@keboola/api-client 36.0.0 → 40.0.0

package/dist/{types-CzsnuPFh.d.cts → types-Dtuvhm3K.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiReturnType, o as OpenapiPathType, r as OpenapiBodyType } from "./index-V7XKUQm9.cjs";
+import { c as OpenapiReturnType, n as ArrayElement, o as OpenapiPathType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-BVhHt5lx.cjs";
 //#region src/clients/management/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -41,6 +41,82 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/manage/application-tokens': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Application Tokens
+     * @description Lists every application token (`type: super`) on the stack. An application token is
+     *     decoupled from any admin and authorizes other services against the Manage API.
+     *     The secret itself is returned only once, when the token is created.
+     */
+    get: operations['get_/manage/application-tokens::ApplicationTokenListAction'];
+    put?: never;
+    /**
+     * Create Application Token
+     * @description Issues an application token (`type: super`). The secret is returned once, in this
+     *     response, and cannot be retrieved later. Any non-empty, comma-free scope string is
+     *     accepted — a scope grants nothing until some endpoint looks for it, and
+     *     `GET /manage/application-tokens/scopes` lists the ones this stack defines.
+     *     Omitting `expiresIn` produces a token that never expires.
+     */
+    post: operations['post_/manage/application-tokens::ApplicationTokenCreateAction'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/manage/application-tokens/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Delete Application Token
+     * @description Revokes an application token. Only tokens of type `super` can be deleted here;
+     *     anything else answers 404. Deleting a token breaks whichever service is
+     *     authenticating with it — check `lastUsed` first.
+     */
+    delete: operations['delete_/manage/application-tokens/{id}::ApplicationTokenDeleteAction'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/manage/application-tokens/scopes': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Application Token Scopes
+     * @description Lists the scopes this stack defines for application tokens.
+     *
+     *     The scopes are not an enum the API enforces — a token may carry any string, and a
+     *     scope only means something once some endpoint checks for it. This list exists so a
+     *     client can offer the known ones instead of keeping its own copy in sync by hand.
+     */
+    get: operations['get_/manage/application-tokens/scopes::ApplicationTokenScopeListAction'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/manage/commands': {
     parameters: {
       query?: never;
@@ -341,7 +417,7 @@ type paths = {
     put?: never;
     /**
      * Purge deleted project
-     * @description Enqueues the command that fully deletes a project and returns its execution ID for monitoring.
+     * @description Enqueues the command that fully deletes a project and returns its execution ID for monitoring. Requires a super admin, or an admin holding the "can-manage-deleted-projects" feature.
      */
     post: operations['post_/manage/deleted-projects/{projectId}/purge::ProjectPurgeAction'];
     delete?: never;
@@ -519,6 +595,30 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/manage/file-storage/{fileStorageId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Delete file storage
+     * @description Deletes a file storage of any provider. Every project using the file storage must be deleted and purged, and every workspace using it deleted, before it can be deleted. Any maintainer whose default file storage this is has that default cleared, which makes the next project created under that maintainer fall back to the region default. Deleting the region default itself is allowed and leaves the region without one, which makes every subsequent project creation in that region fail until another file storage is set as default. Only the database record is removed: the bucket or container stays, and so do the stored credentials (IAM user, storage account key, service account key) and, for GCS, the Snowflake storage integration — after the delete none of them is recoverable through this API, and the automated sweeps over them (ABS container cleanup, BigQuery key-sharing audit) stop visiting the resource. Decommission them separately.
+     */
+    delete: operations['delete_/manage/file-storage/{fileStorageId}::FileStorageDeleteAction'];
+    options?: never;
+    head?: never;
+    /**
+     * Update file storage
+     * @description A partial update of a file storage of any provider; at least one of the attributes is required. Changing the region only moves the record: the files stay in the bucket or container they were uploaded to, and the new region is used immediately for every S3/STS client and every file operation of every project on this storage, with no check that any project uses it. It also does not touch the project's own region (bi_projects.region), so project and file responses keep reporting the old region while workspace responses report the new one — realigning the affected projects is a separate step.
+     */
+    patch: operations['patch_/manage/file-storage/{fileStorageId}::FileStorageUpdateAction'];
+    trace?: never;
+  };
   '/manage/file-storage-gcs': {
     parameters: {
       query?: never;
@@ -1295,6 +1395,26 @@ type paths = {
     patch: operations['patch_/manage/organizations/{id}/force-mfa::OrganizationSetMfaRequiredAction'];
     trace?: never;
   };
+  '/manage/programmatic-projects/confirm': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Confirm an agent-provisioned project
+     * @description Redeems a single-use claim token: the authenticated account becomes an administrator of the project and the synthetic agent identity that provisioned it has its session revoked. The link is spent whether or not the caller keeps using the project.
+     */
+    post: operations['post_/manage/programmatic-projects/confirm::ProgrammaticProjectConfirmAction'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/manage/programmatic-projects': {
     parameters: {
       query?: never;
@@ -1563,7 +1683,7 @@ type paths = {
     put?: never;
     /**
      * Change project disabled status
-     * @description Enables or disables the project specified by its ID.
+     * @description Enables or disables the project specified by its ID. Allowed for super admins and for admins with the "can-disable-projects" feature.
      */
     post: operations['post_/manage/projects/{projectId}/disabled::ProjectChangeDisabledAction'];
     delete?: never;
@@ -2116,7 +2236,7 @@ type paths = {
      * Create a new BigQuery backend server-side
      * @description Server-side creation for an already-provisioned master service account (created by Terraform
      *     for Keboola-managed stacks, or via the setup guide for BYODB). Provide a one-time admin
-     *     credential that holds `iam.serviceAccountKeys.create` on the master service account; connection
+     *     credential that holds `iam.serviceAccountKeys.create` and `iam.serviceAccountKeys.delete` on the master service account; connection
      *     mints the first key, registers the backend in a not-yet-active state, and discards the admin
      *     credential. Activate the backend afterwards to smoke-test and enable it. Gated behind the
      *     `bigquery-backend-server-side-creation-enabled` stack feature.
@@ -2283,7 +2403,11 @@ type paths = {
       path?: never;
       cookie?: never;
     };
-    get?: never;
+    /**
+     * Application Detail
+     * @description Returns one UI application with all of its registered versions, including inactive ones.
+     */
+    get: operations['get_/manage/ui-apps/{id}::UiAppsDetailAction'];
     put?: never;
     post?: never;
     /**
@@ -2293,7 +2417,12 @@ type paths = {
     delete: operations['delete_/manage/ui-apps/{id}::UiAppsDeleteAction'];
     options?: never;
     head?: never;
-    patch?: never;
+    /**
+     * Rename Application
+     * @description Changes the display name of a UI application. The `stringId`, which identifies the
+     *     application across stacks, is not affected.
+     */
+    patch: operations['patch_/manage/ui-apps/{id}::UiAppsRenameAction'];
     trace?: never;
   };
   '/manage/ui-apps': {
@@ -2306,6 +2435,10 @@ type paths = {
     /**
      * List Applications
      * @description Returns active applications. This resource doesn't require authentication.
+     *
+     *     With `includeInactive=true` it returns every registered application instead, including
+     *     those that have no active version — their `version`, `basePath`, `type` and `commitSha`
+     *     are then null and `scripts`/`styles` empty. That variant requires a super admin.
      */
     get: operations['get_/manage/ui-apps::UiAppsListAction'];
     put?: never;
@@ -2756,6 +2889,26 @@ type components = {
       /** @description Pagination offset. Default value: 0. */
       offset?: number | null;
     };
+    /** @description Application token to issue. The secret is returned once, in the response. */
+    ApplicationTokenCreateRequest: {
+      /**
+       * @description What the token is for. This is the only trace of its purpose.
+       * @example Sandboxes API
+       */
+      description: string;
+      /**
+       * @description Scopes the token carries. Any non-empty string without a comma is accepted; GET /manage/application-tokens/scopes lists the ones this stack defines.
+       * @example [
+       *       "projects:read"
+       *     ]
+       */
+      scopes?: string[] | null;
+      /**
+       * @description Lifetime in seconds. Omit for a token that never expires, which is the historical behaviour.
+       * @example 2592000
+       */
+      expiresIn?: number | null;
+    };
     /** @description CLI command enqueue request payload. */
     EnqueueCommandRequest: {
       /**
@@ -2892,6 +3045,19 @@ type components = {
        */
       accountKey: string;
     };
+    /** @description Partial update of a file storage; at least one of `owner`, `region` must be supplied. */
+    FileStorageUpdateRequest: {
+      /**
+       * @description Associated account owner (mostly: keboola, client-<name>).
+       * @example keboola
+       */
+      owner: string;
+      /**
+       * @description Region the files bucket or container lives in. Changing it only moves the record, not the files themselves.
+       * @example us-east-1
+       */
+      region: string;
+    };
     FileStorageCreateGcsRequest: {
       /**
        * @description GCP service account key file contents (full JSON keyfile including the private key).
@@ -3315,6 +3481,10 @@ type components = {
         value: string;
       }[];
     };
+    ConfirmProgrammaticProjectRequest: {
+      /** @description The single-use token from the `confirmUrl` handed back at provisioning time (format: `kbc_apc_{claimId}_{secret}`). Optional only for a browser that already carries the claim cookie the confirmation page set; an API client must send it. When both are present this wins. */
+      claimToken?: string | null;
+    };
     CreateProgrammaticProjectRequest: {
       /**
        * @description Label identifying the calling agent. Used as the rate-limit bucket and recorded on the provisioning audit event. Caller-asserted, not verified.
@@ -3523,7 +3693,7 @@ type components = {
     };
     /** @description Create a BigQuery backend server-side on an already-provisioned master service account. */
     StorageBackendCreateBigqueryServerSideRequest: {
-      /** @description One-time GCP service-account keyfile (JSON) holding iam.serviceAccountKeys.create on the master service account. Used only to mint the first key, then discarded — never stored. */
+      /** @description One-time GCP service-account keyfile (JSON) holding iam.serviceAccountKeys.create and iam.serviceAccountKeys.delete on the master service account. Used only to mint the first key, then discarded — never stored. */
       adminCredentials: {
         [key: string]: unknown;
       };
@@ -3657,6 +3827,14 @@ type components = {
        */
       activate?: boolean | null;
     };
+    /** @description New display name of the UI application. The immutable stringId is never changed. */
+    RenameRequest: {
+      /**
+       * @description New display name.
+       * @example Keboola Connection UI
+       */
+      name: string;
+    };
     BillingCreditListRequest: {
       /**
        * @description Identifier of the pay-as-you-go project.
@@ -3777,6 +3955,56 @@ type components = {
        */
       maintainersCount: number;
     }[];
+    ApplicationTokenResponse: {
+      id: number;
+      description: string;
+      /**
+       * Format: date-time
+       * @description Null on legacy rows written before the column had a default.
+       */
+      created?: string | null;
+      /**
+       * Format: date-time
+       * @description Null when the token has never been used.
+       */
+      lastUsed?: string | null;
+      /**
+       * Format: date-time
+       * @description Null when the token never expires.
+       */
+      expires?: string | null;
+      /** @description A disabled token is listed but cannot authenticate. */
+      isDisabled: boolean;
+      /** @description Derived from `expires` at read time. */
+      isExpired: boolean;
+      scopes: string[];
+      /** @description The admin who issued the token. An application token has no owner, only a creator. */
+      creator: {
+        id?: number | null;
+        name?: string | null;
+      };
+    };
+    ApplicationTokenListResponse: components['schemas']['ApplicationTokenResponse'][];
+    /** @description The created application token. `token` is the secret and is returned only here. */
+    ApplicationTokenCreateResponse: {
+      id: number;
+      description: string;
+      /** Format: date-time */
+      created: string;
+      /** Format: date-time */
+      lastUsed?: string | null;
+      /** Format: date-time */
+      expires?: string | null;
+      scopes: string[];
+      creator: {
+        id?: number | null;
+        name?: string | null;
+      };
+      /** @description The secret. Shown once and never retrievable again. */
+      token: string;
+    };
+    /** @description Scopes an application token can carry, as the stack defines them. */
+    ApplicationTokenScopeListResponse: string[];
     EnqueueCommandResponse: {
       /**
        * @description Identifier of the enqueued command execution; this ID is appended to all logs produced by the command.
@@ -4051,6 +4279,29 @@ type components = {
       deletedTime: string;
       /** Format: date-time */
       purgedTime?: string | null;
+      /** @description IDs of the default storage backends assigned to the project, keyed by backend name. */
+      backends: {
+        snowflake?: {
+          /** @example 353 */
+          id: number;
+        };
+        synapse?: {
+          /** @example 353 */
+          id: number;
+        };
+        exasol?: {
+          /** @example 353 */
+          id: number;
+        };
+        teradata?: {
+          /** @example 353 */
+          id: number;
+        };
+        bigquery?: {
+          /** @example 353 */
+          id: number;
+        };
+      };
       /** @description Organization the project belongs to. */
       organization: {
         id?: number;
@@ -4178,6 +4429,56 @@ type components = {
         name: string | null;
       };
     };
+    FileStorageS3Response: {
+      /**
+       * @description File storage identifier.
+       * @example 123
+       */
+      id: number;
+      /**
+       * @description AWS access key ID.
+       * @example AKIAXXXXXXXXXXXXXXXXX
+       */
+      awsKey: string;
+      /**
+       * @description AWS region.
+       * @example us-east-1
+       */
+      region: string;
+      /**
+       * @description S3 bucket name for files.
+       * @example kbc-sapi-files
+       */
+      filesBucket: string;
+      /**
+       * @description File storage provider.
+       * @example aws
+       */
+      provider: string;
+      /**
+       * @description Associated AWS account owner.
+       * @example keboola
+       */
+      owner: string;
+      /**
+       * @description Whether this is the default file storage.
+       * @example false
+       */
+      isDefault: boolean;
+      /**
+       * Format: date-time
+       * @description File storage creation timestamp (ISO 8601).
+       * @example 2019-06-17T15:07:48+01:00
+       */
+      created: string;
+      /** @description User who created the file storage. */
+      creator: {
+        /** @example 123 */
+        id: number | null;
+        /** @example name-of-creator */
+        name: string | null;
+      };
+    };
     FileStorageGcsResponse: {
       /**
        * @description File storage identifier.
@@ -4264,86 +4565,36 @@ type components = {
         name: string | null;
       };
     };
-    FileStorageS3Response: {
-      /**
-       * @description File storage identifier.
-       * @example 123
-       */
+    UserLoggedInResponse: {
       id: number;
+      email: string;
+      name: string;
+    };
+    CliTokenResponse: {
+      /** @description Opaque bearer access token for API authentication. */
+      accessToken: string;
+      /** @description Refresh token for obtaining new access tokens. */
+      refreshToken: string;
+      /** @description Token type. Always "Bearer". */
+      tokenType: string;
+      /** @description Access token lifetime in seconds. */
+      expiresIn: number;
+      /** @description Unique session identifier. */
+      sessionId: string;
+      user: components['schemas']['UserLoggedInResponse'];
+    };
+    TokenVerifyResponse: {
       /**
-       * @description AWS access key ID.
-       * @example AKIAXXXXXXXXXXXXXXXXX
+       * @description Unique identifier of the token.
+       * @example 484
        */
-      awsKey: string;
+      id: string;
       /**
-       * @description AWS region.
-       * @example us-east-1
+       * Format: date-time
+       * @description Token creation timestamp.
+       * @example 2017-11-13T16:48:28+0100
        */
-      region: string;
-      /**
-       * @description S3 bucket name for files.
-       * @example kbc-sapi-files
-       */
-      filesBucket: string;
-      /**
-       * @description File storage provider.
-       * @example aws
-       */
-      provider: string;
-      /**
-       * @description Associated AWS account owner.
-       * @example keboola
-       */
-      owner: string;
-      /**
-       * @description Whether this is the default file storage.
-       * @example false
-       */
-      isDefault: boolean;
-      /**
-       * Format: date-time
-       * @description File storage creation timestamp (ISO 8601).
-       * @example 2019-06-17T15:07:48+01:00
-       */
-      created: string;
-      /** @description User who created the file storage. */
-      creator: {
-        /** @example 123 */
-        id: number | null;
-        /** @example name-of-creator */
-        name: string | null;
-      };
-    };
-    UserLoggedInResponse: {
-      id: number;
-      email: string;
-      name: string;
-    };
-    CliTokenResponse: {
-      /** @description Opaque bearer access token for API authentication. */
-      accessToken: string;
-      /** @description Refresh token for obtaining new access tokens. */
-      refreshToken: string;
-      /** @description Token type. Always "Bearer". */
-      tokenType: string;
-      /** @description Access token lifetime in seconds. */
-      expiresIn: number;
-      /** @description Unique session identifier. */
-      sessionId: string;
-      user: components['schemas']['UserLoggedInResponse'];
-    };
-    TokenVerifyResponse: {
-      /**
-       * @description Unique identifier of the token.
-       * @example 484
-       */
-      id: string;
-      /**
-       * Format: date-time
-       * @description Token creation timestamp.
-       * @example 2017-11-13T16:48:28+0100
-       */
-      created?: string | null;
+      created?: string | null;
       /**
        * Format: date-time
        * @description Token last refresh timestamp.
@@ -4513,6 +4764,11 @@ type components = {
          * @example 123
          */
         id?: number | null;
+        /**
+         * Format: date-time
+         * @description Creation time of the organization. Null when the creation time is unavailable.
+         */
+        created?: string | null;
       };
       /** @description Administrator the token belongs to. Present only for master tokens. */
       admin: {
@@ -4525,8 +4781,10 @@ type components = {
         /** @example admin */
         role?: string;
         isActivated?: boolean;
-        /** @description Present only when SAML is enabled on the stack. */
-        samlParameters?: Record<string, never> | null;
+        /** @description Raw SAML attribute statement asserted by the IdP on last login, keyed by IdP-defined attribute name (e.g. a role or group claim); attribute names and count vary per IdP configuration. Present only when SAML is enabled on the stack. */
+        samlParameters?: {
+          [key: string]: string[];
+        } | null;
       };
       /** @description Administrator who owns the token. Present when an owner can be resolved. */
       adminOwner: {
@@ -5115,6 +5373,22 @@ type components = {
       };
     };
     OrganizationsListResponse: components['schemas']['OrganizationListResponse'][];
+    ConfirmProgrammaticProjectRequest2: {
+      /**
+       * Null when the body carried no token. The caller resolves the effective claim - see
+       *     {@see \Keboola\Controller\Manage\ProgrammaticProjects\ProgrammaticProjectConfirmAction}.
+       * @description The single-use token from the `confirmUrl` handed back at provisioning time (format: `kbc_apc_{claimId}_{secret}`). Optional only for a browser that already carries the claim cookie the confirmation page set; an API client must send it. When both are present this wins.
+       */
+      claimToken?: string | null;
+    };
+    ConfirmProgrammaticProjectResponse: {
+      project: {
+        /** @example 1234 */
+        id?: number;
+      };
+      /** @description The account that now owns the project - the caller of this endpoint. */
+      confirmedByAdminId: number;
+    };
     CreateProgrammaticProjectResponse: {
       project: {
         /** @example 1234 */
@@ -5621,6 +5895,8 @@ type components = {
       isSsoEnabled: boolean;
       /** @description Whether SAML2 SSO configuration exists for the Snowflake backend. */
       isSsoConfigured: boolean;
+      /** @description Whether the backend credential certificate is validated and the backend is usable. Snowflake backends only; absent otherwise. */
+      isEnabled: boolean;
       /** @description Array of technical owner contact emails for SAML2 certificate rotation notifications. */
       technicalOwnerContactEmails: string[];
       /** @description Number of projects assigned to this backend, unlike stats.projectsCount which only counts projects with data (buckets) on it. Synapse-assigned projects are not counted (deprecated backend, intentionally excluded). */
@@ -5631,9 +5907,15 @@ type components = {
       loginType?: string | null;
       /**
        * Format: date-time
-       * @description Detail endpoint only (absent on the list endpoint). Most recent enabledAt of an active Snowflake RSA key-pair certificate; null for password-based backends.
+       * @description Detail endpoint only (absent on the list endpoint). Most recent enabledAt of the backend's active credential certificate — a Snowflake RSA key-pair or a BigQuery service-account key; null when the backend has no active certificate (e.g. password-based backends). The value is when the current certificate became active, which may be backend creation, activation, a migration or a backfill rather than a rotation.
        */
       keyPairLastRotatedAt?: string | null;
+      /**
+       * Format: email
+       * @description Detail endpoint only (absent on the list endpoint). Email of the GCP service account the backend runs under. BigQuery backends only; absent otherwise. Null when the stored key carries no client_email. No key material is ever exposed here.
+       * @example something@else.iam.gserviceaccount.com
+       */
+      serviceAccountEmail?: string | null;
     };
     StorageBackendListResponse: components['schemas']['StorageBackendDetailResponse'][];
     StorageBackendMaintainerListResponse: {
@@ -5763,7 +6045,29 @@ type components = {
         isSuperAdmin: boolean;
       } | null;
     };
+    UiAppDetailResponse: {
+      /** @description Numeric identifier of the application. */
+      id: number;
+      /** @description Immutable identifier taken from the manifest name. */
+      stringId: string;
+      /** @description Editable display name. */
+      name: string;
+      /** @description Creation timestamp. */
+      created: string;
+      /** @description Every registered version, newest first. */
+      versions: {
+        id?: number;
+        version?: string;
+        created?: string;
+        isActive?: boolean;
+        isCritical?: boolean;
+        buildUrl?: string | null;
+        commitSha?: string | null;
+      }[];
+    };
     UiAppResponse: {
+      /** @description Immutable identifier of the application, stable across renames and stacks. */
+      stringId: string;
       /** @description Application name. */
       name: string;
       /** @description Active version identifier. */
@@ -5782,6 +6086,18 @@ type components = {
       commitSha?: string | null;
     };
     UiAppsListResponse: components['schemas']['UiAppResponse'][];
+    /** @description Entry of the `includeInactive` listing. Every version field is null when the application has no active version. */
+    UiAppInactiveResponse: {
+      stringId?: string;
+      name?: string;
+      version?: string | null;
+      basePath?: string | null;
+      type?: string | null;
+      scripts?: string[];
+      styles?: string[];
+      isCritical?: boolean;
+      commitSha?: string | null;
+    }[];
     UiAppsRegistrationResponse: {
       app: {
         /** @description Application identifier. */
@@ -5925,6 +6241,143 @@ interface operations {
       };
     };
   };
+  'get_/manage/application-tokens::ApplicationTokenListAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Every application token on the stack. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ApplicationTokenListResponse'];
+        };
+      };
+      /** @description Returned when the caller is not a super admin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/manage/application-tokens::ApplicationTokenCreateAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ApplicationTokenCreateRequest'];
+      };
+    };
+    responses: {
+      /** @description The token has been issued. */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ApplicationTokenCreateResponse'];
+        };
+      };
+      /** @description Returned when `description` is blank or too long, a scope is empty or contains a comma, or the lifetime is not storable. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the caller is not a super admin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when this admin has issued too many application tokens recently. Retry after the window named by the `Retry-After` header. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'delete_/manage/application-tokens/{id}::ApplicationTokenDeleteAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /**
+         * @description Numeric id of the application token.
+         * @example 117
+         */
+        id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The token has been revoked. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the caller is not a super admin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when no application token with this id exists. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'get_/manage/application-tokens/scopes::ApplicationTokenScopeListAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Scopes the stack defines. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ApplicationTokenScopeListResponse'];
+        };
+      };
+      /** @description Returned when the caller is not a super admin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'post_/manage/commands::CommandEnqueueAction': {
     parameters: {
       query?: never;
@@ -7597,16 +8050,127 @@ interface operations {
     parameters: {
       query?: never;
       header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        'application/json': components['schemas']['FileStorageCreateAbsRequest'];
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['FileStorageCreateAbsRequest'];
+      };
+    };
+    responses: {
+      /** @description ABS file storage created. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          /**
+           * @example {
+           *       "id": 123,
+           *       "accountName": "nameofaccount",
+           *       "region": "us-east-1",
+           *       "containerName": "name-of-container",
+           *       "provider": "azure",
+           *       "owner": "keboola",
+           *       "isDefault": false,
+           *       "created": "2019-06-17T15:07:48+01:00",
+           *       "creator": {
+           *         "id": 123,
+           *         "name": "name-of-creator"
+           *       }
+           *     }
+           */
+          'application/json': components['schemas']['FileStorageAbsResponse'];
+        };
+      };
+      /** @description Returned when request parameters fail validation or when the Azure Blob Storage connection cannot be established with the provided credentials. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the Manage token is missing or invalid. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the Manage token does not have admin privileges. Superuser credentials are not required for storage registration. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/manage/file-storage-abs/{fileStorageId}/credentials::FileStorageAbsRotateCredentialsAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Identifier of the file storage. */
+        fileStorageId: number;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['FileStorageRotateAbsRequest'];
+      };
+    };
+    responses: {
+      /** @description ABS file storage credentials rotated. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['FileStorageAbsResponse'];
+        };
+      };
+      /** @description Returned when request parameters are invalid. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when access is denied. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the file storage does not exist. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/manage/file-storage-abs/{fileStorageId}/default::FileStorageAbsSetDefaultAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /**
+         * @description File Storage ID.
+         * @example 123
+         */
+        fileStorageId: number;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
-      /** @description ABS file storage created. */
+      /** @description ABS file storage set as default. */
       200: {
         headers: {
           [name: string]: unknown;
@@ -7620,7 +8184,7 @@ interface operations {
            *       "containerName": "name-of-container",
            *       "provider": "azure",
            *       "owner": "keboola",
-           *       "isDefault": false,
+           *       "isDefault": true,
            *       "created": "2019-06-17T15:07:48+01:00",
            *       "creator": {
            *         "id": 123,
@@ -7631,7 +8195,7 @@ interface operations {
           'application/json': components['schemas']['FileStorageAbsResponse'];
         };
       };
-      /** @description Returned when request parameters fail validation or when the Azure Blob Storage connection cannot be established with the provided credentials. */
+      /** @description Returned when the storage is already set as default or is not owned by Keboola. */
       400: {
         headers: {
           [name: string]: unknown;
@@ -7645,55 +8209,66 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token does not have admin privileges. Superuser credentials are not required for storage registration. */
+      /** @description Returned when the Manage token does not have admin privileges or the current admin is not a super admin. */
       403: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
+      /** @description Returned when the file storage does not exist. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
     };
   };
-  'post_/manage/file-storage-abs/{fileStorageId}/credentials::FileStorageAbsRotateCredentialsAction': {
+  'delete_/manage/file-storage/{fileStorageId}::FileStorageDeleteAction': {
     parameters: {
       query?: never;
       header?: never;
       path: {
-        /** @description Identifier of the file storage. */
+        /**
+         * @description Identifier of the file storage.
+         * @example 12
+         */
         fileStorageId: number;
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        'application/json': components['schemas']['FileStorageRotateAbsRequest'];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description ABS file storage credentials rotated. */
-      200: {
+      /** @description File storage deleted. */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          'application/json': components['schemas']['FileStorageAbsResponse'];
-        };
+        content?: never;
       };
-      /** @description Returned when request parameters are invalid. */
+      /** @description Returned when the file storage is still in use by projects or workspaces. */
       400: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
-      /** @description Returned when access is denied. */
+      /** @description Returned when the Manage token is missing or invalid. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the current admin is not a super admin. */
       403: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
-      /** @description Returned when the file storage does not exist. */
+      /** @description Returned when the file storage with the given ID does not exist. */
       404: {
         headers: {
           [name: string]: unknown;
@@ -7702,47 +8277,35 @@ interface operations {
       };
     };
   };
-  'post_/manage/file-storage-abs/{fileStorageId}/default::FileStorageAbsSetDefaultAction': {
+  'patch_/manage/file-storage/{fileStorageId}::FileStorageUpdateAction': {
     parameters: {
       query?: never;
       header?: never;
       path: {
         /**
-         * @description File Storage ID.
-         * @example 123
+         * @description Identifier of the file storage.
+         * @example 12
          */
         fileStorageId: number;
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['FileStorageUpdateRequest'];
+      };
+    };
     responses: {
-      /** @description ABS file storage set as default. */
+      /** @description File storage updated. The shape of the response depends on the provider. */
       200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          /**
-           * @example {
-           *       "id": 123,
-           *       "accountName": "nameofaccount",
-           *       "region": "us-east-1",
-           *       "containerName": "name-of-container",
-           *       "provider": "azure",
-           *       "owner": "keboola",
-           *       "isDefault": true,
-           *       "created": "2019-06-17T15:07:48+01:00",
-           *       "creator": {
-           *         "id": 123,
-           *         "name": "name-of-creator"
-           *       }
-           *     }
-           */
-          'application/json': components['schemas']['FileStorageAbsResponse'];
+          'application/json': components['schemas']['FileStorageS3Response'] | components['schemas']['FileStorageAbsResponse'] | components['schemas']['FileStorageGcsResponse'];
         };
       };
-      /** @description Returned when the storage is already set as default or is not owned by Keboola. */
+      /** @description Returned when the request payload is invalid, when the target region already has a default file storage, or when the stored provider is none of aws, azure and gcp. */
       400: {
         headers: {
           [name: string]: unknown;
@@ -7756,14 +8319,14 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token does not have admin privileges or the current admin is not a super admin. */
+      /** @description Returned when the current admin is not a super admin. */
       403: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
-      /** @description Returned when the file storage does not exist. */
+      /** @description Returned when the file storage with the given ID does not exist. */
       404: {
         headers: {
           [name: string]: unknown;
@@ -11091,6 +11654,65 @@ interface operations {
       };
     };
   };
+  'post_/manage/programmatic-projects/confirm::ProgrammaticProjectConfirmAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ConfirmProgrammaticProjectRequest2'];
+      };
+    };
+    responses: {
+      /** @description Project confirmed and owned by the calling account. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ConfirmProgrammaticProjectResponse'];
+        };
+      };
+      /** @description The confirmation link is invalid, expired, or already used (manage.programmaticProjects.invalidClaim). Every reason returns this one error on purpose, so the endpoint cannot be used to discover which tokens exist. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Missing, expired or revoked bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description The bearer token cannot take ownership: it is either a session issued for agent provisioning, or a delegated session restricted to specific projects. Confirmation transfers ownership to a real account and to a project no approval could have listed. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Agent provisioning disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many confirmation attempts from this account or IP address (manage.programmaticProjects.rateLimited). `Retry-After` says when to retry. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'post_/manage/programmatic-projects::ProgrammaticProjectCreateAction': {
     parameters: {
       query?: never;
@@ -11485,7 +12107,8 @@ interface operations {
            *           "email": "spam@keboola.com"
            *         },
            *         "approver": null,
-           *         "canApproveMergeRequests": true
+           *         "canApproveMergeRequests": true,
+           *         "isOrganizationMember": true
            *       },
            *       {
            *         "id": 124,
@@ -11506,7 +12129,8 @@ interface operations {
            *           "name": "admin 1",
            *           "email": "dev@keboola.com"
            *         },
-           *         "canApproveMergeRequests": false
+           *         "canApproveMergeRequests": false,
+           *         "isOrganizationMember": false
            *       }
            *     ]
            */
@@ -12161,7 +12785,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the token does not have permission to change the project disabled status. */
+      /** @description Returned when the token is neither a super admin nor a holder of the "can-disable-projects" feature. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -14520,6 +15144,46 @@ interface operations {
       };
     };
   };
+  'get_/manage/ui-apps/{id}::UiAppsDetailAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /**
+         * @description Immutable stringId of the application. Renaming changes the display name, not this.
+         * @example kbc.manageApps
+         */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The application and every version it has. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['UiAppDetailResponse'];
+        };
+      };
+      /** @description Returned when the token is neither a super admin nor a super token with the `connection:ui-manage` scope. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the UI application does not exist. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'delete_/manage/ui-apps/{id}::UiAppsDeleteAction': {
     parameters: {
       query?: never;
@@ -14549,7 +15213,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token is not a super token with the `connection:ui-manage` scope. */
+      /** @description Returned when the token is neither a super admin nor a super token with the `connection:ui-manage` scope. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -14565,16 +15229,68 @@ interface operations {
       };
     };
   };
-  'get_/manage/ui-apps::UiAppsListAction': {
+  'patch_/manage/ui-apps/{id}::UiAppsRenameAction': {
     parameters: {
       query?: never;
       header?: never;
+      path: {
+        /**
+         * @description Immutable stringId of the application. Renaming changes the display name, not this.
+         * @example kbc.manageApps
+         */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['RenameRequest'];
+      };
+    };
+    responses: {
+      /** @description The application has been renamed. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when `name` is missing or blank. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the token is neither a super admin nor a super token with the `connection:ui-manage` scope. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the UI application does not exist. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'get_/manage/ui-apps::UiAppsListAction': {
+    parameters: {
+      query?: {
+        /** @description Also return applications that have no active version, with every version field null. Requires a super admin; the plain list is public. */
+        includeInactive?: boolean;
+      };
+      header?: never;
       path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description List of UI applications with their active version. */
+      /** @description List of UI applications with their active version, or every application when `includeInactive` is set. */
       200: {
         headers: {
           [name: string]: unknown;
@@ -14583,6 +15299,7 @@ interface operations {
           /**
            * @example [
            *       {
+           *         "stringId": "kbc.manageApps",
            *         "name": "kbc.manageApps",
            *         "version": "0.0.3-33-ga6bc947",
            *         "basePath": "https://kbc-uis.s3.amazonaws.com/kbc.manageApps/0.0.3-33-ga6bc947/",
@@ -14600,8 +15317,15 @@ interface operations {
            *       }
            *     ]
            */
-          'application/json': components['schemas']['UiAppsListResponse'];
+          'application/json': components['schemas']['UiAppsListResponse'] | components['schemas']['UiAppInactiveResponse'];
+        };
+      };
+      /** @description Returned when `includeInactive` is requested by a token that is neither a super admin nor a super token with the `connection:ui-manage` scope. */
+      403: {
+        headers: {
+          [name: string]: unknown;
         };
+        content?: never;
       };
     };
   };
@@ -14658,7 +15382,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token is not a super token with the `connection:ui-manage` scope. */
+      /** @description Returned when the token is neither a super admin nor a super token with the `connection:ui-manage` scope. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -16015,6 +16739,10 @@ interface operations {
           /** Format: email */
           adminEmail?: string | null;
           adminPassword?: string | null;
+          /**
+           * @deprecated
+           * @description Bring-your-own Snowflake backend is no longer supported for Pay As You Go; any non-null value is rejected with 400.
+           */
           backendConfiguration?: Record<string, never> | null;
           extraQueryParams?: Record<string, never> | null;
           extraFormData?: Record<string, never> | null;
@@ -16054,6 +16782,15 @@ interface operations {
   };
 }
 //#endregion
+//#region src/clients/management/applicationTokens/types.d.ts
+/** A super ("application") token as listed by `GET /manage/application-tokens`. */
+type ApplicationToken = ArrayElement<OpenapiReturnType<paths['/manage/application-tokens']['get']>>;
+/** `POST /manage/application-tokens`. `token` is the secret and is returned only here. */
+type CreatedApplicationToken = OpenapiReturnType<paths['/manage/application-tokens']['post']>;
+type CreateApplicationTokenBody = OpenapiBodyType<paths['/manage/application-tokens']['post']>;
+/** One scope this stack defines. Any string is accepted on create; the list is what a picker offers. */
+type ApplicationTokenScope = ArrayElement<OpenapiReturnType<paths['/manage/application-tokens/scopes']['get']>>;
+//#endregion
 //#region src/clients/management/currentUser/types.d.ts
 type MaintainerInvitation = components['schemas']['MaintainerInvitationResponse'];
 type OrganizationInvitation = components['schemas']['OrganizationInvitationResponse'];
@@ -16277,6 +17014,30 @@ type CreditPaymentRequest = Omit<OpenapiReturnType<paths['/pay-as-you-go/billing
 };
 type CreatePaymentRequestBody = OpenapiBodyType<paths['/pay-as-you-go/billing/create-payment-request']['post']>;
 //#endregion
+//#region src/clients/management/programmaticProjects/types.d.ts
+/**
+ * `POST /manage/programmatic-projects/confirm`, hand-declared.
+ *
+ * - Production's spec lacks this path; replace both types with the generated
+ *   `operations['post_/manage/programmatic-projects/confirm::…']` once it has it.
+ */
+type ConfirmProgrammaticProjectPayload = {
+  /** `kbc_apc_<claimId>_<secret>`. Omit to use the `HttpOnly` claim cookie (e.g. after sign-up/IdP);
+   * the body wins over the cookie. */
+  claimToken?: string;
+};
+/**
+ * The confirmed project and the account that now owns it.
+ *
+ * - No token: the claim is spent and the agent's session revoked.
+ */
+type ConfirmProgrammaticProjectResult = {
+  project: {
+    id: number;
+  };
+  confirmedByAdminId: number;
+};
+//#endregion
 //#region src/clients/management/users/types.d.ts
 type AddUserFeaturePath = {
   userIdOrMail: string;
@@ -16324,9 +17085,8 @@ type DeleteUserMetadataPath = UserPath & {
 type UpdateProjectBody = components['schemas']['ProjectUpdateRequest'];
 type ProjectTemplate = components['schemas']['ProjectTemplateResponse'];
 type MoveProjectBody = paths['/manage/projects/{projectId}/organizations']['post']['requestBody']['content']['application/json'];
-/** Body for POST /manage/projects/{projectId}/disabled — no schema entry; hand-written per live API.
- * The backend requires `disableReason` when disabling (400 "Disable reason must be set"), so the
- * shape is a discriminated union: a reason is mandatory only on the `isDisabled: true` branch. */
+/** Body for POST /manage/projects/{projectId}/disabled — hand-written, no schema entry.
+ * The backend 400s without `disableReason` when disabling. */
 type SetProjectDisabledBody = {
   isDisabled: true;
   disableReason: string;
@@ -16334,8 +17094,7 @@ type SetProjectDisabledBody = {
 } | {
   isDisabled: false;
 };
-/** Body for `POST /manage/projects/{projectId}/limits`. Super admins may set any limit; admins
- * holding the `can-manage-project-limits` feature may set only the whitelisted subset. */
+/** Super admins may set any limit; `can-manage-project-limits` admins only a whitelisted subset. */
 type SetProjectLimitsBody = {
   limits: {
     name: string;
@@ -16424,9 +17183,8 @@ type ListProjectInvitationsPath = {
   projectId: number | string;
 };
 type ProjectInvitationDetail = components['schemas']['ProjectInvitationDetailResponse'];
-/** The four roles a non-SOX project offers on invite / add — a subset of the 7-value `User['role']`
- * union. A project with a protected default branch instead offers `productionManager`, `developer`
- * and `reviewer`, so a role `<Select>` is only limited to these four off the SOX path. */
+/** The roles a non-SOX project offers on invite / add; a SOX project offers
+ * `productionManager`, `developer` and `reviewer` instead. */
 type ProjectInvitableRole = 'admin' | 'guest' | 'readOnly' | 'share';
 type CreateProjectInvitationPath = {
   projectId: number;
@@ -16434,19 +17192,10 @@ type CreateProjectInvitationPath = {
 type CreateProjectInvitationBody = {
   email: string;
   role?: User['role'];
-  /** After how many seconds the invitation and the resulting membership expire. */
+  /** Seconds until the invitation and the resulting membership expire. */
   expirationSeconds?: number;
-  /**
-   * The ui-app the invitation leads to, instead of the Keboola project.
-   *
-   * - Values are `ui_apps` keys — the same keys Connection registers and serves an app under — so
-   *   a second app is one more member of the union, not a second flag.
-   * - Connection picks the email template from it, and honours it only for projects holding the
-   *   matching project feature. Without the feature the invitation is still created; it just gets
-   *   the ordinary email.
-   * - Absent means the ordinary email, pointing at the Keboola project.
-   * - A stack that does not know the field ignores it, so sending it is safe on every stack.
-   */
+  /** `ui_apps` key the invitation leads to instead of the project; honoured only with the
+   * matching project feature, else (and on stacks unaware of it) the ordinary email is sent. */
   landingApp?: 'business-workspace';
 };
 type DeleteProjectInvitationPath = {
@@ -16472,23 +17221,18 @@ type ProjectJoinRequestPath = {
   projectId: number;
   joinRequestId: number;
 };
-/**
- * The base project shape, returned by `updateProject`, `moveProject`, `addProjectFeature` and
- * `setProjectDisabled`. `GET /manage/projects/{projectId}` and `setProjectLimits` return the richer
- * {@link Project}.
- */
+/** Returned by `updateProject`, `moveProject`, `addProjectFeature` and `setProjectDisabled`;
+ * the detail and `setProjectLimits` return the richer {@link Project}. */
 type ProjectBase = Omit<components['schemas']['ProjectResponse'], 'limits' | 'metrics'> & {
   limits: Record<string, ProjectLimit>;
   metrics: Record<string, unknown>;
 };
 /**
  * `ProjectDetailResponse` with the parts the swagger under-models replaced:
- * - `fileStorage` is documented S3-only (`awsKey`/`filesBucket`), so ABS/GCS projects don't fit it
+ * - `fileStorage` is documented S3-only, so ABS/GCS projects don't fit it
  * - `backends` is documented as `{ snowflake }` only
  * - `organization` is missing `mfaRequired`
- * - `usersCount` isn't documented at all
- *
- * Drop each override as the swagger catches up.
+ * - `usersCount` isn't documented
  */
 type Project = Omit<components['schemas']['ProjectDetailResponse'], 'organization' | 'fileStorage' | 'backends' | 'limits' | 'metrics'> & {
   organization: ProjectOrganization;
@@ -16522,27 +17266,19 @@ type ChangeProjectUserRoleBody = {
 type ChangeProjectUserRoleInput = ChangeProjectUserRolePath & ChangeProjectUserRoleBody;
 //#endregion
 //#region src/clients/management/storageBackends/types.d.ts
-/** A storage backend's full detail as returned by `GET /manage/storage-backend/{id}` — id, owner,
- * technical owner, host/URL, stats, creator and backend-kind-specific fields.
+/**
+ * A storage backend as returned by `GET /manage/storage-backend/{id}`.
  *
- * `assignedProjectsCount` / `assignedMaintainersCount` / `loginType` are required in the generated
- * schema but weakened to optional here (live behavior > generated schema): the list endpoint
- * (`GET /manage/storage-backend`) reuses this schema while `loginType` (like
- * `keyPairLastRotatedAt`) is detail-only per the generated JSDoc, and during the pre-deploy window
- * a stack that hasn't shipped the M9.1 connection change omits all of them. Consumers access them
- * defensively; drop the overlay if the backend ever splits the list/detail response schemas. */
+ * - The counts and `loginType` are optional here, though required in the schema: the list endpoint
+ *   reuses this schema but omits `loginType`, and older stacks omit all three.
+ */
 type StorageBackend = Omit<components['schemas']['StorageBackendDetailResponse'], 'assignedProjectsCount' | 'assignedMaintainersCount' | 'loginType'> & {
   assignedProjectsCount?: number;
   assignedMaintainersCount?: number;
   loginType?: string;
 };
-/** A project assigned to a storage backend, as returned by
- * `GET /manage/storage-backend/{id}/projects`. */
 type StorageBackendProject = components['schemas']['StorageBackendProjectListResponse'][number];
-/** A maintainer assigned to a storage backend, as returned by
- * `GET /manage/storage-backend/{id}/maintainers`. */
 type StorageBackendMaintainer = components['schemas']['StorageBackendMaintainerListResponse'][number];
-/** Query parameters accepted by `GET /manage/storage-backend/{id}/projects`. */
 type GetStorageBackendProjectsQuery = NonNullable<operations['get_/manage/storage-backend/{id}/projects::StorageBackendProjectListAction']['parameters']['query']>;
 type CreateSnowflakeStorageBackendBody = components['schemas']['CreateSnowflakeBackendWithCertRequest'];
 type CreateBigqueryStorageBackendBody = components['schemas']['StorageBackendCreateBigqueryRequest'];
@@ -16553,12 +17289,35 @@ type UpdateBigqueryStorageBackendBody = components['schemas']['StorageBackendUpd
 type UpdateBigqueryStorageBackendInput = StorageBackendPath & UpdateBigqueryStorageBackendBody;
 //#endregion
 //#region src/clients/management/uiApps/types.d.ts
-type UiApp = components['schemas']['UiAppsListResponse'][number];
-type RegisterUiAppBody = components['schemas']['RegistrationRequest'];
-type ActivateUiAppVersionPath = OpenapiPathType<paths['/manage/ui-apps/{id}/activate/{version}']['post']>;
+/**
+ * One entry of the UI-application listing.
+ *
+ * - `version`, `basePath`, `type` and `commitSha` are null without an active version.
+ * - `stringId` and `name` are tightened: optional in the spec, always sent by the backend.
+ */
+type UiApp = ArrayElement<OpenapiReturnType<paths['/manage/ui-apps']['get']>> & {
+  stringId: string;
+  name: string;
+};
+/** Tightened: the spec marks every field optional, the backend sends all of them. */
+type UiAppVersion = ArrayElement<OpenapiReturnType<paths['/manage/ui-apps/{id}']['get']>['versions']> & {
+  id: number;
+  version: string;
+  created: string;
+  isActive: boolean;
+  isCritical: boolean;
+};
+/** Versions are newest first. */
+type UiAppDetail = Omit<OpenapiReturnType<paths['/manage/ui-apps/{id}']['get']>, 'versions'> & {
+  versions: UiAppVersion[];
+};
+type GetUiAppsQuery = NonNullable<OpenapiQueryType<paths['/manage/ui-apps']['get']>>;
+type RegisterUiAppBody = OpenapiBodyType<paths['/manage/ui-apps']['post']>;
+type RenameUiAppBody = OpenapiBodyType<paths['/manage/ui-apps/{id}']['patch']>;
+type UiAppRegistrationResult = OpenapiReturnType<paths['/manage/ui-apps']['post']>;
 //#endregion
 //#region src/clients/management/tokenTypes.d.ts
 type ManagementToken = components['schemas']['ManageTokenVerifyResponse'];
 //#endregion
-export { RemoveProjectUserPath as $, FeatureProject as $n, MaintainerInvitationPath as $t, GetProjectPath as A, OrganizationUserPath as An, CreditPaymentRequest as At, ProjectBase as B, FileStorageGcs as Bn, CompleteSamlSetupBody as Bt, CreateProjectFeatureBody as C, OrganizationInvitationDetail as Cn, UserDetail as Ct, DeleteProjectInvitationPath as D, OrganizationMetadataItemPath as Dn, UserPath as Dt, CreateProjectInvitationPath as E, OrganizationMaintainer as En, UserOrganizationMembership as Et, ListProjectJoinRequestsPath as F, CreateFileStorageAbsBody as Fn, TopUpSetting as Ft, ProjectMetadataInput as G, RotateFileStorageGcsBody as Gn, CreateMaintainerOrganizationBody as Gt, ProjectInvitationDetail as H, RotateFileStorageAbsBody as Hn, CreateMaintainerBody as Ht, ListProjectUsersPath as I, CreateFileStorageGcsBody as In, UpdateStripeCustomerBody as It, ProjectTemplate as J, RotateFileStorageS3Body as Jn, CreateSamlConfigInput as Jt, ProjectMetadataItem as K, RotateFileStorageGcsInput as Kn, CreateMaintainerOrganizationInput as Kt, MoveProjectBody as L, CreateFileStorageS3Body as Ln, UpdateTopUpSettingBody as Lt, JoinProjectBody as M, SetOrganizationMetadataInput as Mn, PayAsYouGoBillingConfiguration as Mt, JoinProjectInput as N, UpdateOrganizationBody as Nn, StripeCustomer as Nt, DeleteProjectMetadataPath as O, OrganizationPath as On, UserProjectMembership as Ot, ListProjectInvitationsPath as P, UpdateOrganizationInput as Pn, StripeCustomerCard as Pt, RemoveProjectTemplateFeaturePath as Q, FeatureAdmin as Qn, MaintainerInvitationDetail as Qt, MoveProjectInput as R, FileStorage as Rn, AddMaintainerUserBody as Rt, ChangeProjectUserRolePath as S, OrganizationDetail as Sn, User as St, CreateProjectInvitationBody as T, OrganizationListItem as Tn, UserMaintainerMembership as Tt, ProjectJoinRequestDetail as U, RotateFileStorageAbsInput as Un, CreateMaintainerInvitationBody as Ut, ProjectInvitableRole as V, FileStorageS3 as Vn, CompleteSamlSetupInput as Vt, ProjectJoinRequestPath as W, RotateFileStorageAbsPath as Wn, CreateMaintainerInvitationInput as Wt, RemoveProjectFeaturePath as X, RotateFileStorageS3Path as Xn, Maintainer as Xt, ProjectTemplatePath as Y, RotateFileStorageS3Input as Yn, CreateSamlConfigPath as Yt, RemoveProjectLimitPath as Z, Feature as Zn, MaintainerDetail as Zt, AddProjectUserPath as _, CreateOrganizationInvitationBody as _n, RemoveUserFeaturePath as _t, CreateBigqueryStorageBackendBody as a, SamlConfigDetail as an, MaintainerInvitation as ar, SetProjectLimitsBody as at, ChangeProjectUserRoleBody as b, CreateOrganizationProjectInput as bn, UpdateUserBody as bt, StorageBackend as c, SetMaintainerMetadataBody as cn, ProjectJoinRequest as cr, SetProjectMetadataPath as ct, StorageBackendProject as d, UpdateMaintainerInput as dn, UpdateProjectBody as dt, MaintainerMetadataItemPath as en, FeatureType as er, RequestProjectAccessBody as et, UpdateBigqueryStorageBackendBody as f, UpdateSamlConfigBody as fn, UpdateProjectInput as ft, AddProjectUserBody as g, AdminUser as gn, GetUsersQuery as gt, UpdateStorageBackendInput as h, AddOrganizationUserInput as hn, DeleteUserMetadataPath as ht, UiApp as i, MetadataItem as in, DeletedProjectsListQuery as ir, SetProjectDisabledInput as it, GetProjectReviewersPath as j, SetOrganizationMetadataBody as jn, CreditPurchase as jt, GetProjectMetadataPath as k, OrganizationProject as kn, CreatePaymentRequestBody as kt, StorageBackendMaintainer as l, SetMaintainerMetadataInput as ln, paths as lr, SetProjectReviewersBody as lt, UpdateStorageBackendBody as m, AddOrganizationUserBody as mn, AddUserFeaturePath as mt, ActivateUiAppVersionPath as n, MaintainerUser as nn, DeletedProject as nr, Reviewer as nt, CreateSnowflakeStorageBackendBody as o, SamlConfigPath as on, OrganizationInvitation as or, SetProjectLimitsInput as ot, UpdateBigqueryStorageBackendInput as p, UpdateSamlConfigInput as pn, AddUserFeatureBody as pt, ProjectPath as q, RotateFileStorageGcsPath as qn, CreateSamlConfigBody as qt, RegisterUiAppBody as r, MaintainerUserPath as rn, DeletedProjectPurgeResult as rr, SetProjectDisabledBody as rt, GetStorageBackendProjectsQuery as s, SamlConfigSummary as sn, ProjectInvitation as sr, SetProjectMetadataBody as st, ManagementToken as t, MaintainerPath as tn, GetAllFeaturesQuery as tr, RequestProjectAccessInput as tt, StorageBackendPath as u, UpdateMaintainerBody as un, SetProjectReviewersPath as ut, AssignFeatureBody as v, CreateOrganizationInvitationInput as vn, SetUserMetadataBody as vt, CreateProjectFeaturePath as w, OrganizationInvitationPath as wn, UserListItem as wt, ChangeProjectUserRoleInput as x, Organization as xn, UpdateUserInput as xt, AssignProjectTemplateFeatureInput as y, CreateOrganizationProjectBody as yn, SetUserMetadataInput as yt, Project as z, FileStorageAbs as zn, AddMaintainerUserInput as zt };
-//# sourceMappingURL=types-CzsnuPFh.d.cts.map
+export { ProjectTemplatePath as $, RotateFileStorageGcsPath as $n, CreateSamlConfigBody as $t, CreateProjectInvitationPath as A, OrganizationInvitationPath as An, UserOrganizationMembership as At, ListProjectUsersPath as B, UpdateOrganizationInput as Bn, StripeCustomerCard as Bt, AssignProjectTemplateFeatureInput as C, CreateOrganizationInvitationBody as Cn, SetUserMetadataInput as Ct, CreateProjectFeatureBody as D, Organization as Dn, UserDetail as Dt, ChangeProjectUserRolePath as E, CreateOrganizationProjectInput as En, User as Et, GetProjectReviewersPath as F, OrganizationProject as Fn, CreatePaymentRequestBody as Ft, ProjectInvitableRole as G, FileStorageAbs as Gn, AddMaintainerUserInput as Gt, MoveProjectInput as H, CreateFileStorageGcsBody as Hn, UpdateStripeCustomerBody as Ht, JoinProjectBody as I, OrganizationUserPath as In, CreditPaymentRequest as It, ProjectJoinRequestPath as J, RotateFileStorageAbsBody as Jn, CreateMaintainerBody as Jt, ProjectInvitationDetail as K, FileStorageGcs as Kn, CompleteSamlSetupBody as Kt, JoinProjectInput as L, SetOrganizationMetadataBody as Ln, CreditPurchase as Lt, DeleteProjectMetadataPath as M, OrganizationMaintainer as Mn, UserProjectMembership as Mt, GetProjectMetadataPath as N, OrganizationMetadataItemPath as Nn, ConfirmProgrammaticProjectPayload as Nt, CreateProjectFeaturePath as O, OrganizationDetail as On, UserListItem as Ot, GetProjectPath as P, OrganizationPath as Pn, ConfirmProgrammaticProjectResult as Pt, ProjectTemplate as Q, RotateFileStorageGcsInput as Qn, CreateMaintainerOrganizationInput as Qt, ListProjectInvitationsPath as R, SetOrganizationMetadataInput as Rn, PayAsYouGoBillingConfiguration as Rt, AssignFeatureBody as S, AdminUser as Sn, SetUserMetadataBody as St, ChangeProjectUserRoleInput as T, CreateOrganizationProjectBody as Tn, UpdateUserInput as Tt, Project as U, CreateFileStorageS3Body as Un, UpdateTopUpSettingBody as Ut, MoveProjectBody as V, CreateFileStorageAbsBody as Vn, TopUpSetting as Vt, ProjectBase as W, FileStorage as Wn, AddMaintainerUserBody as Wt, ProjectMetadataItem as X, RotateFileStorageAbsPath as Xn, CreateMaintainerInvitationInput as Xt, ProjectMetadataInput as Y, RotateFileStorageAbsInput as Yn, CreateMaintainerInvitationBody as Yt, ProjectPath as Z, RotateFileStorageGcsBody as Zn, CreateMaintainerOrganizationBody as Zt, UpdateBigqueryStorageBackendInput as _, UpdateMaintainerInput as _n, CreateApplicationTokenBody as _r, AddUserFeatureBody as _t, UiApp as a, MaintainerInvitationPath as an, FeatureProject as ar, RequestProjectAccessInput as at, AddProjectUserBody as b, AddOrganizationUserBody as bn, GetUsersQuery as bt, UiAppVersion as c, MaintainerUser as cn, DeletedProject as cr, SetProjectDisabledInput as ct, GetStorageBackendProjectsQuery as d, SamlConfigDetail as dn, MaintainerInvitation as dr, SetProjectMetadataBody as dt, CreateSamlConfigInput as en, RotateFileStorageS3Body as er, RemoveProjectFeaturePath as et, StorageBackend as f, SamlConfigPath as fn, OrganizationInvitation as fr, SetProjectMetadataPath as ft, UpdateBigqueryStorageBackendBody as g, UpdateMaintainerBody as gn, ApplicationTokenScope as gr, UpdateProjectInput as gt, StorageBackendProject as h, SetMaintainerMetadataInput as hn, ApplicationToken as hr, UpdateProjectBody as ht, RenameUiAppBody as i, MaintainerInvitationDetail as in, FeatureAdmin as ir, RequestProjectAccessBody as it, DeleteProjectInvitationPath as j, OrganizationListItem as jn, UserPath as jt, CreateProjectInvitationBody as k, OrganizationInvitationDetail as kn, UserMaintainerMembership as kt, CreateBigqueryStorageBackendBody as l, MaintainerUserPath as ln, DeletedProjectPurgeResult as lr, SetProjectLimitsBody as lt, StorageBackendPath as m, SetMaintainerMetadataBody as mn, ProjectJoinRequest as mr, SetProjectReviewersPath as mt, GetUiAppsQuery as n, Maintainer as nn, RotateFileStorageS3Path as nr, RemoveProjectTemplateFeaturePath as nt, UiAppDetail as o, MaintainerMetadataItemPath as on, FeatureType as or, Reviewer as ot, StorageBackendMaintainer as p, SamlConfigSummary as pn, ProjectInvitation as pr, SetProjectReviewersBody as pt, ProjectJoinRequestDetail as q, FileStorageS3 as qn, CompleteSamlSetupInput as qt, RegisterUiAppBody as r, MaintainerDetail as rn, Feature as rr, RemoveProjectUserPath as rt, UiAppRegistrationResult as s, MaintainerPath as sn, GetAllFeaturesQuery as sr, SetProjectDisabledBody as st, ManagementToken as t, CreateSamlConfigPath as tn, RotateFileStorageS3Input as tr, RemoveProjectLimitPath as tt, CreateSnowflakeStorageBackendBody as u, MetadataItem as un, DeletedProjectsListQuery as ur, SetProjectLimitsInput as ut, UpdateStorageBackendBody as v, UpdateSamlConfigBody as vn, CreatedApplicationToken as vr, AddUserFeaturePath as vt, ChangeProjectUserRoleBody as w, CreateOrganizationInvitationInput as wn, UpdateUserBody as wt, AddProjectUserPath as x, AddOrganizationUserInput as xn, RemoveUserFeaturePath as xt, UpdateStorageBackendInput as y, UpdateSamlConfigInput as yn, paths as yr, DeleteUserMetadataPath as yt, ListProjectJoinRequestsPath as z, UpdateOrganizationBody as zn, StripeCustomer as zt };
+//# sourceMappingURL=types-Dtuvhm3K.d.cts.map