@artifact-keeper/sdk 1.5.8 → 1.7.0

package/src/types.gen.ts

@@ -4,6 +4,50 @@ export type ClientOptions = {
     baseUrl: `${string}://${string}` | (string & {});
 };
 
+/**
+ * One principal that can read an affected artifact but has not downloaded it.
+ */
+export type AccessibleUser = {
+    /**
+     * Always `has-access` for this endpoint (accessible minus downloaded).
+     */
+    reason: string;
+    user_id: string;
+    username: string;
+    /**
+     * How access is granted: `admin` (global), `permission` (fine-grained
+     * direct **or** group grant, repo or owning project), or `role`
+     * (role_assignment only). Direct and group grants both surface as
+     * `permission` because they share one read fragment.
+     */
+    via: string;
+};
+
+/**
+ * Full accessible-but-not-downloaded report for a CVE or artifact, scoped to
+ * one restricted repository.
+ */
+export type AccessibleUsersResponse = {
+    /**
+     * The page of accessible-but-not-downloaded principals. Empty when
+     * `exposure != "enumerable"`.
+     */
+    accessible_not_downloaded: Array<AccessibleUser>;
+    /**
+     * `enumerable` | `everyone` | `effectively-everyone`.
+     */
+    exposure: string;
+    page: number;
+    per_page: number;
+    repository: RepoExposure;
+    target: BlastRadiusTargetInfo;
+    /**
+     * Total accessible-not-downloaded principals (the pagination total).
+     * `null` for `public` repos (never enumerated).
+     */
+    total?: number | null;
+};
+
 export type AcknowledgeRequest = {
     reason: string;
 };
@@ -28,6 +72,19 @@ export type AddPeerLabelRequest = {
     value?: string;
 };
 
+export type AddProjectMemberRequest = {
+    /**
+     * Actions granted on every repository in the project (e.g. ["read"],
+     * ["read", "write"]).
+     */
+    actions: Array<string>;
+    principal_id: string;
+    /**
+     * "user" or "group".
+     */
+    principal_type: string;
+};
+
 export type AddVirtualMemberRequest = {
     member_key: string;
     priority?: number | null;
@@ -246,7 +303,19 @@ export type ArtifactListResponse = {
      * Docker tag grouping.  Only present when `group_by=docker_tag`.
      */
     docker_tags?: Array<DockerTagResponse> | null;
+    /**
+     * Whether another page exists after this one (#2520, #2518). Present on
+     * keyset-paged listings (flat and grouped); authoritative regardless of
+     * the `pagination.total` mode (exact vs lower bound).
+     */
+    has_more?: boolean | null;
     items: Array<ArtifactResponse>;
+    /**
+     * Opaque keyset cursor for the next page (#2520, #2518). Present on
+     * keyset-paged listings (flat and grouped) when another page exists;
+     * pass it back via `?cursor=`.
+     */
+    next_cursor?: string | null;
     pagination: Pagination;
 };
 
@@ -296,6 +365,31 @@ export type ArtifactResponse = {
     } | null;
     name: string;
     path: string;
+    /**
+     * Per-artifact quarantine state so a client/operator can tell which
+     * listed artifacts are held for security review (#2940). Always
+     * serialized so the listing never hides the control:
+     * - `"quarantined"` — held pending review; downloads return 409 (until
+     * any `quarantine_until` lapses),
+     * - `"rejected"` — terminally blocked by an admin,
+     * - a scan-lifecycle state (`"clean"`, `"flagged"`, `"unscanned"`,
+     * `"released"`),
+     * - `"not_quarantined"` — the explicit default when the row carries no
+     * quarantine state, so clients never have to treat a missing value as
+     * a state.
+     *
+     * The human-readable *reason* is intentionally NOT surfaced here: it is
+     * per-artifact security detail disclosed only by the authenticated,
+     * repository-visibility-checked `GET /api/v1/quarantine/{id}` (#2912),
+     * whereas this listing is reachable anonymously on public repositories.
+     */
+    quarantine_status: string;
+    /**
+     * When a timed quarantine hold lapses and the artifact becomes
+     * downloadable again. `None` for a permanent (admin) quarantine and for
+     * artifacts that are not quarantined. (#2940)
+     */
+    quarantine_until?: string | null;
     repository_key: string;
     /**
      * Server-assigned revision number for repositories with first-class
@@ -439,6 +533,18 @@ export type AuthConfig = {
      * Whether an LDAP directory is configured.
      */
     ldap_enabled: boolean;
+    /**
+     * Whether the login UI should offer the local username/password form
+     * (issue #2621). `true` when no SSO provider is enabled; with SSO
+     * enabled it is `true` only when the operator explicitly opted in via
+     * `ALLOW_LOCAL_ADMIN_LOGIN=true` and has not enforced strict SSO-only
+     * via `SSO_DISABLE_ADMIN_BREAK_GLASS`. Display-only: the login endpoint
+     * independently enforces the same policy server-side
+     * (`api::handlers::auth::local_login_gate`), so this flag never grants
+     * access by itself. LDAP is separate — the UI shows the credentials form
+     * for enabled LDAP providers regardless of this flag.
+     */
+    local_login_enabled: boolean;
     /**
      * Whether an OIDC provider is configured.
      */
@@ -966,7 +1072,40 @@ export type CreateApiTokenResponse = {
 };
 
 export type CreateBackupRequest = {
+    /**
+     * Repository ids to exclude from a full or incremental backup (#2772).
+     *
+     * Airgapped or bandwidth-limited deployments use this to keep specific
+     * repositories out of the backup. When omitted or empty nothing is
+     * excluded, so existing behavior is unchanged. If `repository_ids` is
+     * also supplied the excluded ids are removed from that include list;
+     * otherwise every repository except the excluded ones is backed up.
+     */
+    exclude_repositories?: Array<string> | null;
+    /**
+     * Optional custom name/label for the backup archive (#2790).
+     *
+     * When provided it becomes the identifying part of the archive
+     * filename. Restricted to letters, digits, `.`, `_`, and `-`; when
+     * omitted the archive keeps its default `{uuid}` name.
+     */
+    name?: string | null;
+    /**
+     * Explicit allow-list of repository ids to include in the backup.
+     *
+     * When omitted every repository is backed up (subject to
+     * `exclude_repositories`).
+     */
     repository_ids?: Array<string> | null;
+    /**
+     * Optional RFC3339 lower bound on artifact modification time (#2789).
+     *
+     * When set, the (typically incremental) backup includes only artifacts
+     * whose `updated_at` is at or after this timestamp, capturing just the
+     * changes made from the given date/time to now. When omitted every
+     * artifact is included, so backup behavior is unchanged.
+     */
+    since?: string | null;
     type?: string | null;
 };
 
@@ -1065,11 +1204,24 @@ export type CreateLdapConfigRequest = {
     admin_group_dn?: string | null;
     bind_dn?: string | null;
     bind_password?: string | null;
+    /**
+     * Inline PEM CA certificate/chain to trust for this provider's LDAPS/
+     * STARTTLS handshake (migration 174, #2782). Send an empty string to
+     * clear a previously stored certificate.
+     */
+    ca_certificate?: string | null;
     display_name_attribute?: string | null;
     email_attribute?: string | null;
     group_base_dn?: string | null;
     group_filter?: string | null;
     groups_attribute?: string | null;
+    /**
+     * Opt-in (migration 174, #2782): skip TLS certificate verification for
+     * this provider's LDAPS/STARTTLS handshake. Defaults false
+     * (secure-by-default). Only enable for trusted networks / private CAs
+     * you cannot import.
+     */
+    insecure_skip_verify?: boolean | null;
     is_enabled?: boolean | null;
     name: string;
     priority?: number | null;
@@ -1153,6 +1305,16 @@ export type CreatePolicyRequest = {
     require_signature?: boolean;
 };
 
+export type CreateProjectRequest = {
+    description?: string | null;
+    key: string;
+    name: string;
+    /**
+     * P1: stored only, NOT enforced (quota enforcement is P3).
+     */
+    quota_bytes?: number | null;
+};
+
 /**
  * Request to create an access token scoped to a repository.
  */
@@ -1198,6 +1360,40 @@ export type CreateRepositoryRequest = {
      * `allow_anonymous_access` takes precedence.
      */
     allow_anonymous_access?: boolean | null;
+    /**
+     * Custom Description field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_description`.
+     */
+    apt_description?: string | null;
+    /**
+     * Custom Label field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_label`.
+     */
+    apt_label?: string | null;
+    /**
+     * Custom Origin field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_origin`.
+     */
+    apt_origin?: string | null;
+    /**
+     * Custom Version field for Debian/APT Release files.
+     * Stored in `repository_config` under `apt_release_version`.
+     */
+    apt_release_version?: string | null;
+    /**
+     * Opt into ingesting UNVERIFIED upstream metadata on the keyless RPM
+     * curation-sync path (#2569). Omit or `false` to keep the fail-closed
+     * default (a keyless curation sync refuses to ingest unverified upstream
+     * packages); `true` reverts to the legacy unverified-ingest behavior. Only
+     * meaningful for RPM curation staging repositories.
+     */
+    curation_allow_unverified?: boolean | null;
+    /**
+     * Custom User-Agent sent on outbound HTTP requests to the upstream for
+     * this repository. Only valid for remote repositories. Max 256 characters.
+     */
+    custom_user_agent?: string | null;
+    debian?: null | DebianRepositoryConfig;
     description?: string | null;
     format: string;
     /**
@@ -1219,6 +1415,31 @@ export type CreateRepositoryRequest = {
      */
     member_repos?: Array<CreateVirtualMemberInput> | null;
     name: string;
+    /**
+     * Whether unscoped npm package names may resolve through this npm Remote
+     * repository (#2424). Stored under `npm_allow_unscoped`.
+     */
+    npm_allow_unscoped?: boolean | null;
+    /**
+     * Allowed npm full-name glob patterns (`*`/`?`) for this npm Remote
+     * repository (#2424). Additive to `npm_allowed_scopes`; stored under
+     * `npm_allowed_name_patterns`. A name is allowed if its scope is allowed
+     * OR any glob matches (e.g. `@acme*`, `internal-*`).
+     */
+    npm_allowed_name_patterns?: Array<string> | null;
+    /**
+     * Allowed npm `@scope` literals for this npm Remote repository (#2424).
+     * Only meaningful for npm-format Remote repositories; validated and stored
+     * in `repository_config` under `npm_allowed_scopes`. Omit to leave the
+     * repository unrestricted by scope.
+     */
+    npm_allowed_scopes?: Array<string> | null;
+    /**
+     * Optional project to assign this repository to (#2472). Grants on the
+     * project (permissions with `target_type = 'project'`) are inherited by
+     * the repository. Omit to leave the repository unassigned.
+     */
+    project_id?: string | null;
     /**
      * When true, direct user uploads to this repository are rejected:
      * artifacts must arrive via the promotion path. Admin-only to set.
@@ -1246,6 +1467,16 @@ export type CreateRepositoryRequest = {
      * Non-admin users may only use the default backend.
      */
     storage_backend?: string | null;
+    /**
+     * ASCII-armored OpenPGP *public* key trusted to sign this RPM curation
+     * remote's `repodata/repomd.xml` (#2568, RPM curation Phase 3). When set,
+     * the curation sync fetches `repomd.xml.asc` and verifies the detached
+     * signature before ingesting upstream metadata (#2567 reads this column).
+     * Must be a PUBLIC key block; a private-key block is rejected. Write-only:
+     * the response exposes only the boolean `has_trusted_gpg_key`, never the
+     * key material.
+     */
+    trusted_gpg_key?: string | null;
     /**
      * Upstream auth type: "basic" or "bearer". Only valid for remote repos.
      */
@@ -1289,6 +1520,12 @@ export type CreateSamlConfigRequest = {
     certificate: string;
     entity_id: string;
     is_enabled?: boolean | null;
+    /**
+     * Opt-in flag (see migration 157, #2333): when true, SAML assertion
+     * group values are reflected as Artifact Keeper group memberships.
+     * Defaults to false.
+     */
+    map_groups_to_groups?: boolean | null;
     name: string;
     name_id_format?: string | null;
     require_signed_assertions?: boolean | null;
@@ -1492,6 +1729,7 @@ export type CreateWebhookRequest = {
 export type CreatedGroupRow = {
     created_at: string;
     description?: string | null;
+    external_source?: string | null;
     id: string;
     name: string;
     updated_at: string;
@@ -1511,9 +1749,33 @@ export type CreatedPermissionRow = {
 export type CurationCreateRuleRequest = {
     action: string;
     architecture?: string;
-    package_pattern: string;
+    /**
+     * Engine-specific parameters (JSON object). `{}` for `pattern` rules.
+     */
+    config?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Only meaningful for `rule_type = "pattern"`; defaults to `*` so typed
+     * rules (`publisher_trust`, `popularity`) can omit it.
+     */
+    package_pattern?: string;
     priority?: number;
     reason: string;
+    /**
+     * Evaluation engine: `pattern` (default), `publisher_trust`, `popularity`.
+     */
+    rule_type?: string;
+    /**
+     * `repository` (default when `staging_repo_id` is set) or `global`.
+     * When present it must be consistent with `staging_repo_id`: `global`
+     * forbids a repo id, `repository` requires one.
+     */
+    scope?: string | null;
+    /**
+     * Omit (with `scope: "global"` or no `scope`) to create an instance-wide
+     * baseline rule; set to attach the rule to one staging repository.
+     */
     staging_repo_id?: string | null;
     version_constraint?: string;
 };
@@ -1543,10 +1805,20 @@ export type CurationPackageResponse = {
 export type CurationUpdateRuleRequest = {
     action: string;
     architecture?: string;
+    /**
+     * Engine-specific parameters (JSON object). `{}` for `pattern` rules.
+     */
+    config?: {
+        [key: string]: unknown;
+    };
     enabled?: boolean;
     package_pattern: string;
     priority?: number;
     reason: string;
+    /**
+     * Evaluation engine: `pattern` (default), `publisher_trust`, `popularity`.
+     */
+    rule_type?: string;
     version_constraint?: string;
 };
 
@@ -1666,6 +1938,112 @@ export type DbPoolStats = {
     size: number;
 };
 
+/**
+ * Partial-update patch for [`DebianRepositoryConfig`]. Fields left absent are
+ * preserved; provided fields (including an explicit empty list) replace the
+ * stored value. Applied on top of the currently stored config, or on top of
+ * the default when none exists yet.
+ */
+export type DebianConfigPatch = {
+    allow_encoded_separators?: boolean | null;
+    architectures?: Array<string> | null;
+    components?: Array<string> | null;
+    distribution_paths?: Array<string> | null;
+    flat_repository?: boolean | null;
+    include_source_packages?: boolean | null;
+    metadata_strategy?: null | DebianMetadataStrategy;
+    package_fetch_strategy?: null | DebianPackageFetchStrategy;
+    package_queries?: Array<string> | null;
+    upstream_gpg_key_id?: string | null;
+    verify_upstream_metadata?: boolean | null;
+};
+
+/**
+ * How metadata (`Packages`/`Release`) is produced for a Debian remote.
+ *
+ * Only [`DebianMetadataStrategy::UpstreamPassthrough`] is implemented in
+ * 1.6.0; the other variants are reserved for P3 (filtered generation) / P4
+ * (local re-signing) and are rejected with 422 until then. The enum lands now
+ * so those phases can flip it on without a schema/config-shape change.
+ */
+export type DebianMetadataStrategy = 'upstream_passthrough' | 'filter_and_generate' | 'filter_generate_and_sign' | 'hosted_generate';
+
+/**
+ * How package bodies are fetched for a Debian remote.
+ *
+ * Only [`DebianPackageFetchStrategy::UpstreamPassthrough`] is implemented in
+ * 1.6.0.
+ */
+export type DebianPackageFetchStrategy = 'upstream_passthrough' | 'eager';
+
+/**
+ * P2 Debian remote proxy filter config (dist/component/arch allowlists).
+ *
+ * Semantics for each allowlist: an empty list OR a list containing `"*"`
+ * selects everything (today's full-proxy behaviour); otherwise only exact
+ * matches are selected. Architecture-independent (`all`) packages are always
+ * permitted regardless of the `architectures` allowlist.
+ */
+export type DebianRepositoryConfig = {
+    /**
+     * Defense-in-depth (#2562): when `false` (the default) a proxy request
+     * whose path carries a percent-encoded path separator (`%2f` = `/`,
+     * `%5c` = `\`, at any decode layer) is rejected with 400 before any
+     * upstream fetch. APT never percent-encodes path separators, so this only
+     * ever blocks path-confusion/traversal probes; set it `true` to opt out
+     * for a nonstandard upstream that genuinely requires encoded separators.
+     */
+    allow_encoded_separators?: boolean;
+    /**
+     * Architectures (e.g. `amd64`, `arm64`) to proxy. Empty/`["*"]` = all.
+     * `all` (arch-independent) is always permitted.
+     */
+    architectures?: Array<string>;
+    /**
+     * Components (e.g. `main`, `contrib`, `non-free`) to proxy. Empty/`["*"]` = all.
+     */
+    components?: Array<string>;
+    /**
+     * Distributions (a.k.a. suites/codenames, e.g. `bookworm`) to proxy.
+     * Empty or `["*"]` = all.
+     */
+    distribution_paths?: Array<string>;
+    /**
+     * Flat (non-`dists/`) repository layout flag. Accepted but does NOT weaken
+     * P1's flat/redirect abuse posture in passthrough.
+     */
+    flat_repository?: boolean;
+    /**
+     * Whether source packages (`Sources`, `.dsc`) are included. Advisory in
+     * passthrough (upstream metadata is unchanged); honored under P3.
+     */
+    include_source_packages?: boolean;
+    /**
+     * Metadata production strategy. Only `upstream_passthrough` in 1.6.0.
+     */
+    metadata_strategy?: DebianMetadataStrategy;
+    /**
+     * Package-body fetch strategy. Only `upstream_passthrough` in 1.6.0.
+     */
+    package_fetch_strategy?: DebianPackageFetchStrategy;
+    /**
+     * Package-name-level queries. NOT honored in passthrough (that needs P3);
+     * a non-empty value here with `upstream_passthrough` is rejected with 422
+     * rather than silently advertising content the proxy would then block.
+     */
+    package_queries?: Array<string>;
+    /**
+     * Upstream GPG key id used to verify upstream metadata (reserved for P4).
+     */
+    upstream_gpg_key_id?: string | null;
+    /**
+     * Whether to verify the upstream signed `Release` before serving. In P2 the
+     * P1 integrity gate already enforces index/Release consistency; this flag
+     * is reserved for P4 trust-anchor verification.
+     */
+    verify_upstream_metadata?: boolean;
+};
+
 export type DeliveryListResponse = {
     items: Array<DeliveryResponse>;
     total: number;
@@ -1799,6 +2177,13 @@ export type DownloadRecord = {
 export type DownloadTrend = {
     date: string;
     download_count: number;
+    /**
+     * Proxy-served (pull-through) downloads for the day, from the sibling
+     * `proxy_download_statistics` table (#2537/#2704). Additive: hosted
+     * serves stay in `download_count` unchanged; defaults to 0 when
+     * deserializing older payloads.
+     */
+    proxy_download_count?: number;
 };
 
 /**
@@ -2246,6 +2631,10 @@ export type GroupMemberResponse = {
 export type GroupResponse = {
     created_at: string;
     description?: string | null;
+    /**
+     * See [`GroupRow::external_source`]; lets the frontend disable member editing for SSO groups.
+     */
+    external_source?: string | null;
     id: string;
     member_count: number;
     name: string;
@@ -2255,6 +2644,10 @@ export type GroupResponse = {
 export type GroupRow = {
     created_at: string;
     description?: string | null;
+    /**
+     * SSO provider owning the group (`oidc`/`saml`/`ldap`); `None` for local groups. IdP owns membership (#2874).
+     */
+    external_source?: string | null;
     id: string;
     member_count: number;
     name: string;
@@ -2413,7 +2806,20 @@ export type LdapConfigResponse = {
     group_filter?: string | null;
     groups_attribute: string;
     has_bind_password: boolean;
+    /**
+     * Whether a custom inline CA certificate is configured for this provider
+     * (migration 174, #2782). The PEM itself is not returned.
+     */
+    has_ca_certificate: boolean;
     id: string;
+    /**
+     * Opt-in flag (migration 174, #2782): when true, TLS certificate
+     * verification is skipped for this provider's LDAPS/STARTTLS handshake.
+     * Defaults false (secure-by-default). Matches Harbor's "insecure skip
+     * verify"; only enable for trusted networks / private CAs you cannot
+     * import.
+     */
+    insecure_skip_verify: boolean;
     is_enabled: boolean;
     name: string;
     priority: number;
@@ -2481,6 +2887,23 @@ export type LifecyclePolicy = {
 };
 
 export type ListArtifactsQuery = {
+    /**
+     * Total-count mode for keyset-paged listings (#2520, #2519).
+     * `count=exact` runs a dedicated COUNT query so `pagination.total` is
+     * exact; otherwise the keyset-paged listings report a cheap lower bound
+     * (rows seen so far, +1 when another page exists) and `has_more` is the
+     * authoritative "is there a next page" signal.
+     */
+    count?: string | null;
+    /**
+     * Opaque keyset cursor (#2520, #2519, #2518). Pass the `next_cursor`
+     * value from the previous response to fetch the next page; `page` is
+     * ignored while a cursor is present. Supported by the flat artifact
+     * listing of hosted/local, virtual, and remote repositories (#2518,
+     * #2519), by `group_by=docker_tag`, and by `group_by=maven_component`
+     * on remote repositories; other listing modes ignore it.
+     */
+    cursor?: string | null;
     /**
      * Server-side artifact grouping.
      *
@@ -2562,6 +2985,10 @@ export type ListRepositoriesQuery = {
     format?: string | null;
     page?: number | null;
     per_page?: number | null;
+    /**
+     * Filter the listing to repositories assigned to this project (#2472).
+     */
+    project?: string | null;
     q?: string | null;
     type?: string | null;
 };
@@ -2825,26 +3252,33 @@ export type NpmScopePolicyResponse = {
  * layers before any garbage-collection mechanism is enabled.
  *
  * It deliberately does NOT attempt to classify which blobs are
- * "reclaimable orphans": that requires a manifest -> blob reference table
- * that does not yet exist in the schema, and any per-`(repository_id,
- * digest)` orphan heuristic would mis-handle the cross-repo dedup case
- * (multiple `oci_blobs` rows, one physical object) and report in-use
- * blobs as reclaimable. The numbers here are exact aggregates only.
+ * "reclaimable orphans": that is the blob GC's job (mark-and-sweep over
+ * `manifest_blob_refs`, per [`BLOB_PROTECTED_BY_REFS_SQL`]). A naive
+ * per-`(repository_id, digest)` orphan heuristic would mis-handle shared
+ * backends (anything other than `filesystem`), where all referencing
+ * repos share ONE physical object per digest per backend, and report
+ * in-use blobs as reclaimable; on `filesystem` each repository keeps an
+ * independent copy under its own `storage_path`. The numbers here are
+ * exact aggregates only.
  */
 export type OciBlobFootprintReport = {
     /**
-     * Distinct digests older than `grace_hours` (eligible to be *considered*
-     * by a future GC sweep once a reference table exists). Reporting only.
+     * Distinct digests with at least one physical copy older than
+     * `grace_hours` (eligible to be *considered* by a future GC sweep once
+     * a reference table exists). Reporting only.
      */
     aged_distinct_digests: number;
     /**
-     * Physical bytes (distinct-digest) older than `grace_hours`.
+     * Physical bytes (same physical-object grouping as `physical_bytes`)
+     * older than `grace_hours`.
      */
     aged_physical_bytes: number;
     /**
      * Number of distinct blob digests (content-addressed identities). When
      * this is smaller than `total_blob_rows`, the difference is cross-repo
-     * deduplication: rows that share one physical storage object.
+     * sharing of a content identity (one physical object shared by all
+     * referencing repos on shared backends; an independent copy per
+     * repository on `filesystem`).
      */
     distinct_digests: number;
     /**
@@ -2861,8 +3295,13 @@ export type OciBlobFootprintReport = {
      */
     per_repository: Array<OciBlobRepoFootprint>;
     /**
-     * Sum of `size_bytes` counting each distinct digest exactly once. This
-     * approximates the physical bytes occupied in the storage backend.
+     * Sum of `size_bytes` counting each distinct **physical storage
+     * object** exactly once, per the ownership model of
+     * [`BLOB_PROTECTED_BY_REFS_SQL`]: on shared backends (anything other
+     * than `filesystem`) a digest is one object per backend; on
+     * `filesystem` each repository stores its own copy under its
+     * `storage_path`, so the same digest in two filesystem repositories
+     * counts twice.
      */
     physical_bytes: number;
     /**
@@ -2880,10 +3319,13 @@ export type OciBlobRepoFootprint = {
      */
     blob_rows: number;
     /**
-     * Sum of `oci_blobs.size_bytes` for this repository's rows. Because OCI
-     * blob storage is content-addressed and deduplicated across repos, the
+     * Sum of `oci_blobs.size_bytes` for this repository's rows. On shared
+     * backends (anything other than `filesystem`) blobs are deduplicated
+     * across repos — one physical object per digest per backend — so the
      * same physical bytes can be counted under more than one repository
-     * here; see [`OciBlobFootprintReport::physical_bytes`] for the
+     * here. On `filesystem` each repository stores its own independent
+     * copy under its `storage_path`, so its rows are that repo's real
+     * bytes. See [`OciBlobFootprintReport::physical_bytes`] for the
      * dedup-aware total.
      */
     logical_bytes: number;
@@ -2962,6 +3404,23 @@ export type PackageRow = {
     version: string;
 };
 
+export type PackageSearchQuery = {
+    /**
+     * Exact architecture filter (e.g. `x86_64`, `noarch`).
+     */
+    arch?: string | null;
+    limit?: number;
+    offset?: number;
+    /**
+     * Case-insensitive substring match on the package name.
+     */
+    q?: string | null;
+    /**
+     * Curation status filter (e.g. `approved`, `pending`, `blocked`, `review`).
+     */
+    status?: string | null;
+};
+
 export type PackageVersionResponse = {
     checksum_sha256: string;
     created_at: string;
@@ -3295,6 +3754,43 @@ export type ProbeBody = {
     target_peer_id: string;
 };
 
+/**
+ * Project entity.
+ */
+export type Project = {
+    created_at: string;
+    description?: string | null;
+    id: string;
+    /**
+     * Unique, URL-safe project key (e.g. "payments").
+     */
+    key: string;
+    name: string;
+    /**
+     * Storage quota in bytes. P1: stored only, NOT enforced (quotas = P3).
+     */
+    quota_bytes?: number | null;
+    updated_at: string;
+};
+
+export type ProjectListResponse = {
+    items: Array<Project>;
+};
+
+export type ProjectMemberListResponse = {
+    items: Array<ProjectMemberRow>;
+};
+
+/**
+ * One membership grant on a project: a `permissions` row with
+ * `target_type = 'project'`.
+ */
+export type ProjectMemberRow = {
+    actions: Array<string>;
+    principal_id: string;
+    principal_type: string;
+};
+
 export type PromoteArtifactRequest = {
     notes?: string | null;
     skip_policy_check?: boolean;
@@ -3412,9 +3908,23 @@ export type QuarantineActionResponse = {
     new_status: string;
 };
 
+export type QuarantineNowRequest = {
+    /**
+     * Reason shown to developers whose downloads are blocked.
+     */
+    reason?: string | null;
+};
+
 export type QuarantineStatusResponse = {
     artifact_id: string;
     is_blocked: boolean;
+    /**
+     * Why the artifact is held, when one was recorded by a scan policy or an
+     * admin. This is the only surface that discloses the reason: blocked
+     * downloads return a generic message because they are reachable
+     * anonymously on public repositories (#2912).
+     */
+    quarantine_reason?: string | null;
     quarantine_status?: string | null;
     quarantine_until?: string | null;
 };
@@ -3505,6 +4015,24 @@ export type RemoteInstanceResponse = {
     url: string;
 };
 
+export type RemoveProjectMemberRequest = {
+    principal_id: string;
+    principal_type: string;
+};
+
+/**
+ * Repository exposure descriptor echoed in the response.
+ */
+export type RepoExposure = {
+    /**
+     * `public` | `restricted_acl` | `restricted_roles` — see
+     * [`classify_access_scope`].
+     */
+    access_scope: string;
+    repository_id: string;
+    repository_key: string;
+};
+
 export type RepoHealthResponse = {
     artifacts_evaluated: number;
     artifacts_failing: number;
@@ -3580,13 +4108,78 @@ export type RepositoryResponse = {
      * the semantics are clear for remote (pull-through cache) repositories.
      */
     allow_anonymous_access: boolean;
+    /**
+     * Custom Description field for Debian/APT Release files. Omitted from the
+     * Release file when `None` or empty.
+     */
+    apt_description?: string | null;
+    /**
+     * Custom Label field for Debian/APT Release files (default: "artifact-keeper").
+     */
+    apt_label?: string | null;
+    /**
+     * Custom Origin field for Debian/APT Release files (default: "artifact-keeper").
+     */
+    apt_origin?: string | null;
+    /**
+     * Custom Version field for Debian/APT Release files. Omitted from the
+     * Release file when `None` or empty.
+     */
+    apt_release_version?: string | null;
     created_at: string;
+    /**
+     * Stance applied when no curation rule matches: `allow` or `review`.
+     */
+    curation_default_action: string;
+    /**
+     * Whether curation rules are enforced for this repository (#2912).
+     *
+     * Echoed back because this flag now *blocks downloads* on the PyPI proxy
+     * paths, and a security control that cannot be read back is the same class of
+     * problem as one that is stored but not enforced. Stored on the repositories
+     * row, so unlike `quarantine_enabled` this needs no separate lookup.
+     */
+    curation_enabled: boolean;
+    /**
+     * Custom User-Agent used for outbound HTTP requests to the upstream,
+     * read back from `repository_config`. `None` when unset.
+     */
+    custom_user_agent?: string | null;
+    debian?: null | DebianRepositoryConfig;
     description?: string | null;
     format: string;
+    /**
+     * Whether a trusted upstream OpenPGP public key is configured for RPM
+     * curation signature verification (#2568). The key material itself is
+     * never returned; this boolean is the only exposure. `false` for repos
+     * with no key set. Populated by the single-repo handlers (create / get /
+     * update) and the listing; `repo_to_response` alone defaults it to `false`
+     * (it is db-less and cannot read the column).
+     */
+    has_trusted_gpg_key: boolean;
     id: string;
     is_public: boolean;
     key: string;
     name: string;
+    /**
+     * Whether unscoped npm names may resolve through this npm Remote
+     * repository (#2424). Omitted when unset.
+     */
+    npm_allow_unscoped?: boolean | null;
+    /**
+     * Allowed npm full-name glob patterns (#2424), read back from
+     * `repository_config`. Omitted for non-npm repositories or when unset.
+     */
+    npm_allowed_name_patterns?: Array<string> | null;
+    /**
+     * Allowed npm `@scope` literals (#2424), read back from
+     * `repository_config`. Omitted for non-npm repositories or when unset.
+     */
+    npm_allowed_scopes?: Array<string> | null;
+    /**
+     * Project this repository is assigned to (#2472), if any.
+     */
+    project_id?: string | null;
     /**
      * When true, direct user uploads are rejected; artifacts must be promoted.
      */
@@ -3651,12 +4244,144 @@ export type RepositoryStorageBreakdown = {
     download_count: number;
     format: string;
     last_upload_at?: string | null;
+    /**
+     * Downloads served by this repository's remote pull-through proxy
+     * (`proxy_download_statistics`, #2537/#2704). Proxy-cached objects carry
+     * no `artifacts` row (#1280), so these serves are counted in a sibling
+     * table and were previously not readable through any API. Kept separate
+     * from `download_count` (hosted serves) so existing consumers are
+     * unaffected; defaults to 0 when deserializing older payloads.
+     */
+    proxy_download_count?: number;
     repository_id: string;
     repository_key: string;
     repository_name: string;
     storage_bytes: number;
 };
 
+/**
+ * Deduplicated storage-accounting response for a single repository (#2056).
+ *
+ * All figures are read from the materialized `repository_storage_stats` cache
+ * (refreshed on a schedule + post-GC), so this endpoint is an O(1) primary-key
+ * lookup and never runs the heavy cross-repo aggregation. `computed_at` is the
+ * freshness marker; it is `null` until the first refresh has run.
+ *
+ * Quota is unaffected: these numbers are accounting/visibility only and do NOT
+ * change how the repository's storage quota is enforced (#2056 §7).
+ */
+export type RepositoryStorageStatsResponse = {
+    /**
+     * Distinct physical objects (dedup keys) this repository references.
+     */
+    blob_count: number;
+    /**
+     * When these figures were last recomputed. `null` before the first refresh.
+     */
+    computed_at?: string | null;
+    /**
+     * logical_bytes / physical_bytes (1.0 when nothing is stored). Restricted
+     * on cloud backends — see [`physical_bytes`](Self::physical_bytes).
+     */
+    dedup_ratio?: number | null;
+    /**
+     * `per_repo` (filesystem) or `instance` (cloud) — the backend semantics at
+     * compute time.
+     */
+    dedup_scope: string;
+    /**
+     * The instance-wide globally-distinct footprint (true disk usage). On
+     * cloud backends the sum of per-repo `physical_bytes` OVER-counts shared
+     * objects, so this is the authoritative instance total.
+     *
+     * **Admin-only:** this is a whole-instance aggregate that spans every
+     * tenant, so it is only populated for admin callers. It is omitted from the
+     * response entirely for repo-authorized non-admins and anonymous callers,
+     * who see only this repository's own figures (#2559 review).
+     */
+    instance_unique_bytes?: number | null;
+    /**
+     * Sum over every reference (per-row). Now includes OCI layer bytes, which
+     * were previously omitted from all storage accounting.
+     */
+    logical_bytes: number;
+    /**
+     * Deduplicated physical footprint within the dedup scope.
+     *
+     * **Restricted on cloud (instance-scope) backends:** on a shared-storage
+     * backend `physical_bytes`, `unique_bytes`, `shared_bytes` and
+     * `dedup_ratio` are all cross-tenant-derivable — `shared_bytes =
+     * physical_bytes - unique_bytes` reveals whether this repo's blobs are also
+     * stored by another tenant (a per-blob cross-tenant existence oracle,
+     * #2560). The whole derivable set is therefore populated only for admins on
+     * instance-scope backends, and omitted for repo-authorized non-admins /
+     * anonymous callers. On `per_repo` (filesystem) backends there is no
+     * cross-tenant sharing (`shared_bytes == 0` by construction), so all
+     * figures are always present.
+     */
+    physical_bytes?: number | null;
+    repository_key: string;
+    /**
+     * physical_bytes - unique_bytes. Always 0 on filesystem backends (a shared
+     * digest in two repos is two files). Restricted on cloud backends — see
+     * [`physical_bytes`](Self::physical_bytes).
+     */
+    shared_bytes?: number | null;
+    /**
+     * Physical bytes of objects referenced only by this repository.
+     * Restricted on cloud backends — see [`physical_bytes`].
+     *
+     * [`physical_bytes`]: Self::physical_bytes
+     */
+    unique_bytes?: number | null;
+};
+
+/**
+ * Per-prefix (folder tree) storage rollup response (#2601).
+ *
+ * All figures are read from the materialized `repository_path_storage_stats`
+ * cache (refreshed on the storage-stats schedule + post-GC) — a tree call is
+ * an index scan over pre-aggregated rows, never a walk of the artifact table.
+ *
+ * Every figure is within-repository only (references this repo holds), so
+ * unlike the repo-level endpoint's cross-tenant-derivable dedup breakdown
+ * (#2560) nothing here needs an admin restriction beyond repo visibility.
+ */
+export type RepositoryStorageTreeResponse = {
+    /**
+     * Descendant folder nodes, up to `depth` levels below `node`, largest
+     * `logical_bytes` first.
+     */
+    children: Array<StorageTreeNode>;
+    /**
+     * When the rollup was last recomputed. `null` before the first refresh.
+     */
+    computed_at?: string | null;
+    /**
+     * Folder levels below the root that are individually materialized;
+     * deeper files roll up into their ancestor at this depth.
+     */
+    max_materialized_depth: number;
+    /**
+     * The node the listing is rooted at (zeros when the prefix has no
+     * materialized data — unknown folder or refresher not yet run).
+     */
+    node: StorageTreeNode;
+    repository_key: string;
+    /**
+     * True when `limit` cut the descendant listing.
+     */
+    truncated: boolean;
+    /**
+     * Bytes referenced by this repository that carry no logical path and so
+     * cannot be placed in the tree (today: OCI layer blobs; the blob→image
+     * edge lives only in manifest content). Root-level figure; present only
+     * when the request is rooted at `''`. `node.logical_bytes +
+     * unattributed_bytes` reconciles with the repo-level logical total.
+     */
+    unattributed_bytes?: number | null;
+};
+
 export type RescanForInventoryRequest = {
     /**
      * Maximum number of artifacts to enqueue in this call. Operators
@@ -3737,6 +4462,12 @@ export type RoleResponse = {
 
 /**
  * Response returned by the rotate-secret endpoint.
+ *
+ * GHSA-qcmj: the raw signing secret is intentionally NOT returned here. A
+ * rotation only reports success and non-reversible metadata (the display
+ * `secret_digest` and the previous-secret expiry); the new raw secret is
+ * retained only in encrypted form and delivered/consumed out-of-band, so it
+ * cannot be disclosed via this response body or logs.
  */
 export type RotateWebhookSecretResponse = {
     id: string;
@@ -3745,9 +4476,8 @@ export type RotateWebhookSecretResponse = {
      */
     previous_secret_expires_at: string;
     /**
-     * Raw signing secret produced by this rotation. Shown exactly once.
+     * Short, non-reversible identifier for the newly active signing secret.
      */
-    secret: string;
     secret_digest: string;
 };
 
@@ -3782,6 +4512,9 @@ export type RuleEvaluationResponse = {
 export type RuleResponse = {
     action: string;
     architecture: string;
+    config: {
+        [key: string]: unknown;
+    };
     created_at: string;
     created_by?: string | null;
     enabled: boolean;
@@ -3789,6 +4522,8 @@ export type RuleResponse = {
     package_pattern: string;
     priority: number;
     reason: string;
+    rule_type: string;
+    scope: string;
     staging_repo_id?: string | null;
     updated_at: string;
     version_constraint: string;
@@ -3817,6 +4552,12 @@ export type SamlConfigResponse = {
     has_certificate: boolean;
     id: string;
     is_enabled: boolean;
+    /**
+     * Opt-in flag (see migration 157, #2333): when true, SAML assertion
+     * group values are reflected as Artifact Keeper group memberships,
+     * mirroring the OIDC flag from #1094. Defaults to false.
+     */
+    map_groups_to_groups: boolean;
     name: string;
     name_id_format: string;
     require_signed_assertions: boolean;
@@ -3861,6 +4602,11 @@ export type ScanConfigResponse = {
     block_on_policy_violation: boolean;
     created_at: string;
     id: string;
+    /**
+     * #2954: fail-open (default) / fail-closed action for the inline proxy
+     * scan-on-fetch.
+     */
+    proxy_scan_action: string;
     repository_id: string;
     scan_enabled: boolean;
     scan_on_proxy: boolean;
@@ -3878,6 +4624,23 @@ export type ScanResponse = {
     artifact_id: string;
     artifact_name?: string | null;
     artifact_version?: string | null;
+    /**
+     * #2471: number of `not_applicable` scanner rows folded into this row.
+     * `Some(n)` marks a synthetic *summary* row that collapses `n` redundant
+     * "this scanner does not apply" results (e.g. the image-family scanners
+     * `filesystem`/`incus`/`openscap` all declining on a Docker image) into a
+     * single muted "not applicable to this artifact" indication, so the UI
+     * stops rendering N rows that read as N failures. `None` for every real
+     * (non-collapsed) scan row. Omitted from the wire when `None`.
+     */
+    collapsed_not_applicable_count?: number | null;
+    /**
+     * #2471: the individual `scan_type` values folded into a summary row,
+     * sorted and de-duplicated (e.g. `["filesystem","incus","openscap"]`).
+     * Present only on a synthetic summary row (alongside
+     * `collapsed_not_applicable_count`); `None` / omitted otherwise.
+     */
+    collapsed_scan_types?: Array<string> | null;
     completed_at?: string | null;
     created_at: string;
     critical_count: number;
@@ -4080,12 +4843,35 @@ export type SetRoutingRulesRequest = {
  * Response body for the setup status endpoint.
  */
 export type SetupStatusResponse = {
+    /**
+     * Optional deployment-aware instruction for retrieving the generated
+     * initial admin password, sourced from the `SETUP_PASSWORD_HINT` env var.
+     * Present only when an operator has configured it; when absent, the web UI
+     * falls back to its built-in Docker Compose instruction (#2802).
+     */
+    setup_password_hint?: string | null;
     /**
      * Whether the initial admin password change is still required.
      */
     setup_required: boolean;
 };
 
+/**
+ * Response from a deliberate per-artifact signing action (#2535).
+ */
+export type SignArtifactResponse = {
+    algorithm: string;
+    artifact_id: string;
+    /**
+     * The active signing key that produced the attestation.
+     */
+    key_id: string;
+    /**
+     * SHA-256 of the produced signature blob (the blob itself is not persisted).
+     */
+    signature_sha256: string;
+};
+
 export type SigningConfigResponse = {
     key?: null | SigningKeyPublic;
     repository_id: string;
@@ -4236,6 +5022,61 @@ export type StorageSnapshot = {
     total_users: number;
 };
 
+/**
+ * One folder node in the per-prefix storage rollup (#2601).
+ */
+export type StorageTreeNode = {
+    /**
+     * Distinct physical objects under this prefix.
+     */
+    blob_count: number;
+    /**
+     * Number of path segments in `prefix` (0 = root).
+     */
+    depth: number;
+    /**
+     * References (artifact/proxy-cache rows) under this prefix.
+     */
+    file_count: number;
+    /**
+     * Sum over every artifact/proxy-cache reference under this prefix.
+     */
+    logical_bytes: number;
+    /**
+     * Deduplicated within this repository: each distinct physical object
+     * under the prefix counted once. Because an object shared by two sibling
+     * subtrees counts once in each but once at their common ancestor, the sum
+     * of children's `physical_bytes` can exceed the parent's — the difference
+     * is the cross-subtree dedup saving.
+     */
+    physical_bytes: number;
+    /**
+     * Canonical prefix (no leading/trailing `/`; `''` = repository root).
+     */
+    prefix: string;
+};
+
+/**
+ * Query parameters for the per-prefix storage tree (#2601).
+ */
+export type StorageTreeQuery = {
+    /**
+     * How many tree levels below `prefix` to return (default 1 = immediate
+     * children, clamped to 1..=5).
+     */
+    depth?: number | null;
+    /**
+     * Maximum number of descendant nodes returned (default 200, clamped to
+     * 1..=1000). `truncated` is set when the limit cut the listing.
+     */
+    limit?: number | null;
+    /**
+     * Folder prefix to root the listing at (`''`/absent = repository root).
+     * Leading/trailing slashes are ignored.
+     */
+    prefix?: string | null;
+};
+
 export type SubmitCrashesRequest = {
     ids: Array<string>;
 };
@@ -4330,6 +5171,23 @@ export type SyncTaskResponse = {
     storage_key: string;
 };
 
+export type SyncTriggerResponse = {
+    /**
+     * The repository key the sync was triggered for.
+     */
+    repository: string;
+    /**
+     * Whether the sync pass completed without error. A false value with
+     * `triggered = true` means the pass ran but an upstream fetch/verify step
+     * failed for the repo (details are in the server logs, not this response).
+     */
+    succeeded: boolean;
+    /**
+     * Always true when the trigger was accepted and a sync pass ran.
+     */
+    triggered: boolean;
+};
+
 /**
  * Runtime configuration values.
  *
@@ -4698,11 +5556,21 @@ export type UpdateLdapConfigRequest = {
     admin_group_dn?: string | null;
     bind_dn?: string | null;
     bind_password?: string | null;
+    /**
+     * Inline PEM CA certificate/chain (migration 174, #2782). Omit to leave
+     * unchanged; send an empty string to clear.
+     */
+    ca_certificate?: string | null;
     display_name_attribute?: string | null;
     email_attribute?: string | null;
     group_base_dn?: string | null;
     group_filter?: string | null;
     groups_attribute?: string | null;
+    /**
+     * See `CreateLdapConfigRequest::insecure_skip_verify` (migration 174,
+     * #2782). Omit to leave the stored value unchanged.
+     */
+    insecure_skip_verify?: boolean | null;
     is_enabled?: boolean | null;
     name?: string | null;
     priority?: number | null;
@@ -4790,6 +5658,12 @@ export type UpdatePolicyRequest = {
     require_signature?: boolean | null;
 };
 
+export type UpdateProjectRequest = {
+    description?: string | null;
+    name?: string | null;
+    quota_bytes?: number | null;
+};
+
 export type UpdateRepositoryRequest = {
     /**
      * Alias for `is_public`. When set to true, anonymous users can download
@@ -4800,6 +5674,57 @@ export type UpdateRepositoryRequest = {
      * `allow_anonymous_access` takes precedence.
      */
     allow_anonymous_access?: boolean | null;
+    /**
+     * Custom Description field for Debian/APT Release files. Pass an empty
+     * string to remove (omits the field entirely from the Release file).
+     * Stored in `repository_config` under `apt_description`.
+     */
+    apt_description?: string | null;
+    /**
+     * Custom Label field for Debian/APT Release files. Pass an empty string
+     * to reset to the default ("artifact-keeper").
+     * Stored in `repository_config` under `apt_label`.
+     */
+    apt_label?: string | null;
+    /**
+     * Custom Origin field for Debian/APT Release files. Pass an empty string
+     * to reset to the default ("artifact-keeper").
+     * Stored in `repository_config` under `apt_origin`.
+     */
+    apt_origin?: string | null;
+    /**
+     * Custom Version field for Debian/APT Release files. Pass an empty
+     * string to remove (omits the field entirely from the Release file).
+     * Stored in `repository_config` under `apt_release_version`.
+     */
+    apt_release_version?: string | null;
+    /**
+     * Update the keyless-sync unverified-ingest opt-in (#2569). When provided,
+     * sets `curation_allow_unverified` (`false` restores the fail-closed
+     * default; `true` opts into legacy unverified ingest). Omit to leave it
+     * unchanged.
+     */
+    curation_allow_unverified?: boolean | null;
+    /**
+     * Default curation action when no rule matches: allow or review.
+     * "block" is rejected (DB CHECK, migration 071); use block rules for
+     * specific packages instead.
+     *
+     * The allowed set is spelled out in the schema so a generated SDK presents it
+     * rather than an unconstrained string.
+     */
+    curation_default_action: string;
+    /**
+     * Enable curation-rule enforcement on this repository's proxy paths.
+     */
+    curation_enabled?: boolean | null;
+    /**
+     * Update the custom User-Agent for outbound HTTP requests to the upstream.
+     * Only valid for remote repositories. Pass an empty string to remove.
+     * Max 256 characters. Stored in `repository_config` under `custom_user_agent`.
+     */
+    custom_user_agent?: string | null;
+    debian?: null | DebianConfigPatch;
     description?: string | null;
     /**
      * Update the Cargo index upstream URL (stored in `repository_config`).
@@ -4809,6 +5734,28 @@ export type UpdateRepositoryRequest = {
     is_public?: boolean | null;
     key?: string | null;
     name?: string | null;
+    /**
+     * Update whether unscoped npm package names may resolve through this npm
+     * Remote repository (#2424). Stored under `npm_allow_unscoped`.
+     */
+    npm_allow_unscoped?: boolean | null;
+    /**
+     * Update the allowed npm full-name glob patterns for this npm Remote
+     * repository (#2424). When provided, replaces the stored
+     * `npm_allowed_name_patterns` list.
+     */
+    npm_allowed_name_patterns?: Array<string> | null;
+    /**
+     * Update the allowed npm `@scope` literals for this npm Remote repository
+     * (#2424). When provided, replaces the stored `npm_allowed_scopes` list.
+     */
+    npm_allowed_scopes?: Array<string> | null;
+    /**
+     * Assign this repository to a project (#2472). P1 is set-only: omitting
+     * the field leaves the assignment unchanged (unassignment ships with the
+     * project-admin surface in P2).
+     */
+    project_id?: string | null;
     /**
      * When provided, enables/disables the `promotion_only` policy for this
      * repository (admin-only). When omitted, the flag is left unchanged.
@@ -4841,6 +5788,15 @@ export type UpdateRepositoryRequest = {
      * Stored in `repository_config` under `release_repository_id`.
      */
     release_repository_key?: string | null;
+    /**
+     * Update the trusted upstream OpenPGP public key for RPM curation (#2568).
+     * Three-way semantics via `Option<Option<String>>`: omit the field to
+     * leave the stored key unchanged; send `null` to clear it (revert to
+     * "unverified upstream"); send an ASCII-armored PUBLIC key block to set
+     * it. A private-key block or malformed armor is rejected (400). The
+     * response never echoes the key — only `has_trusted_gpg_key`.
+     */
+    trusted_gpg_key?: string | null;
     /**
      * When provided, enables/disables first-class artifact versioning for
      * this Generic/Mlmodel repository (#2367). When omitted, unchanged.
@@ -4868,6 +5824,7 @@ export type UpdateSamlConfigRequest = {
     certificate?: string | null;
     entity_id?: string | null;
     is_enabled?: boolean | null;
+    map_groups_to_groups?: boolean | null;
     name?: string | null;
     name_id_format?: string | null;
     require_signed_assertions?: boolean | null;
@@ -4947,6 +5904,11 @@ export type UpsertLicensePolicyRequest = {
  */
 export type UpsertScanConfigRequest = {
     block_on_policy_violation?: boolean | null;
+    /**
+     * #2954: `'fail_open'` (default) | `'fail_closed'` for the inline proxy
+     * scan-on-fetch action.
+     */
+    proxy_scan_action?: string | null;
     scan_enabled?: boolean | null;
     scan_on_proxy?: boolean | null;
     scan_on_upload?: boolean | null;
@@ -4982,6 +5944,25 @@ export type UserResponse = {
     username: string;
 };
 
+export type VersionResponse = {
+    /**
+     * The number of approved packages frozen into the snapshot.
+     */
+    package_count: number;
+    /**
+     * Whether this version's signed repodata has been published yet.
+     */
+    published: boolean;
+    /**
+     * The repository key the version belongs to.
+     */
+    repository: string;
+    /**
+     * The monotonic snapshot number (published/served under `/rpm/{key}/@N/`).
+     */
+    version_number: number;
+};
+
 export type VirtualMemberPriority = {
     member_key: string;
     priority: number;
@@ -5154,6 +6135,21 @@ export type RejectReviewResponses = {
 
 export type RejectReviewResponse = RejectReviewResponses[keyof RejectReviewResponses];
 
+export type ReopenReviewData = {
+    body: ReviewActionRequest;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/age-gate/reviews/{id}/reopen';
+};
+
+export type ReopenReviewResponses = {
+    200: AgeGateReviewResponse;
+};
+
+export type ReopenReviewResponse = ReopenReviewResponses[keyof ReopenReviewResponses];
+
 export type GetStaleArtifactsData = {
     body?: never;
     path?: never;
@@ -6559,6 +7555,53 @@ export type TriggerSearchReindexResponses = {
 
 export type TriggerSearchReindexResponse = TriggerSearchReindexResponses[keyof TriggerSearchReindexResponses];
 
+export type ArtifactAccessibleUsersData = {
+    body?: never;
+    path: {
+        /**
+         * Artifact id
+         */
+        artifact_id: string;
+    };
+    query?: {
+        /**
+         * Repository to scope the enumeration to. **Required** for the CVE route
+         * (a CVE spans many repos); ignored for the artifact route (implied by the
+         * artifact).
+         */
+        repository_id?: string | null;
+        /**
+         * 1-based page over the accessible-users list.
+         */
+        page?: number | null;
+        /**
+         * Users per page (1..=100, default 20).
+         */
+        per_page?: number | null;
+    };
+    url: '/api/v1/admin/security/artifact/{artifact_id}/accessible-users';
+};
+
+export type ArtifactAccessibleUsersErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Artifact not found
+     */
+    404: unknown;
+};
+
+export type ArtifactAccessibleUsersResponses = {
+    /**
+     * Accessible-not-downloaded report
+     */
+    200: AccessibleUsersResponse;
+};
+
+export type ArtifactAccessibleUsersResponse = ArtifactAccessibleUsersResponses[keyof ArtifactAccessibleUsersResponses];
+
 export type ArtifactBlastRadiusData = {
     body?: never;
     path: {
@@ -6608,6 +7651,57 @@ export type ArtifactBlastRadiusResponses = {
 
 export type ArtifactBlastRadiusResponse = ArtifactBlastRadiusResponses[keyof ArtifactBlastRadiusResponses];
 
+export type CveAccessibleUsersData = {
+    body?: never;
+    path: {
+        /**
+         * CVE id (exact match, e.g. CVE-2021-44228)
+         */
+        cve_id: string;
+    };
+    query?: {
+        /**
+         * Repository to scope the enumeration to. **Required** for the CVE route
+         * (a CVE spans many repos); ignored for the artifact route (implied by the
+         * artifact).
+         */
+        repository_id?: string | null;
+        /**
+         * 1-based page over the accessible-users list.
+         */
+        page?: number | null;
+        /**
+         * Users per page (1..=100, default 20).
+         */
+        per_page?: number | null;
+    };
+    url: '/api/v1/admin/security/cve/{cve_id}/accessible-users';
+};
+
+export type CveAccessibleUsersErrors = {
+    /**
+     * Invalid parameter
+     */
+    400: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * CVE does not affect the repository
+     */
+    404: unknown;
+};
+
+export type CveAccessibleUsersResponses = {
+    /**
+     * Accessible-not-downloaded report
+     */
+    200: AccessibleUsersResponse;
+};
+
+export type CveAccessibleUsersResponse = CveAccessibleUsersResponses[keyof CveAccessibleUsersResponses];
+
 export type CveBlastRadiusData = {
     body?: never;
     path: {
@@ -8716,19 +9810,166 @@ export type BlockPackageResponses = {
 
 export type BlockPackageResponse = BlockPackageResponses[keyof BlockPackageResponses];
 
-export type ListCurationRulesData = {
+export type SearchCurationPackagesData = {
     body?: never;
-    path?: never;
-    query?: {
+    path: {
         /**
-         * Filter by staging repo
+         * Staging repository key
          */
-        staging_repo_id?: string;
+        repo_key: string;
     };
-    url: '/api/v1/curation/rules';
-};
-
-export type ListCurationRulesResponses = {
+    query?: {
+        /**
+         * Case-insensitive substring match on the package name.
+         */
+        q?: string | null;
+        /**
+         * Exact architecture filter (e.g. `x86_64`, `noarch`).
+         */
+        arch?: string | null;
+        /**
+         * Curation status filter (e.g. `approved`, `pending`, `blocked`, `review`).
+         */
+        status?: string | null;
+        limit?: number;
+        offset?: number;
+    };
+    url: '/api/v1/curation/repos/{repo_key}/packages/search';
+};
+
+export type SearchCurationPackagesErrors = {
+    /**
+     * Repository not found or not visible
+     */
+    404: unknown;
+};
+
+export type SearchCurationPackagesResponses = {
+    200: Array<CurationPackageResponse>;
+};
+
+export type SearchCurationPackagesResponse = SearchCurationPackagesResponses[keyof SearchCurationPackagesResponses];
+
+export type TriggerCurationSyncData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+    };
+    query?: never;
+    url: '/api/v1/curation/repos/{repo_key}/sync';
+};
+
+export type TriggerCurationSyncErrors = {
+    /**
+     * Not authorized to trigger a sync for this repo
+     */
+    403: unknown;
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type TriggerCurationSyncResponses = {
+    200: SyncTriggerResponse;
+};
+
+export type TriggerCurationSyncResponse = TriggerCurationSyncResponses[keyof TriggerCurationSyncResponses];
+
+export type CreateCurationVersionData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+    };
+    query?: never;
+    url: '/api/v1/curation/repos/{repo_key}/versions';
+};
+
+export type CreateCurationVersionErrors = {
+    /**
+     * No approved packages / packages need re-sync
+     */
+    400: unknown;
+    /**
+     * Not authorized for this repo
+     */
+    403: unknown;
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type CreateCurationVersionResponses = {
+    201: VersionResponse;
+};
+
+export type CreateCurationVersionResponse = CreateCurationVersionResponses[keyof CreateCurationVersionResponses];
+
+export type PublishCurationVersionData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+        /**
+         * Version number to publish
+         */
+        n: number;
+    };
+    query?: never;
+    url: '/api/v1/curation/repos/{repo_key}/versions/{n}/publish';
+};
+
+export type PublishCurationVersionErrors = {
+    /**
+     * Empty version / missing snippet / no signing key
+     */
+    400: unknown;
+    /**
+     * Not authorized for this repo
+     */
+    403: unknown;
+    /**
+     * Repository or version not found
+     */
+    404: unknown;
+    /**
+     * Version already published (immutable)
+     */
+    409: unknown;
+};
+
+export type PublishCurationVersionResponses = {
+    200: VersionResponse;
+};
+
+export type PublishCurationVersionResponse = PublishCurationVersionResponses[keyof PublishCurationVersionResponses];
+
+export type ListCurationRulesData = {
+    body?: never;
+    path?: never;
+    query?: {
+        /**
+         * Filter by staging repo
+         */
+        staging_repo_id?: string;
+        /**
+         * Filter by rule scope: `global` lists only the instance-wide baseline rules (admin-only)
+         */
+        scope?: string;
+    };
+    url: '/api/v1/curation/rules';
+};
+
+export type ListCurationRulesResponses = {
     200: Array<RuleResponse>;
 };
 
@@ -11523,181 +12764,459 @@ export type GetPluginData = {
     body?: never;
     path: {
         /**
-         * Plugin ID
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/plugins/{id}';
+};
+
+export type GetPluginErrors = {
+    /**
+     * Plugin not found
+     */
+    404: unknown;
+};
+
+export type GetPluginResponses = {
+    /**
+     * Plugin details
+     */
+    200: PluginResponse;
+};
+
+export type GetPluginResponse = GetPluginResponses[keyof GetPluginResponses];
+
+export type GetPluginConfigData = {
+    body?: never;
+    path: {
+        /**
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/plugins/{id}/config';
+};
+
+export type GetPluginConfigErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Plugin not found
+     */
+    404: unknown;
+};
+
+export type GetPluginConfigResponses = {
+    /**
+     * Plugin configuration
+     */
+    200: PluginConfigResponse;
+};
+
+export type GetPluginConfigResponse = GetPluginConfigResponses[keyof GetPluginConfigResponses];
+
+export type UpdatePluginConfigData = {
+    body: UpdatePluginConfigRequest;
+    path: {
+        /**
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/plugins/{id}/config';
+};
+
+export type UpdatePluginConfigErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Plugin not found
+     */
+    404: unknown;
+};
+
+export type UpdatePluginConfigResponses = {
+    /**
+     * Plugin configuration updated
+     */
+    200: PluginConfigResponse;
+};
+
+export type UpdatePluginConfigResponse = UpdatePluginConfigResponses[keyof UpdatePluginConfigResponses];
+
+export type DisablePluginData = {
+    body?: never;
+    path: {
+        /**
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/plugins/{id}/disable';
+};
+
+export type DisablePluginErrors = {
+    /**
+     * Plugin not found
+     */
+    404: unknown;
+};
+
+export type DisablePluginResponses = {
+    /**
+     * Plugin disabled successfully
+     */
+    200: unknown;
+};
+
+export type EnablePluginData = {
+    body?: never;
+    path: {
+        /**
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/plugins/{id}/enable';
+};
+
+export type EnablePluginErrors = {
+    /**
+     * Plugin not found
+     */
+    404: unknown;
+};
+
+export type EnablePluginResponses = {
+    /**
+     * Plugin enabled successfully
+     */
+    200: unknown;
+};
+
+export type GetPluginEventsData = {
+    body?: never;
+    path: {
+        /**
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: {
+        limit?: number | null;
+    };
+    url: '/api/v1/plugins/{id}/events';
+};
+
+export type GetPluginEventsResponses = {
+    /**
+     * Plugin events
+     */
+    200: Array<unknown>;
+};
+
+export type GetPluginEventsResponse = GetPluginEventsResponses[keyof GetPluginEventsResponses];
+
+export type ReloadPluginData = {
+    body?: never;
+    path: {
+        /**
+         * Plugin ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/plugins/{id}/reload';
+};
+
+export type ReloadPluginResponses = {
+    /**
+     * Plugin reloaded successfully
+     */
+    200: WasmPluginResponse;
+};
+
+export type ReloadPluginResponse = ReloadPluginResponses[keyof ReloadPluginResponses];
+
+export type ProjectsListData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/projects';
+};
+
+export type ProjectsListErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+};
+
+export type ProjectsListResponses = {
+    /**
+     * List of projects
+     */
+    200: ProjectListResponse;
+};
+
+export type ProjectsListResponse = ProjectsListResponses[keyof ProjectsListResponses];
+
+export type ProjectsCreateData = {
+    body: CreateProjectRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/projects';
+};
+
+export type ProjectsCreateErrors = {
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project key already exists
+     */
+    409: unknown;
+};
+
+export type ProjectsCreateResponses = {
+    /**
+     * Project created
+     */
+    200: Project;
+};
+
+export type ProjectsCreateResponse = ProjectsCreateResponses[keyof ProjectsCreateResponses];
+
+export type ProjectsDeleteData = {
+    body?: never;
+    path: {
+        /**
+         * Project ID
          */
         id: string;
     };
     query?: never;
-    url: '/api/v1/plugins/{id}';
+    url: '/api/v1/projects/{id}';
 };
 
-export type GetPluginErrors = {
+export type ProjectsDeleteErrors = {
     /**
-     * Plugin not found
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
      */
     404: unknown;
 };
 
-export type GetPluginResponses = {
+export type ProjectsDeleteResponses = {
     /**
-     * Plugin details
+     * Project deleted
      */
-    200: PluginResponse;
+    200: unknown;
 };
 
-export type GetPluginResponse = GetPluginResponses[keyof GetPluginResponses];
-
-export type GetPluginConfigData = {
+export type ProjectsGetData = {
     body?: never;
     path: {
         /**
-         * Plugin ID
+         * Project ID
          */
         id: string;
     };
     query?: never;
-    url: '/api/v1/plugins/{id}/config';
+    url: '/api/v1/projects/{id}';
 };
 
-export type GetPluginConfigErrors = {
+export type ProjectsGetErrors = {
     /**
-     * Plugin not found
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
      */
     404: unknown;
 };
 
-export type GetPluginConfigResponses = {
+export type ProjectsGetResponses = {
     /**
-     * Plugin configuration
+     * Project details
      */
-    200: PluginConfigResponse;
+    200: Project;
 };
 
-export type GetPluginConfigResponse = GetPluginConfigResponses[keyof GetPluginConfigResponses];
+export type ProjectsGetResponse = ProjectsGetResponses[keyof ProjectsGetResponses];
 
-export type UpdatePluginConfigData = {
-    body: UpdatePluginConfigRequest;
+export type ProjectsUpdateData = {
+    body: UpdateProjectRequest;
     path: {
         /**
-         * Plugin ID
+         * Project ID
          */
         id: string;
     };
     query?: never;
-    url: '/api/v1/plugins/{id}/config';
+    url: '/api/v1/projects/{id}';
 };
 
-export type UpdatePluginConfigErrors = {
+export type ProjectsUpdateErrors = {
     /**
-     * Plugin not found
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
      */
     404: unknown;
 };
 
-export type UpdatePluginConfigResponses = {
+export type ProjectsUpdateResponses = {
     /**
-     * Plugin configuration updated
+     * Project updated
      */
-    200: PluginConfigResponse;
+    200: Project;
 };
 
-export type UpdatePluginConfigResponse = UpdatePluginConfigResponses[keyof UpdatePluginConfigResponses];
+export type ProjectsUpdateResponse = ProjectsUpdateResponses[keyof ProjectsUpdateResponses];
 
-export type DisablePluginData = {
-    body?: never;
+export type ProjectsRemoveMemberData = {
+    body: RemoveProjectMemberRequest;
     path: {
         /**
-         * Plugin ID
+         * Project ID
          */
         id: string;
     };
     query?: never;
-    url: '/api/v1/plugins/{id}/disable';
+    url: '/api/v1/projects/{id}/members';
 };
 
-export type DisablePluginErrors = {
+export type ProjectsRemoveMemberErrors = {
     /**
-     * Plugin not found
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Grant not found
      */
     404: unknown;
 };
 
-export type DisablePluginResponses = {
+export type ProjectsRemoveMemberResponses = {
     /**
-     * Plugin disabled successfully
+     * Membership grant removed
      */
     200: unknown;
 };
 
-export type EnablePluginData = {
+export type ProjectsListMembersData = {
     body?: never;
     path: {
         /**
-         * Plugin ID
+         * Project ID
          */
         id: string;
     };
     query?: never;
-    url: '/api/v1/plugins/{id}/enable';
+    url: '/api/v1/projects/{id}/members';
 };
 
-export type EnablePluginErrors = {
+export type ProjectsListMembersErrors = {
     /**
-     * Plugin not found
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
      */
     404: unknown;
 };
 
-export type EnablePluginResponses = {
+export type ProjectsListMembersResponses = {
     /**
-     * Plugin enabled successfully
+     * Project membership grants
      */
-    200: unknown;
+    200: ProjectMemberListResponse;
 };
 
-export type GetPluginEventsData = {
-    body?: never;
+export type ProjectsListMembersResponse = ProjectsListMembersResponses[keyof ProjectsListMembersResponses];
+
+export type ProjectsAddMemberData = {
+    body: AddProjectMemberRequest;
     path: {
         /**
-         * Plugin ID
+         * Project ID
          */
         id: string;
     };
-    query?: {
-        limit?: number | null;
-    };
-    url: '/api/v1/plugins/{id}/events';
+    query?: never;
+    url: '/api/v1/projects/{id}/members';
 };
 
-export type GetPluginEventsResponses = {
+export type ProjectsAddMemberErrors = {
     /**
-     * Plugin events
+     * Authentication required
      */
-    200: Array<unknown>;
-};
-
-export type GetPluginEventsResponse = GetPluginEventsResponses[keyof GetPluginEventsResponses];
-
-export type ReloadPluginData = {
-    body?: never;
-    path: {
-        /**
-         * Plugin ID
-         */
-        id: string;
-    };
-    query?: never;
-    url: '/api/v1/plugins/{id}/reload';
+    401: unknown;
+    /**
+     * Admin privileges required
+     */
+    403: unknown;
+    /**
+     * Project not found
+     */
+    404: unknown;
 };
 
-export type ReloadPluginResponses = {
+export type ProjectsAddMemberResponses = {
     /**
-     * Plugin reloaded successfully
+     * Membership grant upserted
      */
-    200: WasmPluginResponse;
+    200: ProjectMemberRow;
 };
 
-export type ReloadPluginResponse = ReloadPluginResponses[keyof ReloadPluginResponses];
+export type ProjectsAddMemberResponse = ProjectsAddMemberResponses[keyof ProjectsAddMemberResponses];
 
 export type ListRulesData = {
     body?: never;
@@ -12417,6 +13936,15 @@ export type GetHealthDashboardData = {
     url: '/api/v1/quality/health/dashboard';
 };
 
+export type GetHealthDashboardErrors = {
+    /**
+     * Admin privileges required
+     */
+    403: ErrorResponse;
+};
+
+export type GetHealthDashboardError = GetHealthDashboardErrors[keyof GetHealthDashboardErrors];
+
 export type GetHealthDashboardResponses = {
     /**
      * Health dashboard summary
@@ -12548,6 +14076,53 @@ export type GetQuarantineStatusResponses = {
 
 export type GetQuarantineStatusResponse = GetQuarantineStatusResponses[keyof GetQuarantineStatusResponses];
 
+export type QuarantineArtifactNowData = {
+    /**
+     * Optional; empty body uses the default reason
+     */
+    body: QuarantineNowRequest;
+    path: {
+        /**
+         * Artifact ID
+         */
+        artifact_id: string;
+    };
+    query?: never;
+    url: '/api/v1/quarantine/{artifact_id}/quarantine';
+};
+
+export type QuarantineArtifactNowErrors = {
+    /**
+     * Malformed request body
+     */
+    400: unknown;
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin access required
+     */
+    403: unknown;
+    /**
+     * Artifact not found
+     */
+    404: unknown;
+    /**
+     * Artifact was rejected during security review
+     */
+    409: unknown;
+};
+
+export type QuarantineArtifactNowResponses = {
+    /**
+     * Artifact quarantined
+     */
+    200: QuarantineActionResponse;
+};
+
+export type QuarantineArtifactNowResponse = QuarantineArtifactNowResponses[keyof QuarantineArtifactNowResponses];
+
 export type RejectQuarantinedArtifactData = {
     body: RejectRequest;
     path: {
@@ -12637,6 +14212,10 @@ export type ListRepositoriesData = {
         format?: string | null;
         type?: string | null;
         q?: string | null;
+        /**
+         * Filter the listing to repositories assigned to this project (#2472).
+         */
+        project?: string | null;
     };
     url: '/api/v1/repositories';
 };
@@ -12839,6 +14418,23 @@ export type ListArtifactsData = {
          * `docker_tags` array.
          */
         group_by?: string | null;
+        /**
+         * Opaque keyset cursor (#2520, #2519, #2518). Pass the `next_cursor`
+         * value from the previous response to fetch the next page; `page` is
+         * ignored while a cursor is present. Supported by the flat artifact
+         * listing of hosted/local, virtual, and remote repositories (#2518,
+         * #2519), by `group_by=docker_tag`, and by `group_by=maven_component`
+         * on remote repositories; other listing modes ignore it.
+         */
+        cursor?: string | null;
+        /**
+         * Total-count mode for keyset-paged listings (#2520, #2519).
+         * `count=exact` runs a dedicated COUNT query so `pagination.total` is
+         * exact; otherwise the keyset-paged listings report a cheap lower bound
+         * (rows seen so far, +1 when another page exists) and `has_more` is the
+         * authoritative "is there a next page" signal.
+         */
+        count?: string | null;
     };
     url: '/api/v1/repositories/{key}/artifacts';
 };
@@ -13436,13 +15032,17 @@ export type UpdateVirtualMembersData = {
 
 export type UpdateVirtualMembersErrors = {
     /**
-     * Repository is not virtual
+     * Repository is not virtual, or a member is invalid
      */
     400: unknown;
     /**
      * Authentication required
      */
     401: unknown;
+    /**
+     * Insufficient permissions
+     */
+    403: unknown;
     /**
      * Repository not found
      */
@@ -13451,7 +15051,7 @@ export type UpdateVirtualMembersErrors = {
 
 export type UpdateVirtualMembersResponses = {
     /**
-     * Members updated
+     * Members replaced with the supplied set
      */
     200: VirtualMembersListResponse;
 };
@@ -13858,6 +15458,78 @@ export type ListRepoScansResponses = {
 
 export type ListRepoScansResponse = ListRepoScansResponses[keyof ListRepoScansResponses];
 
+export type GetRepositoryStorageData = {
+    body?: never;
+    path: {
+        /**
+         * Repository key
+         */
+        key: string;
+    };
+    query?: never;
+    url: '/api/v1/repositories/{key}/storage';
+};
+
+export type GetRepositoryStorageErrors = {
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type GetRepositoryStorageResponses = {
+    /**
+     * Deduplicated storage stats
+     */
+    200: RepositoryStorageStatsResponse;
+};
+
+export type GetRepositoryStorageResponse = GetRepositoryStorageResponses[keyof GetRepositoryStorageResponses];
+
+export type GetRepositoryStorageTreeData = {
+    body?: never;
+    path: {
+        /**
+         * Repository key
+         */
+        key: string;
+    };
+    query?: {
+        /**
+         * Folder prefix to root the listing at (`''`/absent = repository root).
+         * Leading/trailing slashes are ignored.
+         */
+        prefix?: string | null;
+        /**
+         * How many tree levels below `prefix` to return (default 1 = immediate
+         * children, clamped to 1..=5).
+         */
+        depth?: number | null;
+        /**
+         * Maximum number of descendant nodes returned (default 200, clamped to
+         * 1..=1000). `truncated` is set when the limit cut the listing.
+         */
+        limit?: number | null;
+    };
+    url: '/api/v1/repositories/{key}/storage/tree';
+};
+
+export type GetRepositoryStorageTreeErrors = {
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type GetRepositoryStorageTreeResponses = {
+    /**
+     * Per-prefix storage rollup
+     */
+    200: RepositoryStorageTreeResponse;
+};
+
+export type GetRepositoryStorageTreeResponse = GetRepositoryStorageTreeResponses[keyof GetRepositoryStorageTreeResponses];
+
 export type TestUpstreamData = {
     body?: never;
     path: {
@@ -15459,6 +17131,44 @@ export type SetupStatusResponses = {
 
 export type SetupStatusResponse2 = SetupStatusResponses[keyof SetupStatusResponses];
 
+export type SignArtifactData = {
+    body?: never;
+    path: {
+        /**
+         * Artifact ID
+         */
+        artifact_id: string;
+    };
+    query?: never;
+    url: '/api/v1/signing/artifacts/{artifact_id}/sign';
+};
+
+export type SignArtifactErrors = {
+    /**
+     * Admin privilege required
+     */
+    403: ErrorResponse;
+    /**
+     * Artifact not found or not eligible for signing
+     */
+    404: ErrorResponse;
+    /**
+     * Repository has no active signing key/config
+     */
+    409: ErrorResponse;
+};
+
+export type SignArtifactError = SignArtifactErrors[keyof SignArtifactErrors];
+
+export type SignArtifactResponses = {
+    /**
+     * Artifact signed; attestation recorded
+     */
+    200: SignArtifactResponse;
+};
+
+export type SignArtifactResponse2 = SignArtifactResponses[keyof SignArtifactResponses];
+
 export type ListKeysData = {
     body?: never;
     path?: never;
@@ -17068,7 +18778,7 @@ export type RotateWebhookSecretErrors = {
 
 export type RotateWebhookSecretResponses = {
     /**
-     * Secret rotated. Body includes the new raw secret exactly once.
+     * Secret rotated. Body reports success and metadata only; the raw secret is not returned.
      */
     200: RotateWebhookSecretResponse;
 };