@bodhiapp/ts-client 0.1.32 → 0.1.34

package/dist/types/types.gen.ts

@@ -1,75 +1,45 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 export type AccessRequestActionResponse = {
-    /**
-     * Updated status after action
-     */
     status: AppAccessRequestStatus;
-    /**
-     * Flow type of the access request
-     */
     flow_type: FlowType;
     /**
-     * Redirect URL (present for redirect flow)
+     * Present for redirect flow
      */
     redirect_url?: string | null;
 };
 
 export type AccessRequestReviewResponse = {
-    /**
-     * Access request ID
-     */
     id: string;
-    /**
-     * App client ID
-     */
     app_client_id: string;
     /**
-     * App name from KC (if available)
+     * From KC, if available
      */
     app_name?: string | null;
     /**
-     * App description from KC (if available)
+     * From KC, if available
      */
     app_description?: string | null;
     /**
-     * Flow type: "redirect" or "popup"
+     * One of: "redirect", "popup"
      */
     flow_type: FlowType;
-    /**
-     * Current status
-     */
     status: AppAccessRequestStatus;
-    /**
-     * Role requested by the app
-     */
     requested_role: string;
-    /**
-     * Resources requested
-     */
     requested: RequestedResources;
-    /**
-     * MCP server information with user instances
-     */
     mcps_info?: Array<McpServerReviewInfo>;
 };
 
 export type AccessRequestStatusResponse = {
-    /**
-     * Access request ID
-     */
     id: string;
     /**
-     * Current status: "draft", "approved", "denied", "failed"
+     * One of: "draft", "approved", "denied", "failed"
      */
     status: AppAccessRequestStatus;
-    /**
-     * Role requested by the app
-     */
     requested_role: UserScope;
     approved_role?: null | UserScope;
     /**
-     * Access request scope (present when user-approved with tools)
+     * Present when user-approved with tools
      */
     access_request_scope?: string | null;
 };
@@ -84,13 +54,53 @@ export type Alias = (UserAlias & {
     source: 'model';
 }) | (ApiAlias & {
     source: 'api';
+}) | (ModelRouterAlias & {
+    source: 'model_router';
 });
 
+/**
+ * Facet filter query parameters for the All-Models list (`GET /bodhi/v1/models`).
+ *
+ * All facets are server-side and applied before pagination so `total` and the page
+ * reflect the filtered set. Multi-value facets accept a comma-separated list; an empty
+ * or absent value means "no filter for this facet" (all rows pass).
+ */
+export type AliasFilterParams = {
+    /**
+     * Alias type facet (comma-separated): `local_file`, `model_alias`, `api_model`, `fallback`.
+     */
+    type?: string | null;
+    /**
+     * API-format facet (comma-separated), API rows only: `openai`, `responses`, `anthropic`,
+     * `gemini`, `liberty`. `anthropic` matches both anthropic and anthropic_oauth aliases.
+     */
+    api_format?: string | null;
+    /**
+     * Minimum local-file size in bytes (inclusive). Applies to local rows with a known size;
+     * rows without a size (API/router) are not filtered out by size.
+     */
+    size_min?: number | null;
+    /**
+     * Maximum local-file size in bytes (inclusive). See `size_min`.
+     */
+    size_max?: number | null;
+    /**
+     * Capability facet (comma-separated), local rows only: `vision`, `tool_use`, `reasoning`.
+     * A row passes only if it has metadata with every requested capability set true.
+     */
+    capability?: string | null;
+    /**
+     * Free-text search (case-insensitive substring) over a row's identifying fields — alias/name,
+     * repo, filename for local rows; id, name, base_url for API rows; alias for routers.
+     */
+    search?: string | null;
+};
+
 /**
  * Response envelope for model aliases - hides internal implementation details
  * Uses untagged serialization - each variant has its own "source" field
  */
-export type AliasResponse = UserAliasResponse | ModelAliasResponse | ApiAliasResponse;
+export type AliasResponse = ModelRouterResponse | UserAliasResponse | ModelAliasResponse | ApiAliasResponse;
 
 /**
  * Mirrors Anthropic's `ModelInfo` schema — full model metadata returned by
@@ -111,14 +121,11 @@ export type AnthropicModel = {
     capabilities?: null | AnthropicModelCapabilities;
     max_input_tokens?: number | null;
     max_tokens?: number | null;
-    /**
-     * Always `"model"` — included for Anthropic API compatibility.
-     */
     type: string;
 };
 
 /**
- * Model capability information (Anthropic ModelCapabilities schema).
+ * Anthropic ModelCapabilities schema.
  */
 export type AnthropicModelCapabilities = {
     batch: CapabilitySupport;
@@ -134,6 +141,7 @@ export type AnthropicModelCapabilities = {
 
 export type ApiAlias = {
     id: string;
+    name: string;
     api_format: ApiFormat;
     base_url: string;
     models: ApiModelVec;
@@ -151,6 +159,7 @@ export type ApiAlias = {
 export type ApiAliasResponse = {
     source: string;
     id: string;
+    name: string;
     api_format: ApiFormat;
     base_url: string;
     has_api_key: boolean;
@@ -233,7 +242,29 @@ export type ApiModelRequest = (DefaultApiModelRequest & {
  */
 export type ApiModelVec = Array<ApiModel>;
 
-export type AppAccessRequestStatus = 'draft' | 'approved' | 'denied' | 'failed' | 'expired';
+export type AppAccessRequestStatus = 'draft' | 'approved' | 'denied' | 'failed' | 'expired' | 'revoked';
+
+/**
+ * One issued app token (approved access request) with its effective grant summary.
+ */
+export type AppAccessSummary = {
+    id: string;
+    app_client_id: string;
+    app_name?: string | null;
+    app_description?: string | null;
+    status: AppAccessRequestStatus;
+    approved_role?: null | UserScope;
+    /**
+     * Effective model access granted to this app.
+     */
+    models: ResourceAccess;
+    /**
+     * Effective MCP access granted to this app.
+     */
+    mcps: ResourceAccess;
+    created_at: string;
+    updated_at: string;
+};
 
 /**
  * Application information and status
@@ -263,6 +294,11 @@ export type AppInfo = {
      * Public URL of the server
      */
     url: string;
+    /**
+     * Base URL of the external reference API the frontend calls directly (configurable via
+     * `BODHI_REFERENCE_API_URL`, env-overridable for tests)
+     */
+    reference_api_url: string;
 };
 
 export type AppRole = ResourceRole | TokenScope | UserScope;
@@ -271,9 +307,6 @@ export type AppStatus = 'setup' | 'ready' | 'resource_admin';
 
 export type ApprovalStatus = 'approved' | 'denied';
 
-/**
- * Request for approving an app access request
- */
 export type ApproveAccessRequest = {
     /**
      * Role to grant for the approved request (scope_user_user or scope_user_power_user)
@@ -296,33 +329,43 @@ export type ApproveUserAccessRequest = {
 };
 
 /**
- * Versioned envelope for approved resources.
  * The `version` tag is mandatory and must match the corresponding `RequestedResources` version.
  */
 export type ApprovedResources = ApprovedResourcesV1 & {
     version: '1';
 };
 
+/**
+ * What the owner granted at consent. Field names mirror `RequestedResourcesV1`
+ * (`models_list` / `models_access` / `mcps_list` / `mcps_access`) — there the
+ * values are UI-driver booleans, here they are the actual grants. `mcps` holds
+ * the by-url instance approvals; `mcps_access` is the owner-granted set beyond them.
+ */
 export type ApprovedResourcesV1 = {
+    models_list?: boolean;
+    models_access?: ModelGrant;
+    mcps_list?: boolean;
     mcps?: Array<McpApproval>;
+    /**
+     * Owner-granted MCP instances beyond the by-url requests. Defaults to none
+     * (empty `Specific`) — unlike a token's all-access default.
+     */
+    mcps_access?: McpGrant;
 };
 
 export type AuthCallbackRequest = {
     /**
-     * OAuth authorization code from successful authentication (required for success flow)
+     * Required for the success flow
      */
     code?: string | null;
     /**
-     * OAuth state parameter for CSRF protection (must match initiated request)
+     * CSRF protection — must match the initiated request
      */
     state?: string | null;
     /**
      * OAuth error code if authentication failed (e.g., "access_denied")
      */
     error?: string | null;
-    /**
-     * Human-readable OAuth error description if authentication failed
-     */
     error_description?: string | null;
     [key: string]: string | (string | null) | (string | null) | (string | null) | (string | null) | undefined;
 };
@@ -371,9 +414,6 @@ export type BodhiErrorResponse = {
     error: BodhiError;
 };
 
-/**
- * Whether a single capability is supported by the model.
- */
 export type CapabilitySupport = {
     supported: boolean;
 };
@@ -393,9 +433,6 @@ export type ContextLimits = {
     max_output_tokens?: number | null;
 };
 
-/**
- * Context management capability details.
- */
 export type ContextManagementCapability = {
     clear_thinking_20251015?: null | CapabilitySupport;
     clear_tool_uses_20250919?: null | CapabilitySupport;
@@ -406,9 +443,6 @@ export type CopyAliasRequest = {
     alias: string;
 };
 
-/**
- * Request for creating an app access request
- */
 export type CreateAccessRequest = {
     /**
      * App client ID from Keycloak
@@ -433,17 +467,11 @@ export type CreateAccessRequest = {
 };
 
 export type CreateAccessRequestResponse = {
-    /**
-     * Access request ID
-     */
     id: string;
     /**
-     * Status (always "draft")
+     * Always "draft"
      */
     status: AppAccessRequestStatus;
-    /**
-     * Review URL for user to approve/deny
-     */
     review_url: string;
 };
 
@@ -498,6 +526,11 @@ export type CreateTokenRequest = {
      * Token scope defining access level
      */
     scope: TokenScope;
+    /**
+     * Per-resource grants for this token. Defaults to deny (least-privilege) when
+     * omitted — specify grants to widen access.
+     */
+    grants?: TokenGrants;
 };
 
 /**
@@ -515,6 +548,10 @@ export type DashboardUser = {
  * Shared across `openai`, `openai_responses`, `anthropic`, `anthropic_oauth`, `gemini`.
  */
 export type DefaultApiModelRequest = {
+    /**
+     * User-provided descriptive name for this API model
+     */
+    name: string;
     /**
      * API base URL
      */
@@ -609,6 +646,7 @@ export type DownloadRequest = {
     total_bytes?: number | null;
     downloaded_bytes: number;
     started_at?: string | null;
+    archived_at?: string | null;
     created_at: string;
     updated_at: string;
 };
@@ -638,6 +676,19 @@ export type EffortCapability = {
     max: CapabilitySupport;
 };
 
+/**
+ * Per-strategy resilience config for the fallback strategy. Phase 1 persists defaults
+ * and does not yet act on them (failover/health land in later phases).
+ */
+export type FallbackConfig = {
+    cooldown_secs?: number;
+    /**
+     * 0 = try the whole chain.
+     */
+    max_attempts?: number;
+    honor_retry_after?: boolean;
+};
+
 /**
  * Request to fetch available models from provider. Discriminated on `api_format`.
  */
@@ -685,6 +736,13 @@ export type GeminiModel = {
 
 export type JsonVec = Array<string>;
 
+/**
+ * Response for GET /access-requests/apps — the caller's issued app tokens.
+ */
+export type ListAppAccessResponse = {
+    data: Array<AppAccessSummary>;
+};
+
 export type ListMcpServersResponse = {
     mcp_servers: Array<McpServerResponse>;
 };
@@ -713,6 +771,10 @@ export type LlmLibertyApiEndpoints = {
  * (or `Keep` to leave existing credentials untouched on update).
  */
 export type LlmLibertyApiModelRequest = {
+    /**
+     * User-provided descriptive name for this API model
+     */
+    name: string;
     /**
      * Envelope update action — Keep (update only) or Set (create/replace credentials).
      */
@@ -731,6 +793,9 @@ export type LlmLibertyApiModelRequest = {
     forward_all_with_prefix?: boolean;
 };
 
+/**
+ * Envelope sub-types mirror the llm-liberty JSON contract v1.0.0.
+ */
 export type LlmLibertyAuthSpec = {
     in: string;
     key: string;
@@ -832,9 +897,6 @@ export type LlmLibertyTestPromptRequest = {
     prompt: string;
 };
 
-/**
- * Local model file response
- */
 export type LocalModelResponse = {
     repo: string;
     filename: string;
@@ -848,46 +910,22 @@ export type LocalModelResponse = {
  * User-owned MCP server instance.
  */
 export type Mcp = {
-    /**
-     * Unique instance identifier (UUID)
-     */
     id: string;
     /**
      * Server info resolved via JOIN
      */
     mcp_server: McpServerInfo;
-    /**
-     * User-defined slug for this instance
-     */
     slug: string;
-    /**
-     * Human-readable name
-     */
     name: string;
-    /**
-     * Optional description for this instance
-     */
     description?: string | null;
-    /**
-     * Whether this instance is enabled
-     */
     enabled: boolean;
-    /**
-     * MCP proxy path for this instance
-     */
     path: string;
     auth_type: McpAuthType;
     /**
      * Reference to the auth config (mcp_auth_configs.id)
      */
     auth_config_id?: string | null;
-    /**
-     * When this instance was created
-     */
     created_at: string;
-    /**
-     * When this instance was last updated
-     */
     updated_at: string;
 };
 
@@ -950,6 +988,9 @@ export type McpAuthConfigsListResponse = {
     auth_configs: Array<McpAuthConfigResponse>;
 };
 
+/**
+ * Masked auth param response.
+ */
 export type McpAuthParam = {
     id: string;
     param_type: McpAuthParamType;
@@ -967,6 +1008,22 @@ export type McpAuthParamType = 'header' | 'query';
 
 export type McpAuthType = 'public' | 'header' | 'oauth';
 
+/**
+ * MCP connect grant. `All` is a wildcard (incl. future MCPs); `Specific` lists
+ * the user's own instance ids (empty ⇒ no MCP access).
+ *
+ * Defaults to **least-privilege** (empty `Specific` ⇒ deny), symmetric with
+ * `ModelGrant`: an unspecified or legacy grant grants nothing, so a stored
+ * payload that omits `mcps` cannot silently grant every MCP. All-access must be
+ * requested explicitly via `McpGrant::All`.
+ */
+export type McpGrant = {
+    type: 'all';
+} | {
+    ids: Array<string>;
+    type: 'specific';
+};
+
 export type McpInstance = {
     id: string;
     /**
@@ -979,84 +1036,44 @@ export type McpInstance = {
  * Input for creating or updating an MCP instance.
  */
 export type McpRequest = {
-    /**
-     * Human-readable name (required)
-     */
     name: string;
     /**
-     * User-defined slug for this instance (1-24 chars, alphanumeric + hyphens)
+     * 1-24 chars, alphanumeric + hyphens.
      */
     slug: string;
     /**
-     * MCP server ID (required for create, ignored for update)
+     * Required for create, ignored for update.
      */
     mcp_server_id?: string | null;
-    /**
-     * Optional description
-     */
     description?: string | null;
-    /**
-     * Whether this instance is enabled
-     */
     enabled: boolean;
-    /**
-     * Authentication type
-     */
     auth_type?: McpAuthType;
-    /**
-     * Reference to auth config
-     */
     auth_config_id?: string | null;
     /**
-     * Instance-level auth params (values for the auth config's key definitions)
+     * Instance-level values for the auth config's key definitions.
      */
     credentials?: Array<McpAuthParamInput> | null;
     /**
-     * OAuth token ID to link to this MCP instance (set after OAuth flow)
+     * OAuth token ID to link to this MCP instance (set after OAuth flow).
      */
     oauth_token_id?: string | null;
 };
 
 /**
- * Admin-managed MCP server registry entry.
- * Admins/managers register MCP server URLs that users can then create instances of.
+ * Admin-managed MCP server registry entry that users create instances of.
  */
 export type McpServer = {
-    /**
-     * Unique identifier (UUID)
-     */
     id: string;
     /**
      * MCP server endpoint URL (trimmed, case-insensitive unique)
      */
     url: string;
-    /**
-     * Human-readable display name
-     */
     name: string;
-    /**
-     * Optional description
-     */
     description?: string | null;
-    /**
-     * Whether this MCP server is enabled
-     */
     enabled: boolean;
-    /**
-     * User who created this entry
-     */
     created_by: string;
-    /**
-     * User who last updated this entry
-     */
     updated_by: string;
-    /**
-     * When this entry was created
-     */
     created_at: string;
-    /**
-     * When this entry was last updated
-     */
     updated_at: string;
 };
 
@@ -1075,20 +1092,11 @@ export type McpServerInfo = {
  */
 export type McpServerRequest = {
     /**
-     * MCP server endpoint URL (trimmed, case-insensitive unique)
+     * MCP server endpoint URL (trimmed, case-insensitive unique).
      */
     url: string;
-    /**
-     * Human-readable display name
-     */
     name: string;
-    /**
-     * Optional description
-     */
     description?: string | null;
-    /**
-     * Whether this MCP server is enabled
-     */
     enabled: boolean;
     auth_config?: null | CreateMcpAuthConfigRequest;
 };
@@ -1103,9 +1111,6 @@ export type McpServerResponse = McpServer & {
 };
 
 export type McpServerReviewInfo = {
-    /**
-     * Requested MCP server URL
-     */
     url: string;
     /**
      * User's MCP instances connected to this server URL
@@ -1151,6 +1156,10 @@ export type ModelAliasResponse = {
     repo: string;
     filename: string;
     snapshot: string;
+    /**
+     * Local GGUF file size in bytes (present when the file is resolvable on disk)
+     */
+    size?: number | null;
     metadata?: null | ModelMetadata;
 };
 
@@ -1168,6 +1177,21 @@ export type ModelCapabilities = {
     tools: ToolCapabilities;
 };
 
+/**
+ * Model inference grant. `All` is a wildcard that includes models added in the
+ * future; `Specific` lists alias ids (empty ⇒ no model access).
+ *
+ * Defaults to **least-privilege** (empty `Specific` ⇒ deny): an unspecified or
+ * legacy grant grants nothing. All-access must be requested explicitly via
+ * `ModelGrant::All`. Symmetric with `ApprovedResourcesV1`'s empty-MCP default.
+ */
+export type ModelGrant = {
+    type: 'all';
+} | {
+    ids: Array<string>;
+    type: 'specific';
+};
+
 /**
  * Model metadata for API responses
  */
@@ -1178,6 +1202,48 @@ export type ModelMetadata = {
     chat_template?: string | null;
 };
 
+/**
+ * A composite alias that fronts an ordered list of targets and routes a chat
+ * request through them via a pluggable strategy. v1 ships only the fallback strategy.
+ */
+export type ModelRouterAlias = {
+    id: string;
+    /**
+     * User-facing model name, unique across all alias kinds.
+     */
+    alias: string;
+    /**
+     * Ordered list of targets; order is the fallback priority.
+     */
+    targets: Array<RouterTarget>;
+    strategy: RoutingStrategyConfig;
+    created_at: string;
+    updated_at: string;
+};
+
+/**
+ * Input request for creating or updating a model-router. Used as `ValidatedJson` in handlers
+ * for both create and update (PUT). A zero-target or all-disabled router is allowed to save.
+ */
+export type ModelRouterRequest = {
+    alias: string;
+    targets?: Array<RouterTargetRequest>;
+    strategy?: RoutingStrategyConfig;
+};
+
+/**
+ * API response for model-router aliases.
+ */
+export type ModelRouterResponse = {
+    source: string;
+    id: string;
+    alias: string;
+    targets: Array<RouterTarget>;
+    strategy: RoutingStrategyConfig;
+    created_at: string;
+    updated_at: string;
+};
+
 /**
  * Request for creating a new download request
  */
@@ -1201,6 +1267,7 @@ export type OaiRequestParams = {
     temperature?: number | null;
     top_p?: number | null;
     user?: string | null;
+    system_prompt?: string | null;
 };
 
 export type OAuthDiscoverAsRequest = {
@@ -1273,9 +1340,6 @@ export type PaginatedDownloadResponse = {
     page_size: number;
 };
 
-/**
- * Paginated list of local model files
- */
 export type PaginatedLocalModelResponse = {
     data: Array<LocalModelResponse>;
     total: number;
@@ -1354,9 +1418,6 @@ export type PingResponse = {
     message: string;
 };
 
-/**
- * Response for queue status operations
- */
 export type QueueStatusResponse = {
     /**
      * Queue status ("idle" or "processing")
@@ -1421,19 +1482,112 @@ export type RequestedMcpServer = {
 };
 
 /**
- * Versioned envelope for requested resources.
  * The `version` tag is mandatory — clients must specify which version they are using.
  */
 export type RequestedResources = RequestedResourcesV1 & {
     version: '1';
 };
 
+/**
+ * What the external app asks for. The four booleans are **UI drivers**: they tell
+ * the consent screen which controls to render (the owner decides the actual grant).
+ * Fields are domain-first (`models_*` / `mcps_*`), matching `ApprovedResourcesV1`.
+ * `mcp_servers` is the existing by-url MCP request and is unchanged.
+ *
+ * `models_access` defaults to **true**: unless the app explicitly opts out
+ * (`models_access: false`), the consent screen shows the model-access selector so
+ * the owner can always scope models. (The other UI-driver flags default to false.)
+ */
 export type RequestedResourcesV1 = {
+    /**
+     * Render the "list all models" toggle.
+     */
+    models_list?: boolean;
+    /**
+     * Render the model All/Specific access selector. Defaults to `true` (shown).
+     */
+    models_access?: boolean;
+    /**
+     * Render the "list all MCPs" toggle.
+     */
+    mcps_list?: boolean;
+    /**
+     * Render the owner-extra MCP All/Specific access selector.
+     */
+    mcps_access?: boolean;
     mcp_servers?: Array<RequestedMcpServer>;
 };
 
+/**
+ * Effective access to a class of resources (models or MCPs) for an API token,
+ * reflected from its grants. Discriminated on `type`: `all` ⇒ every current and
+ * future resource; `specific` ⇒ the listed `ids` (empty ⇒ no access).
+ * `list` is the `list_*` toggle (whether the token may enumerate the full catalog).
+ */
+export type ResourceAccess = {
+    list: boolean;
+    type: 'all';
+} | {
+    list: boolean;
+    ids: Array<string>;
+    type: 'specific';
+};
+
+/**
+ * Effective resource access for a token-bearing principal (API token or external
+ * app), reflected from its grants. Reported uniformly via the `access` envelope
+ * field for both principals.
+ */
+export type ResourceAccessInfo = {
+    /**
+     * Effective model access for this principal.
+     */
+    models: ResourceAccess;
+    /**
+     * Effective MCP access for this principal.
+     */
+    mcps: ResourceAccess;
+};
+
 export type ResourceRole = 'resource_anonymous' | 'resource_guest' | 'resource_user' | 'resource_power_user' | 'resource_manager' | 'resource_admin';
 
+/**
+ * One target in a model-router: a reference to an existing alias plus a pinned model.
+ */
+export type RouterTarget = {
+    /**
+     * Name of an existing user/model/api alias (NOT a model-router).
+     */
+    alias: string;
+    /**
+     * Concrete model placed into `request["model"]` when forwarding to this target.
+     */
+    model: string;
+    /**
+     * Whether this target is part of the active sequence. Disabled targets are never
+     * attempted but keep their config and position. Defaults to enabled.
+     */
+    enabled?: boolean;
+    /**
+     * SEAM (reserved): ignored by Fallback; used by a future weighted strategy.
+     */
+    weight?: number | null;
+};
+
+export type RouterTargetRequest = {
+    alias: string;
+    model: string;
+    enabled?: boolean;
+    weight?: number | null;
+};
+
+/**
+ * `{"strategy":"fallback", ...}` — try targets in order, first success wins.
+ */
+export type RoutingStrategyConfig = FallbackConfig & {
+    strategy: 'fallback';
+};
+
 export type SettingInfo = {
     key: string;
     current_value: unknown;
@@ -1537,17 +1691,11 @@ export type TestPromptResponse = {
     error?: string | null;
 };
 
-/**
- * Thinking capability and supported type configurations.
- */
 export type ThinkingCapability = {
     supported: boolean;
     types: ThinkingTypes;
 };
 
-/**
- * Supported thinking type configurations.
- */
 export type ThinkingTypes = {
     adaptive: CapabilitySupport;
     enabled: CapabilitySupport;
@@ -1567,32 +1715,58 @@ export type TokenDetail = {
     token_prefix: string;
     scopes: string;
     status: TokenStatus;
+    /**
+     * Per-resource grants this token carries.
+     */
+    grants: TokenGrants;
+    last_used_at?: string | null;
     created_at: string;
     updated_at: string;
 };
 
 /**
- * API Token information response
+ * Versioned envelope; the `version` tag is mandatory (mirrors `ApprovedResources`).
  */
-export type TokenInfo = {
-    role: TokenScope;
+export type TokenGrants = TokenGrantsV1 & {
+    version: '1';
 };
 
-export type TokenScope = 'scope_token_user' | 'scope_token_power_user';
-
-export type TokenStatus = 'active' | 'inactive';
+/**
+ * Per-resource grants carried by an API token. Listing (`models_list` /
+ * `mcps_list`) is separate from inference/connect: with listing off the
+ * discovery endpoints return an empty set, but inference on an individually
+ * granted resource still succeeds.
+ *
+ * Intentionally standalone — NOT shared with the App-access-request envelope
+ * (`ApprovedResources`); the two may diverge.
+ */
+export type TokenGrantsV1 = {
+    models_list?: boolean;
+    models?: ModelGrant;
+    mcps_list?: boolean;
+    mcps?: McpGrant;
+};
+
+/**
+ * API Token information response. Effective model/MCP access is reported uniformly
+ * via the envelope's `access` field (same shape as external apps), not inline here.
+ */
+export type TokenInfo = {
+    role: TokenScope;
+};
+
+export type TokenScope = 'scope_token_user' | 'scope_token_power_user';
+
+export type TokenStatus = 'active' | 'inactive';
 
 export type ToolCapabilities = {
     function_calling?: boolean | null;
     structured_output?: boolean | null;
 };
 
-/**
- * Request to update a setting value
- */
 export type UpdateSettingRequest = {
     /**
-     * New value for the setting (type depends on setting metadata)
+     * type depends on setting metadata
      */
     value: unknown;
 };
@@ -1699,6 +1873,10 @@ export type UserAliasResponse = {
     context_params: Array<string>;
     created_at: string;
     updated_at: string;
+    /**
+     * Local GGUF file size in bytes (present when the file is resolvable on disk)
+     */
+    size?: number | null;
     metadata?: null | ModelMetadata;
 };
 
@@ -1708,6 +1886,11 @@ export type UserInfo = {
     first_name?: string | null;
     last_name?: string | null;
     role?: null | AppRole;
+    /**
+     * OIDC id_token for the active session, when present. Used by the frontend to
+     * authenticate direct calls to the external reference API. Omitted for token/exchange auth.
+     */
+    id_token?: string | null;
 };
 
 /**
@@ -1715,6 +1898,7 @@ export type UserInfo = {
  */
 export type UserInfoEnvelope = UserResponse & {
     dashboard?: null | DashboardUser;
+    access?: null | ResourceAccessInfo;
 };
 
 export type UserListResponse = {
@@ -1795,6 +1979,43 @@ export type ListAllAccessRequestsResponses = {
 
 export type ListAllAccessRequestsResponse = ListAllAccessRequestsResponses[keyof ListAllAccessRequestsResponses];
 
+export type ListAppAccessData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/bodhi/v1/access-requests/apps';
+};
+
+export type ListAppAccessErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type ListAppAccessError = ListAppAccessErrors[keyof ListAppAccessErrors];
+
+export type ListAppAccessResponses = {
+    /**
+     * Issued app tokens
+     */
+    200: ListAppAccessResponse;
+};
+
+export type ListAppAccessResponse2 = ListAppAccessResponses[keyof ListAppAccessResponses];
+
 export type ListPendingAccessRequestsData = {
     body?: never;
     path?: never;
@@ -2093,6 +2314,56 @@ export type GetAccessRequestReviewResponses = {
 
 export type GetAccessRequestReviewResponse = GetAccessRequestReviewResponses[keyof GetAccessRequestReviewResponses];
 
+export type RevokeAppAccessData = {
+    body?: never;
+    path: {
+        /**
+         * Access request ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/access-requests/{id}/revoke';
+};
+
+export type RevokeAppAccessErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Not in a revocable state
+     */
+    409: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type RevokeAppAccessError = RevokeAppAccessErrors[keyof RevokeAppAccessErrors];
+
+export type RevokeAppAccessResponses = {
+    /**
+     * Grant revoked
+     */
+    200: AppAccessSummary;
+};
+
+export type RevokeAppAccessResponse = RevokeAppAccessResponses[keyof RevokeAppAccessResponses];
+
 export type GetAccessRequestStatusData = {
     body?: never;
     path: {
@@ -3420,6 +3691,34 @@ export type ListAllModelsData = {
          * Sort order: 'asc' for ascending, 'desc' for descending
          */
         sort_order?: string;
+        /**
+         * Alias type facet (comma-separated): `local_file`, `model_alias`, `api_model`, `fallback`.
+         */
+        type?: string;
+        /**
+         * API-format facet (comma-separated), API rows only: `openai`, `responses`, `anthropic`,
+         * `gemini`, `liberty`. `anthropic` matches both anthropic and anthropic_oauth aliases.
+         */
+        api_format?: string;
+        /**
+         * Minimum local-file size in bytes (inclusive). Applies to local rows with a known size;
+         * rows without a size (API/router) are not filtered out by size.
+         */
+        size_min?: number;
+        /**
+         * Maximum local-file size in bytes (inclusive). See `size_min`.
+         */
+        size_max?: number;
+        /**
+         * Capability facet (comma-separated), local rows only: `vision`, `tool_use`, `reasoning`.
+         * A row passes only if it has metadata with every requested capability set true.
+         */
+        capability?: string;
+        /**
+         * Free-text search (case-insensitive substring) over a row's identifying fields — alias/name,
+         * repo, filename for local rows; id, name, base_url for API rows; alias for routers.
+         */
+        search?: string;
     };
     url: '/bodhi/v1/models';
 };
@@ -4157,6 +4456,98 @@ export type GetDownloadStatusResponses = {
 
 export type GetDownloadStatusResponse = GetDownloadStatusResponses[keyof GetDownloadStatusResponses];
 
+export type ArchiveDownloadData = {
+    body?: never;
+    path: {
+        /**
+         * Unique identifier of the download request
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/models/files/pull/{id}/archive';
+};
+
+export type ArchiveDownloadErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Download request not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type ArchiveDownloadError = ArchiveDownloadErrors[keyof ArchiveDownloadErrors];
+
+export type ArchiveDownloadResponses = {
+    /**
+     * Download request archived
+     */
+    200: DownloadRequest;
+};
+
+export type ArchiveDownloadResponse = ArchiveDownloadResponses[keyof ArchiveDownloadResponses];
+
+export type RetryDownloadData = {
+    body?: never;
+    path: {
+        /**
+         * Unique identifier of the download request
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/models/files/pull/{id}/retry';
+};
+
+export type RetryDownloadErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Download request not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type RetryDownloadError = RetryDownloadErrors[keyof RetryDownloadErrors];
+
+export type RetryDownloadResponses = {
+    /**
+     * Download request reset and re-started
+     */
+    200: DownloadRequest;
+};
+
+export type RetryDownloadResponse = RetryDownloadResponses[keyof RetryDownloadResponses];
+
 export type RefreshModelMetadataData = {
     /**
      * Refresh request - either bulk (source='all') or single model (source='model' with identifiers)
@@ -4205,6 +4596,181 @@ export type RefreshModelMetadataResponses = {
 
 export type RefreshModelMetadataResponse = RefreshModelMetadataResponses[keyof RefreshModelMetadataResponses];
 
+export type CreateModelRouterData = {
+    body: ModelRouterRequest;
+    path?: never;
+    query?: never;
+    url: '/bodhi/v1/models/router';
+};
+
+export type CreateModelRouterErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type CreateModelRouterError = CreateModelRouterErrors[keyof CreateModelRouterErrors];
+
+export type CreateModelRouterResponses = {
+    /**
+     * Model-router created
+     */
+    201: ModelRouterResponse;
+};
+
+export type CreateModelRouterResponse = CreateModelRouterResponses[keyof CreateModelRouterResponses];
+
+export type DeleteModelRouterData = {
+    body?: never;
+    path: {
+        /**
+         * Model-router ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/models/router/{id}';
+};
+
+export type DeleteModelRouterErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Model-router not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type DeleteModelRouterError = DeleteModelRouterErrors[keyof DeleteModelRouterErrors];
+
+export type DeleteModelRouterResponses = {
+    /**
+     * Model-router deleted
+     */
+    204: void;
+};
+
+export type DeleteModelRouterResponse = DeleteModelRouterResponses[keyof DeleteModelRouterResponses];
+
+export type GetModelRouterData = {
+    body?: never;
+    path: {
+        /**
+         * Unique identifier for the model-router alias
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/models/router/{id}';
+};
+
+export type GetModelRouterErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Model-router with specified ID not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type GetModelRouterError = GetModelRouterErrors[keyof GetModelRouterErrors];
+
+export type GetModelRouterResponses = {
+    /**
+     * Model-router configuration retrieved
+     */
+    200: ModelRouterResponse;
+};
+
+export type GetModelRouterResponse = GetModelRouterResponses[keyof GetModelRouterResponses];
+
+export type UpdateModelRouterData = {
+    body: ModelRouterRequest;
+    path: {
+        /**
+         * Model-router ID
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/models/router/{id}';
+};
+
+export type UpdateModelRouterErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Model-router not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type UpdateModelRouterError = UpdateModelRouterErrors[keyof UpdateModelRouterErrors];
+
+export type UpdateModelRouterResponses = {
+    /**
+     * Model-router updated
+     */
+    200: ModelRouterResponse;
+};
+
+export type UpdateModelRouterResponse = UpdateModelRouterResponses[keyof UpdateModelRouterResponses];
+
 export type GetAliasData = {
     body?: never;
     path: {
@@ -4373,11 +4939,11 @@ export type DeleteSettingResponse = DeleteSettingResponses[keyof DeleteSettingRe
 
 export type UpdateSettingData = {
     /**
-     * Request to update a setting value
+     * New setting value
      */
     body: {
         /**
-         * New value for the setting (type depends on setting metadata)
+         * type depends on setting metadata
          */
         value: unknown;
     };
@@ -4668,6 +5234,52 @@ export type CreateApiTokenResponses = {
 
 export type CreateApiTokenResponse = CreateApiTokenResponses[keyof CreateApiTokenResponses];
 
+export type DeleteApiTokenData = {
+    body?: never;
+    path: {
+        /**
+         * Unique identifier of the API token to delete
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/bodhi/v1/tokens/{id}';
+};
+
+export type DeleteApiTokenErrors = {
+    /**
+     * Invalid request parameters
+     */
+    400: BodhiErrorResponse;
+    /**
+     * Not authenticated
+     */
+    401: BodhiErrorResponse;
+    /**
+     * Insufficient permissions
+     */
+    403: BodhiErrorResponse;
+    /**
+     * Token not found
+     */
+    404: BodhiErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: BodhiErrorResponse;
+};
+
+export type DeleteApiTokenError = DeleteApiTokenErrors[keyof DeleteApiTokenErrors];
+
+export type DeleteApiTokenResponses = {
+    /**
+     * Token deleted successfully
+     */
+    204: void;
+};
+
+export type DeleteApiTokenResponse = DeleteApiTokenResponses[keyof DeleteApiTokenResponses];
+
 export type UpdateApiTokenData = {
     /**
      * Token update request