@artifact-keeper/sdk 1.5.7 → 1.6.0

package/src/types.gen.ts

@@ -4,6 +4,50 @@ export type ClientOptions = {
     baseUrl: `${string}://${string}` | (string & {});
 };
 
+/**
+ * One principal that can read an affected artifact but has not downloaded it.
+ */
+export type AccessibleUser = {
+    /**
+     * Always `has-access` for this endpoint (accessible minus downloaded).
+     */
+    reason: string;
+    user_id: string;
+    username: string;
+    /**
+     * How access is granted: `admin` (global), `permission` (fine-grained
+     * direct **or** group grant, repo or owning project), or `role`
+     * (role_assignment only). Direct and group grants both surface as
+     * `permission` because they share one read fragment.
+     */
+    via: string;
+};
+
+/**
+ * Full accessible-but-not-downloaded report for a CVE or artifact, scoped to
+ * one restricted repository.
+ */
+export type AccessibleUsersResponse = {
+    /**
+     * The page of accessible-but-not-downloaded principals. Empty when
+     * `exposure != "enumerable"`.
+     */
+    accessible_not_downloaded: Array<AccessibleUser>;
+    /**
+     * `enumerable` | `everyone` | `effectively-everyone`.
+     */
+    exposure: string;
+    page: number;
+    per_page: number;
+    repository: RepoExposure;
+    target: BlastRadiusTargetInfo;
+    /**
+     * Total accessible-not-downloaded principals (the pagination total).
+     * `null` for `public` repos (never enumerated).
+     */
+    total?: number | null;
+};
+
 export type AcknowledgeRequest = {
     reason: string;
 };
@@ -28,6 +72,19 @@ export type AddPeerLabelRequest = {
     value?: string;
 };
 
+export type AddProjectMemberRequest = {
+    /**
+     * Actions granted on every repository in the project (e.g. ["read"],
+     * ["read", "write"]).
+     */
+    actions: Array<string>;
+    principal_id: string;
+    /**
+     * "user" or "group".
+     */
+    principal_type: string;
+};
+
 export type AddVirtualMemberRequest = {
     member_key: string;
     priority?: number | null;
@@ -1153,6 +1210,16 @@ export type CreatePolicyRequest = {
     require_signature?: boolean;
 };
 
+export type CreateProjectRequest = {
+    description?: string | null;
+    key: string;
+    name: string;
+    /**
+     * P1: stored only, NOT enforced (quota enforcement is P3).
+     */
+    quota_bytes?: number | null;
+};
+
 /**
  * Request to create an access token scoped to a repository.
  */
@@ -1198,6 +1265,32 @@ export type CreateRepositoryRequest = {
      * `allow_anonymous_access` takes precedence.
      */
     allow_anonymous_access?: boolean | null;
+    /**
+     * Custom Description field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_description`.
+     */
+    apt_description?: string | null;
+    /**
+     * Custom Label field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_label`.
+     */
+    apt_label?: string | null;
+    /**
+     * Custom Origin field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_origin`.
+     */
+    apt_origin?: string | null;
+    /**
+     * Custom Version field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_release_version`.
+     */
+    apt_release_version?: string | null;
+    /**
+     * Custom User-Agent sent on outbound HTTP requests to the upstream for
+     * this repository. Only valid for remote repositories. Max 256 characters.
+     */
+    custom_user_agent?: string | null;
+    debian?: null | DebianRepositoryConfig;
     description?: string | null;
     format: string;
     /**
@@ -1219,6 +1312,31 @@ export type CreateRepositoryRequest = {
      */
     member_repos?: Array<CreateVirtualMemberInput> | null;
     name: string;
+    /**
+     * Whether unscoped npm package names may resolve through this npm Remote
+     * repository (#2424). Stored under `npm_allow_unscoped`.
+     */
+    npm_allow_unscoped?: boolean | null;
+    /**
+     * Allowed npm full-name glob patterns (`*`/`?`) for this npm Remote
+     * repository (#2424). Additive to `npm_allowed_scopes`; stored under
+     * `npm_allowed_name_patterns`. A name is allowed if its scope is allowed
+     * OR any glob matches (e.g. `@acme*`, `internal-*`).
+     */
+    npm_allowed_name_patterns?: Array<string> | null;
+    /**
+     * Allowed npm `@scope` literals for this npm Remote repository (#2424).
+     * Only meaningful for npm-format Remote repositories; validated and stored
+     * in `repository_config` under `npm_allowed_scopes`. Omit to leave the
+     * repository unrestricted by scope.
+     */
+    npm_allowed_scopes?: Array<string> | null;
+    /**
+     * Optional project to assign this repository to (#2472). Grants on the
+     * project (permissions with `target_type = 'project'`) are inherited by
+     * the repository. Omit to leave the repository unassigned.
+     */
+    project_id?: string | null;
     /**
      * When true, direct user uploads to this repository are rejected:
      * artifacts must arrive via the promotion path. Admin-only to set.
@@ -1246,6 +1364,16 @@ export type CreateRepositoryRequest = {
      * Non-admin users may only use the default backend.
      */
     storage_backend?: string | null;
+    /**
+     * ASCII-armored OpenPGP *public* key trusted to sign this RPM curation
+     * remote's `repodata/repomd.xml` (#2568, RPM curation Phase 3). When set,
+     * the curation sync fetches `repomd.xml.asc` and verifies the detached
+     * signature before ingesting upstream metadata (#2567 reads this column).
+     * Must be a PUBLIC key block; a private-key block is rejected. Write-only:
+     * the response exposes only the boolean `has_trusted_gpg_key`, never the
+     * key material.
+     */
+    trusted_gpg_key?: string | null;
     /**
      * Upstream auth type: "basic" or "bearer". Only valid for remote repos.
      */
@@ -1289,6 +1417,12 @@ export type CreateSamlConfigRequest = {
     certificate: string;
     entity_id: string;
     is_enabled?: boolean | null;
+    /**
+     * Opt-in flag (see migration 157, #2333): when true, SAML assertion
+     * group values are reflected as Artifact Keeper group memberships.
+     * Defaults to false.
+     */
+    map_groups_to_groups?: boolean | null;
     name: string;
     name_id_format?: string | null;
     require_signed_assertions?: boolean | null;
@@ -1666,6 +1800,102 @@ export type DbPoolStats = {
     size: number;
 };
 
+/**
+ * Partial-update patch for [`DebianRepositoryConfig`]. Fields left absent are
+ * preserved; provided fields (including an explicit empty list) replace the
+ * stored value. Applied on top of the currently stored config, or on top of
+ * the default when none exists yet.
+ */
+export type DebianConfigPatch = {
+    architectures?: Array<string> | null;
+    components?: Array<string> | null;
+    distribution_paths?: Array<string> | null;
+    flat_repository?: boolean | null;
+    include_source_packages?: boolean | null;
+    metadata_strategy?: null | DebianMetadataStrategy;
+    package_fetch_strategy?: null | DebianPackageFetchStrategy;
+    package_queries?: Array<string> | null;
+    upstream_gpg_key_id?: string | null;
+    verify_upstream_metadata?: boolean | null;
+};
+
+/**
+ * How metadata (`Packages`/`Release`) is produced for a Debian remote.
+ *
+ * Only [`DebianMetadataStrategy::UpstreamPassthrough`] is implemented in
+ * 1.6.0; the other variants are reserved for P3 (filtered generation) / P4
+ * (local re-signing) and are rejected with 422 until then. The enum lands now
+ * so those phases can flip it on without a schema/config-shape change.
+ */
+export type DebianMetadataStrategy = 'upstream_passthrough' | 'filter_and_generate' | 'filter_generate_and_sign' | 'hosted_generate';
+
+/**
+ * How package bodies are fetched for a Debian remote.
+ *
+ * Only [`DebianPackageFetchStrategy::UpstreamPassthrough`] is implemented in
+ * 1.6.0.
+ */
+export type DebianPackageFetchStrategy = 'upstream_passthrough' | 'eager';
+
+/**
+ * P2 Debian remote proxy filter config (dist/component/arch allowlists).
+ *
+ * Semantics for each allowlist: an empty list OR a list containing `"*"`
+ * selects everything (today's full-proxy behaviour); otherwise only exact
+ * matches are selected. Architecture-independent (`all`) packages are always
+ * permitted regardless of the `architectures` allowlist.
+ */
+export type DebianRepositoryConfig = {
+    /**
+     * Architectures (e.g. `amd64`, `arm64`) to proxy. Empty/`["*"]` = all.
+     * `all` (arch-independent) is always permitted.
+     */
+    architectures?: Array<string>;
+    /**
+     * Components (e.g. `main`, `contrib`, `non-free`) to proxy. Empty/`["*"]` = all.
+     */
+    components?: Array<string>;
+    /**
+     * Distributions (a.k.a. suites/codenames, e.g. `bookworm`) to proxy.
+     * Empty or `["*"]` = all.
+     */
+    distribution_paths?: Array<string>;
+    /**
+     * Flat (non-`dists/`) repository layout flag. Accepted but does NOT weaken
+     * P1's flat/redirect abuse posture in passthrough.
+     */
+    flat_repository?: boolean;
+    /**
+     * Whether source packages (`Sources`, `.dsc`) are included. Advisory in
+     * passthrough (upstream metadata is unchanged); honored under P3.
+     */
+    include_source_packages?: boolean;
+    /**
+     * Metadata production strategy. Only `upstream_passthrough` in 1.6.0.
+     */
+    metadata_strategy?: DebianMetadataStrategy;
+    /**
+     * Package-body fetch strategy. Only `upstream_passthrough` in 1.6.0.
+     */
+    package_fetch_strategy?: DebianPackageFetchStrategy;
+    /**
+     * Package-name-level queries. NOT honored in passthrough (that needs P3);
+     * a non-empty value here with `upstream_passthrough` is rejected with 422
+     * rather than silently advertising content the proxy would then block.
+     */
+    package_queries?: Array<string>;
+    /**
+     * Upstream GPG key id used to verify upstream metadata (reserved for P4).
+     */
+    upstream_gpg_key_id?: string | null;
+    /**
+     * Whether to verify the upstream signed `Release` before serving. In P2 the
+     * P1 integrity gate already enforces index/Release consistency; this flag
+     * is reserved for P4 trust-anchor verification.
+     */
+    verify_upstream_metadata?: boolean;
+};
+
 export type DeliveryListResponse = {
     items: Array<DeliveryResponse>;
     total: number;
@@ -2562,6 +2792,10 @@ export type ListRepositoriesQuery = {
     format?: string | null;
     page?: number | null;
     per_page?: number | null;
+    /**
+     * Filter the listing to repositories assigned to this project (#2472).
+     */
+    project?: string | null;
     q?: string | null;
     type?: string | null;
 };
@@ -2825,26 +3059,33 @@ export type NpmScopePolicyResponse = {
  * layers before any garbage-collection mechanism is enabled.
  *
  * It deliberately does NOT attempt to classify which blobs are
- * "reclaimable orphans": that requires a manifest -> blob reference table
- * that does not yet exist in the schema, and any per-`(repository_id,
- * digest)` orphan heuristic would mis-handle the cross-repo dedup case
- * (multiple `oci_blobs` rows, one physical object) and report in-use
- * blobs as reclaimable. The numbers here are exact aggregates only.
+ * "reclaimable orphans": that is the blob GC's job (mark-and-sweep over
+ * `manifest_blob_refs`, per [`BLOB_PROTECTED_BY_REFS_SQL`]). A naive
+ * per-`(repository_id, digest)` orphan heuristic would mis-handle shared
+ * backends (anything other than `filesystem`), where all referencing
+ * repos share ONE physical object per digest per backend, and report
+ * in-use blobs as reclaimable; on `filesystem` each repository keeps an
+ * independent copy under its own `storage_path`. The numbers here are
+ * exact aggregates only.
  */
 export type OciBlobFootprintReport = {
     /**
-     * Distinct digests older than `grace_hours` (eligible to be *considered*
-     * by a future GC sweep once a reference table exists). Reporting only.
+     * Distinct digests with at least one physical copy older than
+     * `grace_hours` (eligible to be *considered* by a future GC sweep once
+     * a reference table exists). Reporting only.
      */
     aged_distinct_digests: number;
     /**
-     * Physical bytes (distinct-digest) older than `grace_hours`.
+     * Physical bytes (same physical-object grouping as `physical_bytes`)
+     * older than `grace_hours`.
      */
     aged_physical_bytes: number;
     /**
      * Number of distinct blob digests (content-addressed identities). When
      * this is smaller than `total_blob_rows`, the difference is cross-repo
-     * deduplication: rows that share one physical storage object.
+     * sharing of a content identity (one physical object shared by all
+     * referencing repos on shared backends; an independent copy per
+     * repository on `filesystem`).
      */
     distinct_digests: number;
     /**
@@ -2861,8 +3102,13 @@ export type OciBlobFootprintReport = {
      */
     per_repository: Array<OciBlobRepoFootprint>;
     /**
-     * Sum of `size_bytes` counting each distinct digest exactly once. This
-     * approximates the physical bytes occupied in the storage backend.
+     * Sum of `size_bytes` counting each distinct **physical storage
+     * object** exactly once, per the ownership model of
+     * [`BLOB_PROTECTED_BY_REFS_SQL`]: on shared backends (anything other
+     * than `filesystem`) a digest is one object per backend; on
+     * `filesystem` each repository stores its own copy under its
+     * `storage_path`, so the same digest in two filesystem repositories
+     * counts twice.
      */
     physical_bytes: number;
     /**
@@ -2880,10 +3126,13 @@ export type OciBlobRepoFootprint = {
      */
     blob_rows: number;
     /**
-     * Sum of `oci_blobs.size_bytes` for this repository's rows. Because OCI
-     * blob storage is content-addressed and deduplicated across repos, the
+     * Sum of `oci_blobs.size_bytes` for this repository's rows. On shared
+     * backends (anything other than `filesystem`) blobs are deduplicated
+     * across repos — one physical object per digest per backend — so the
      * same physical bytes can be counted under more than one repository
-     * here; see [`OciBlobFootprintReport::physical_bytes`] for the
+     * here. On `filesystem` each repository stores its own independent
+     * copy under its `storage_path`, so its rows are that repo's real
+     * bytes. See [`OciBlobFootprintReport::physical_bytes`] for the
      * dedup-aware total.
      */
     logical_bytes: number;
@@ -2962,6 +3211,23 @@ export type PackageRow = {
     version: string;
 };
 
+export type PackageSearchQuery = {
+    /**
+     * Exact architecture filter (e.g. `x86_64`, `noarch`).
+     */
+    arch?: string | null;
+    limit?: number;
+    offset?: number;
+    /**
+     * Case-insensitive substring match on the package name.
+     */
+    q?: string | null;
+    /**
+     * Curation status filter (e.g. `approved`, `pending`, `blocked`, `review`).
+     */
+    status?: string | null;
+};
+
 export type PackageVersionResponse = {
     checksum_sha256: string;
     created_at: string;
@@ -3295,6 +3561,43 @@ export type ProbeBody = {
     target_peer_id: string;
 };
 
+/**
+ * Project entity.
+ */
+export type Project = {
+    created_at: string;
+    description?: string | null;
+    id: string;
+    /**
+     * Unique, URL-safe project key (e.g. "payments").
+     */
+    key: string;
+    name: string;
+    /**
+     * Storage quota in bytes. P1: stored only, NOT enforced (quotas = P3).
+     */
+    quota_bytes?: number | null;
+    updated_at: string;
+};
+
+export type ProjectListResponse = {
+    items: Array<Project>;
+};
+
+export type ProjectMemberListResponse = {
+    items: Array<ProjectMemberRow>;
+};
+
+/**
+ * One membership grant on a project: a `permissions` row with
+ * `target_type = 'project'`.
+ */
+export type ProjectMemberRow = {
+    actions: Array<string>;
+    principal_id: string;
+    principal_type: string;
+};
+
 export type PromoteArtifactRequest = {
     notes?: string | null;
     skip_policy_check?: boolean;
@@ -3505,6 +3808,24 @@ export type RemoteInstanceResponse = {
     url: string;
 };
 
+export type RemoveProjectMemberRequest = {
+    principal_id: string;
+    principal_type: string;
+};
+
+/**
+ * Repository exposure descriptor echoed in the response.
+ */
+export type RepoExposure = {
+    /**
+     * `public` | `restricted_acl` | `restricted_roles` — see
+     * [`classify_access_scope`].
+     */
+    access_scope: string;
+    repository_id: string;
+    repository_key: string;
+};
+
 export type RepoHealthResponse = {
     artifacts_evaluated: number;
     artifacts_failing: number;
@@ -3580,13 +3901,65 @@ export type RepositoryResponse = {
      * the semantics are clear for remote (pull-through cache) repositories.
      */
     allow_anonymous_access: boolean;
+    /**
+     * Custom Description field for Debian/APT Release files. Omitted from the
+     * Release file when `None` or empty.
+     */
+    apt_description?: string | null;
+    /**
+     * Custom Label field for Debian/APT Release files (default: "artifact-keeper").
+     */
+    apt_label?: string | null;
+    /**
+     * Custom Origin field for Debian/APT Release files (default: "artifact-keeper").
+     */
+    apt_origin?: string | null;
+    /**
+     * Custom Version field for Debian/APT Release files. Omitted from the
+     * Release file when `None` or empty.
+     */
+    apt_release_version?: string | null;
     created_at: string;
+    /**
+     * Custom User-Agent used for outbound HTTP requests to the upstream,
+     * read back from `repository_config`. `None` when unset.
+     */
+    custom_user_agent?: string | null;
+    debian?: null | DebianRepositoryConfig;
     description?: string | null;
     format: string;
+    /**
+     * Whether a trusted upstream OpenPGP public key is configured for RPM
+     * curation signature verification (#2568). The key material itself is
+     * never returned; this boolean is the only exposure. `false` for repos
+     * with no key set. Populated by the single-repo handlers (create / get /
+     * update) and the listing; `repo_to_response` alone defaults it to `false`
+     * (it is db-less and cannot read the column).
+     */
+    has_trusted_gpg_key: boolean;
     id: string;
     is_public: boolean;
     key: string;
     name: string;
+    /**
+     * Whether unscoped npm names may resolve through this npm Remote
+     * repository (#2424). Omitted when unset.
+     */
+    npm_allow_unscoped?: boolean | null;
+    /**
+     * Allowed npm full-name glob patterns (#2424), read back from
+     * `repository_config`. Omitted for non-npm repositories or when unset.
+     */
+    npm_allowed_name_patterns?: Array<string> | null;
+    /**
+     * Allowed npm `@scope` literals (#2424), read back from
+     * `repository_config`. Omitted for non-npm repositories or when unset.
+     */
+    npm_allowed_scopes?: Array<string> | null;
+    /**
+     * Project this repository is assigned to (#2472), if any.
+     */
+    project_id?: string | null;
     /**
      * When true, direct user uploads are rejected; artifacts must be promoted.
      */
@@ -3657,6 +4030,83 @@ export type RepositoryStorageBreakdown = {
     storage_bytes: number;
 };
 
+/**
+ * Deduplicated storage-accounting response for a single repository (#2056).
+ *
+ * All figures are read from the materialized `repository_storage_stats` cache
+ * (refreshed on a schedule + post-GC), so this endpoint is an O(1) primary-key
+ * lookup and never runs the heavy cross-repo aggregation. `computed_at` is the
+ * freshness marker; it is `null` until the first refresh has run.
+ *
+ * Quota is unaffected: these numbers are accounting/visibility only and do NOT
+ * change how the repository's storage quota is enforced (#2056 §7).
+ */
+export type RepositoryStorageStatsResponse = {
+    /**
+     * Distinct physical objects (dedup keys) this repository references.
+     */
+    blob_count: number;
+    /**
+     * When these figures were last recomputed. `null` before the first refresh.
+     */
+    computed_at?: string | null;
+    /**
+     * logical_bytes / physical_bytes (1.0 when nothing is stored). Restricted
+     * on cloud backends — see [`physical_bytes`](Self::physical_bytes).
+     */
+    dedup_ratio?: number | null;
+    /**
+     * `per_repo` (filesystem) or `instance` (cloud) — the backend semantics at
+     * compute time.
+     */
+    dedup_scope: string;
+    /**
+     * The instance-wide globally-distinct footprint (true disk usage). On
+     * cloud backends the sum of per-repo `physical_bytes` OVER-counts shared
+     * objects, so this is the authoritative instance total.
+     *
+     * **Admin-only:** this is a whole-instance aggregate that spans every
+     * tenant, so it is only populated for admin callers. It is omitted from the
+     * response entirely for repo-authorized non-admins and anonymous callers,
+     * who see only this repository's own figures (#2559 review).
+     */
+    instance_unique_bytes?: number | null;
+    /**
+     * Sum over every reference (per-row). Now includes OCI layer bytes, which
+     * were previously omitted from all storage accounting.
+     */
+    logical_bytes: number;
+    /**
+     * Deduplicated physical footprint within the dedup scope.
+     *
+     * **Restricted on cloud (instance-scope) backends:** on a shared-storage
+     * backend `physical_bytes`, `unique_bytes`, `shared_bytes` and
+     * `dedup_ratio` are all cross-tenant-derivable — `shared_bytes =
+     * physical_bytes - unique_bytes` reveals whether this repo's blobs are also
+     * stored by another tenant (a per-blob cross-tenant existence oracle,
+     * #2560). The whole derivable set is therefore populated only for admins on
+     * instance-scope backends, and omitted for repo-authorized non-admins /
+     * anonymous callers. On `per_repo` (filesystem) backends there is no
+     * cross-tenant sharing (`shared_bytes == 0` by construction), so all
+     * figures are always present.
+     */
+    physical_bytes?: number | null;
+    repository_key: string;
+    /**
+     * physical_bytes - unique_bytes. Always 0 on filesystem backends (a shared
+     * digest in two repos is two files). Restricted on cloud backends — see
+     * [`physical_bytes`](Self::physical_bytes).
+     */
+    shared_bytes?: number | null;
+    /**
+     * Physical bytes of objects referenced only by this repository.
+     * Restricted on cloud backends — see [`physical_bytes`].
+     *
+     * [`physical_bytes`]: Self::physical_bytes
+     */
+    unique_bytes?: number | null;
+};
+
 export type RescanForInventoryRequest = {
     /**
      * Maximum number of artifacts to enqueue in this call. Operators
@@ -3817,6 +4267,12 @@ export type SamlConfigResponse = {
     has_certificate: boolean;
     id: string;
     is_enabled: boolean;
+    /**
+     * Opt-in flag (see migration 157, #2333): when true, SAML assertion
+     * group values are reflected as Artifact Keeper group memberships,
+     * mirroring the OIDC flag from #1094. Defaults to false.
+     */
+    map_groups_to_groups: boolean;
     name: string;
     name_id_format: string;
     require_signed_assertions: boolean;
@@ -3878,6 +4334,23 @@ export type ScanResponse = {
     artifact_id: string;
     artifact_name?: string | null;
     artifact_version?: string | null;
+    /**
+     * #2471: number of `not_applicable` scanner rows folded into this row.
+     * `Some(n)` marks a synthetic *summary* row that collapses `n` redundant
+     * "this scanner does not apply" results (e.g. the image-family scanners
+     * `filesystem`/`incus`/`openscap` all declining on a Docker image) into a
+     * single muted "not applicable to this artifact" indication, so the UI
+     * stops rendering N rows that read as N failures. `None` for every real
+     * (non-collapsed) scan row. Omitted from the wire when `None`.
+     */
+    collapsed_not_applicable_count?: number | null;
+    /**
+     * #2471: the individual `scan_type` values folded into a summary row,
+     * sorted and de-duplicated (e.g. `["filesystem","incus","openscap"]`).
+     * Present only on a synthetic summary row (alongside
+     * `collapsed_not_applicable_count`); `None` / omitted otherwise.
+     */
+    collapsed_scan_types?: Array<string> | null;
     completed_at?: string | null;
     created_at: string;
     critical_count: number;
@@ -4086,6 +4559,22 @@ export type SetupStatusResponse = {
     setup_required: boolean;
 };
 
+/**
+ * Response from a deliberate per-artifact signing action (#2535).
+ */
+export type SignArtifactResponse = {
+    algorithm: string;
+    artifact_id: string;
+    /**
+     * The active signing key that produced the attestation.
+     */
+    key_id: string;
+    /**
+     * SHA-256 of the produced signature blob (the blob itself is not persisted).
+     */
+    signature_sha256: string;
+};
+
 export type SigningConfigResponse = {
     key?: null | SigningKeyPublic;
     repository_id: string;
@@ -4330,6 +4819,23 @@ export type SyncTaskResponse = {
     storage_key: string;
 };
 
+export type SyncTriggerResponse = {
+    /**
+     * The repository key the sync was triggered for.
+     */
+    repository: string;
+    /**
+     * Whether the sync pass completed without error. A false value with
+     * `triggered = true` means the pass ran but an upstream fetch/verify step
+     * failed for the repo (details are in the server logs, not this response).
+     */
+    succeeded: boolean;
+    /**
+     * Always true when the trigger was accepted and a sync pass ran.
+     */
+    triggered: boolean;
+};
+
 /**
  * Runtime configuration values.
  *
@@ -4790,6 +5296,12 @@ export type UpdatePolicyRequest = {
     require_signature?: boolean | null;
 };
 
+export type UpdateProjectRequest = {
+    description?: string | null;
+    name?: string | null;
+    quota_bytes?: number | null;
+};
+
 export type UpdateRepositoryRequest = {
     /**
      * Alias for `is_public`. When set to true, anonymous users can download
@@ -4800,6 +5312,37 @@ export type UpdateRepositoryRequest = {
      * `allow_anonymous_access` takes precedence.
      */
     allow_anonymous_access?: boolean | null;
+    /**
+     * Custom Description field for Debian/APT Release files. Pass an empty
+     * string to remove (omits the field entirely from the Release file).
+     * Stored in `repository_config` under `apt_description`.
+     */
+    apt_description?: string | null;
+    /**
+     * Custom Label field for Debian/APT Release files. Pass an empty string
+     * to reset to the default ("artifact-keeper").
+     * Stored in `repository_config` under `apt_label`.
+     */
+    apt_label?: string | null;
+    /**
+     * Custom Origin field for Debian/APT Release files. Pass an empty string
+     * to reset to the default ("artifact-keeper").
+     * Stored in `repository_config` under `apt_origin`.
+     */
+    apt_origin?: string | null;
+    /**
+     * Custom Version field for Debian/APT Release files. Pass an empty
+     * string to remove (omits the field entirely from the Release file).
+     * Stored in `repository_config` under `apt_release_version`.
+     */
+    apt_release_version?: string | null;
+    /**
+     * Update the custom User-Agent for outbound HTTP requests to the upstream.
+     * Only valid for remote repositories. Pass an empty string to remove.
+     * Max 256 characters. Stored in `repository_config` under `custom_user_agent`.
+     */
+    custom_user_agent?: string | null;
+    debian?: null | DebianConfigPatch;
     description?: string | null;
     /**
      * Update the Cargo index upstream URL (stored in `repository_config`).
@@ -4809,6 +5352,28 @@ export type UpdateRepositoryRequest = {
     is_public?: boolean | null;
     key?: string | null;
     name?: string | null;
+    /**
+     * Update whether unscoped npm package names may resolve through this npm
+     * Remote repository (#2424). Stored under `npm_allow_unscoped`.
+     */
+    npm_allow_unscoped?: boolean | null;
+    /**
+     * Update the allowed npm full-name glob patterns for this npm Remote
+     * repository (#2424). When provided, replaces the stored
+     * `npm_allowed_name_patterns` list.
+     */
+    npm_allowed_name_patterns?: Array<string> | null;
+    /**
+     * Update the allowed npm `@scope` literals for this npm Remote repository
+     * (#2424). When provided, replaces the stored `npm_allowed_scopes` list.
+     */
+    npm_allowed_scopes?: Array<string> | null;
+    /**
+     * Assign this repository to a project (#2472). P1 is set-only: omitting
+     * the field leaves the assignment unchanged (unassignment ships with the
+     * project-admin surface in P2).
+     */
+    project_id?: string | null;
     /**
      * When provided, enables/disables the `promotion_only` policy for this
      * repository (admin-only). When omitted, the flag is left unchanged.
@@ -4841,6 +5406,15 @@ export type UpdateRepositoryRequest = {
      * Stored in `repository_config` under `release_repository_id`.
      */
     release_repository_key?: string | null;
+    /**
+     * Update the trusted upstream OpenPGP public key for RPM curation (#2568).
+     * Three-way semantics via `Option<Option<String>>`: omit the field to
+     * leave the stored key unchanged; send `null` to clear it (revert to
+     * "unverified upstream"); send an ASCII-armored PUBLIC key block to set
+     * it. A private-key block or malformed armor is rejected (400). The
+     * response never echoes the key — only `has_trusted_gpg_key`.
+     */
+    trusted_gpg_key?: string | null;
     /**
      * When provided, enables/disables first-class artifact versioning for
      * this Generic/Mlmodel repository (#2367). When omitted, unchanged.
@@ -4868,6 +5442,7 @@ export type UpdateSamlConfigRequest = {
     certificate?: string | null;
     entity_id?: string | null;
     is_enabled?: boolean | null;
+    map_groups_to_groups?: boolean | null;
     name?: string | null;
     name_id_format?: string | null;
     require_signed_assertions?: boolean | null;
@@ -6559,7 +7134,54 @@ export type TriggerSearchReindexResponses = {
 
 export type TriggerSearchReindexResponse = TriggerSearchReindexResponses[keyof TriggerSearchReindexResponses];
 
-export type ArtifactBlastRadiusData = {
+export type ArtifactAccessibleUsersData = {
+    body?: never;
+    path: {
+        /**
+         * Artifact id
+         */
+        artifact_id: string;
+    };
+    query?: {
+        /**
+         * Repository to scope the enumeration to. **Required** for the CVE route
+         * (a CVE spans many repos); ignored for the artifact route (implied by the
+         * artifact).
+         */
+        repository_id?: string | null;
+        /**
+         * 1-based page over the accessible-users list.
+         */
+        page?: number | null;
+        /**
+         * Users per page (1..=100, default 20).
+         */
+        per_page?: number | null;
+    };
+    url: '/api/v1/admin/security/artifact/{artifact_id}/accessible-users';
+};
+
+export type ArtifactAccessibleUsersErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Artifact not found
+     */
+    404: unknown;
+};
+
+export type ArtifactAccessibleUsersResponses = {
+    /**
+     * Accessible-not-downloaded report
+     */
+    200: AccessibleUsersResponse;
+};
+
+export type ArtifactAccessibleUsersResponse = ArtifactAccessibleUsersResponses[keyof ArtifactAccessibleUsersResponses];
+
+export type ArtifactBlastRadiusData = {
     body?: never;
     path: {
         /**
@@ -6608,6 +7230,57 @@ export type ArtifactBlastRadiusResponses = {
 
 export type ArtifactBlastRadiusResponse = ArtifactBlastRadiusResponses[keyof ArtifactBlastRadiusResponses];
 
+export type CveAccessibleUsersData = {
+    body?: never;
+    path: {
+        /**
+         * CVE id (exact match, e.g. CVE-2021-44228)
+         */
+        cve_id: string;
+    };
+    query?: {
+        /**
+         * Repository to scope the enumeration to. **Required** for the CVE route
+         * (a CVE spans many repos); ignored for the artifact route (implied by the
+         * artifact).
+         */
+        repository_id?: string | null;
+        /**
+         * 1-based page over the accessible-users list.
+         */
+        page?: number | null;
+        /**
+         * Users per page (1..=100, default 20).
+         */
+        per_page?: number | null;
+    };
+    url: '/api/v1/admin/security/cve/{cve_id}/accessible-users';
+};
+
+export type CveAccessibleUsersErrors = {
+    /**
+     * Invalid parameter
+     */
+    400: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * CVE does not affect the repository
+     */
+    404: unknown;
+};
+
+export type CveAccessibleUsersResponses = {
+    /**
+     * Accessible-not-downloaded report
+     */
+    200: AccessibleUsersResponse;
+};
+
+export type CveAccessibleUsersResponse = CveAccessibleUsersResponses[keyof CveAccessibleUsersResponses];
+
 export type CveBlastRadiusData = {
     body?: never;
     path: {
@@ -8716,6 +9389,75 @@ export type BlockPackageResponses = {
 
 export type BlockPackageResponse = BlockPackageResponses[keyof BlockPackageResponses];
 
+export type SearchCurationPackagesData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+    };
+    query?: {
+        /**
+         * Case-insensitive substring match on the package name.
+         */
+        q?: string | null;
+        /**
+         * Exact architecture filter (e.g. `x86_64`, `noarch`).
+         */
+        arch?: string | null;
+        /**
+         * Curation status filter (e.g. `approved`, `pending`, `blocked`, `review`).
+         */
+        status?: string | null;
+        limit?: number;
+        offset?: number;
+    };
+    url: '/api/v1/curation/repos/{repo_key}/packages/search';
+};
+
+export type SearchCurationPackagesErrors = {
+    /**
+     * Repository not found or not visible
+     */
+    404: unknown;
+};
+
+export type SearchCurationPackagesResponses = {
+    200: Array<CurationPackageResponse>;
+};
+
+export type SearchCurationPackagesResponse = SearchCurationPackagesResponses[keyof SearchCurationPackagesResponses];
+
+export type TriggerCurationSyncData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+    };
+    query?: never;
+    url: '/api/v1/curation/repos/{repo_key}/sync';
+};
+
+export type TriggerCurationSyncErrors = {
+    /**
+     * Not authorized to trigger a sync for this repo
+     */
+    403: unknown;
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type TriggerCurationSyncResponses = {
+    200: SyncTriggerResponse;
+};
+
+export type TriggerCurationSyncResponse = TriggerCurationSyncResponses[keyof TriggerCurationSyncResponses];
+
 export type ListCurationRulesData = {
     body?: never;
     path?: never;
@@ -11560,6 +12302,10 @@ export type GetPluginConfigData = {
 };
 
 export type GetPluginConfigErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
     /**
      * Plugin not found
      */
@@ -11588,6 +12334,10 @@ export type UpdatePluginConfigData = {
 };
 
 export type UpdatePluginConfigErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
     /**
      * Plugin not found
      */
@@ -11699,6 +12449,276 @@ export type ReloadPluginResponses = {
 
 export type ReloadPluginResponse = ReloadPluginResponses[keyof ReloadPluginResponses];
 
+export type ProjectsListData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/projects';
+};
+
+export type ProjectsListErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+};
+
+export type ProjectsListResponses = {
+    /**
+     * List of projects
+     */
+    200: ProjectListResponse;
+};
+
+export type ProjectsListResponse = ProjectsListResponses[keyof ProjectsListResponses];
+
+export type ProjectsCreateData = {
+    body: CreateProjectRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/projects';
+};
+
+export type ProjectsCreateErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project key already exists
+     */
+    409: unknown;
+};
+
+export type ProjectsCreateResponses = {
+    /**
+     * Project created
+     */
+    200: Project;
+};
+
+export type ProjectsCreateResponse = ProjectsCreateResponses[keyof ProjectsCreateResponses];
+
+export type ProjectsDeleteData = {
+    body?: never;
+    path: {
+        /**
+         * Project ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/projects/{id}';
+};
+
+export type ProjectsDeleteErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
+     */
+    404: unknown;
+};
+
+export type ProjectsDeleteResponses = {
+    /**
+     * Project deleted
+     */
+    200: unknown;
+};
+
+export type ProjectsGetData = {
+    body?: never;
+    path: {
+        /**
+         * Project ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/projects/{id}';
+};
+
+export type ProjectsGetErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
+     */
+    404: unknown;
+};
+
+export type ProjectsGetResponses = {
+    /**
+     * Project details
+     */
+    200: Project;
+};
+
+export type ProjectsGetResponse = ProjectsGetResponses[keyof ProjectsGetResponses];
+
+export type ProjectsUpdateData = {
+    body: UpdateProjectRequest;
+    path: {
+        /**
+         * Project ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/projects/{id}';
+};
+
+export type ProjectsUpdateErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
+     */
+    404: unknown;
+};
+
+export type ProjectsUpdateResponses = {
+    /**
+     * Project updated
+     */
+    200: Project;
+};
+
+export type ProjectsUpdateResponse = ProjectsUpdateResponses[keyof ProjectsUpdateResponses];
+
+export type ProjectsRemoveMemberData = {
+    body: RemoveProjectMemberRequest;
+    path: {
+        /**
+         * Project ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/projects/{id}/members';
+};
+
+export type ProjectsRemoveMemberErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Grant not found
+     */
+    404: unknown;
+};
+
+export type ProjectsRemoveMemberResponses = {
+    /**
+     * Membership grant removed
+     */
+    200: unknown;
+};
+
+export type ProjectsListMembersData = {
+    body?: never;
+    path: {
+        /**
+         * Project ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/projects/{id}/members';
+};
+
+export type ProjectsListMembersErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
+     */
+    404: unknown;
+};
+
+export type ProjectsListMembersResponses = {
+    /**
+     * Project membership grants
+     */
+    200: ProjectMemberListResponse;
+};
+
+export type ProjectsListMembersResponse = ProjectsListMembersResponses[keyof ProjectsListMembersResponses];
+
+export type ProjectsAddMemberData = {
+    body: AddProjectMemberRequest;
+    path: {
+        /**
+         * Project ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/projects/{id}/members';
+};
+
+export type ProjectsAddMemberErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
+     */
+    404: unknown;
+};
+
+export type ProjectsAddMemberResponses = {
+    /**
+     * Membership grant upserted
+     */
+    200: ProjectMemberRow;
+};
+
+export type ProjectsAddMemberResponse = ProjectsAddMemberResponses[keyof ProjectsAddMemberResponses];
+
 export type ListRulesData = {
     body?: never;
     path?: never;
@@ -12417,6 +13437,15 @@ export type GetHealthDashboardData = {
     url: '/api/v1/quality/health/dashboard';
 };
 
+export type GetHealthDashboardErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: ErrorResponse;
+};
+
+export type GetHealthDashboardError = GetHealthDashboardErrors[keyof GetHealthDashboardErrors];
+
 export type GetHealthDashboardResponses = {
     /**
      * Health dashboard summary
@@ -12637,6 +13666,10 @@ export type ListRepositoriesData = {
         format?: string | null;
         type?: string | null;
         q?: string | null;
+        /**
+         * Filter the listing to repositories assigned to this project (#2472).
+         */
+        project?: string | null;
     };
     url: '/api/v1/repositories';
 };
@@ -13858,6 +14891,34 @@ export type ListRepoScansResponses = {
 
 export type ListRepoScansResponse = ListRepoScansResponses[keyof ListRepoScansResponses];
 
+export type GetRepositoryStorageData = {
+    body?: never;
+    path: {
+        /**
+         * Repository key
+         */
+        key: string;
+    };
+    query?: never;
+    url: '/api/v1/repositories/{key}/storage';
+};
+
+export type GetRepositoryStorageErrors = {
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type GetRepositoryStorageResponses = {
+    /**
+     * Deduplicated storage stats
+     */
+    200: RepositoryStorageStatsResponse;
+};
+
+export type GetRepositoryStorageResponse = GetRepositoryStorageResponses[keyof GetRepositoryStorageResponses];
+
 export type TestUpstreamData = {
     body?: never;
     path: {
@@ -15459,6 +16520,44 @@ export type SetupStatusResponses = {
 
 export type SetupStatusResponse2 = SetupStatusResponses[keyof SetupStatusResponses];
 
+export type SignArtifactData = {
+    body?: never;
+    path: {
+        /**
+         * Artifact ID
+         */
+        artifact_id: string;
+    };
+    query?: never;
+    url: '/api/v1/signing/artifacts/{artifact_id}/sign';
+};
+
+export type SignArtifactErrors = {
+    /**
+     * Admin privilege required
+     */
+    403: ErrorResponse;
+    /**
+     * Artifact not found or not eligible for signing
+     */
+    404: ErrorResponse;
+    /**
+     * Repository has no active signing key/config
+     */
+    409: ErrorResponse;
+};
+
+export type SignArtifactError = SignArtifactErrors[keyof SignArtifactErrors];
+
+export type SignArtifactResponses = {
+    /**
+     * Artifact signed; attestation recorded
+     */
+    200: SignArtifactResponse;
+};
+
+export type SignArtifactResponse2 = SignArtifactResponses[keyof SignArtifactResponses];
+
 export type ListKeysData = {
     body?: never;
     path?: never;