two builds
@@ -7032,6 +7796,10 @@ export type GetBuildData = {
 };
 
 export type GetBuildErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
     /**
      * Build not found
      */
@@ -11278,6 +12046,36 @@ export type UpdateRepositoryResponses = {
 
 export type UpdateRepositoryResponse = UpdateRepositoryResponses[keyof UpdateRepositoryResponses];
 
+export type GetRepoAgeGateData = {
+    body?: never;
+    path: {
+        key: string;
+    };
+    query?: never;
+    url: '/api/v1/repositories/{key}/age-gate';
+};
+
+export type GetRepoAgeGateResponses = {
+    200: AgeGateConfigResponse;
+};
+
+export type GetRepoAgeGateResponse = GetRepoAgeGateResponses[keyof GetRepoAgeGateResponses];
+
+export type UpdateRepoAgeGateData = {
+    body: UpdateAgeGateConfigRequest;
+    path: {
+        key: string;
+    };
+    query?: never;
+    url: '/api/v1/repositories/{key}/age-gate';
+};
+
+export type UpdateRepoAgeGateResponses = {
+    200: AgeGateConfigResponse;
+};
+
+export type UpdateRepoAgeGateResponse = UpdateRepoAgeGateResponses[keyof UpdateRepoAgeGateResponses];
+
 export type ListArtifactsData = {
     body?: never;
     path: {
@@ -14701,6 +15499,116 @@ export type CreateUserResponses = {
 
 export type CreateUserResponse2 = CreateUserResponses[keyof CreateUserResponses];
 
+export type GetCurrentUserRecordData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/users/me';
+};
+
+export type GetCurrentUserRecordErrors = {
+    /**
+     * User not found
+     */
+    404: unknown;
+};
+
+export type GetCurrentUserRecordResponses = {
+    /**
+     * The authenticated caller's user record
+     */
+    200: AdminUserResponse;
+};
+
+export type GetCurrentUserRecordResponse = GetCurrentUserRecordResponses[keyof GetCurrentUserRecordResponses];
+
+export type ChangeCurrentUserPasswordData = {
+    body: ChangePasswordRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/users/me/password';
+};
+
+export type ChangeCurrentUserPasswordErrors = {
+    /**
+     * Current password is incorrect
+     */
+    401: unknown;
+    /**
+     * User not found
+     */
+    404: unknown;
+    /**
+     * Validation error
+     */
+    422: unknown;
+};
+
+export type ChangeCurrentUserPasswordResponses = {
+    /**
+     * Password changed successfully
+     */
+    200: unknown;
+};
+
+export type ListCurrentUserTokensData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/users/me/tokens';
+};
+
+export type ListCurrentUserTokensResponses = {
+    /**
+     * List of the caller's API tokens
+     */
+    200: ApiTokenListResponse;
+};
+
+export type ListCurrentUserTokensResponse = ListCurrentUserTokensResponses[keyof ListCurrentUserTokensResponses];
+
+export type CreateCurrentUserApiTokenData = {
+    body: CreateApiTokenRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/users/me/tokens';
+};
+
+export type CreateCurrentUserApiTokenErrors = {
+    /**
+     * Requested scopes require administrator privileges
+     */
+    403: unknown;
+};
+
+export type CreateCurrentUserApiTokenResponses = {
+    /**
+     * API token created successfully
+     */
+    200: ApiTokenCreatedResponse;
+};
+
+export type CreateCurrentUserApiTokenResponse = CreateCurrentUserApiTokenResponses[keyof CreateCurrentUserApiTokenResponses];
+
+export type RevokeCurrentUserApiTokenData = {
+    body?: never;
+    path: {
+        /**
+         * API token ID
+         */
+        token_id: string;
+    };
+    query?: never;
+    url: '/api/v1/users/me/tokens/{token_id}';
+};
+
+export type RevokeCurrentUserApiTokenResponses = {
+    /**
+     * API token revoked successfully
+     */
+    200: unknown;
+};
+
 export type DeleteUserData = {
     body?: never;
     path: {