@keboola/api-client 53.0.0 → 55.0.0

package/dist/{types-DNldEa7i.d.ts → types-J_dgwMjP.d.ts}

@@ -625,7 +625,7 @@ type paths = {
     };
     /**
      * List Azure Blob Storage
-     * @description Returns all registered Azure Blob Storages.
+     * @description Returns all registered Azure Blob Storages. A super admin, or an admin with the "can-manage-maintainers" feature, may call this.
      */
     get: operations['get_/manage/file-storage-abs::FileStorageAbsListAction'];
     put?: never;
@@ -752,7 +752,7 @@ type paths = {
     };
     /**
      * List Google Cloud Storage
-     * @description Returns all registered Google Cloud Storages.
+     * @description Returns all registered Google Cloud Storages. A super admin, or an admin with the "can-manage-maintainers" feature, may call this.
      */
     get: operations['get_/manage/file-storage-gcs::FileStorageGcsListAction'];
     put?: never;
@@ -818,7 +818,7 @@ type paths = {
     };
     /**
      * List storages
-     * @description Returns all registered AWS S3 storages.
+     * @description Returns all registered AWS S3 storages. A super admin, or an admin with the "can-manage-maintainers" feature, may call this.
      */
     get: operations['get_/manage/file-storage-s3::FileStorageS3ListAction'];
     put?: never;
@@ -1000,7 +1000,7 @@ type paths = {
     put?: never;
     /**
      * Create a maintainer
-     * @description Creates a new maintainer. The user associated with the token will become an admin of the maintainer.
+     * @description Creates a new maintainer. A super admin may set every field. An admin with the "can-manage-maintainers" feature may set only name, defaultConnectionSnowflakeId and defaultFileStorageId. The user associated with the token becomes an admin of the maintainer.
      */
     post: operations['post_/manage/maintainers::MaintainerCreateAction'];
     delete?: never;
@@ -1080,7 +1080,7 @@ type paths = {
     head?: never;
     /**
      * Update a maintainer
-     * @description A partial update of a maintainer.
+     * @description A partial update of a maintainer. A super admin may change every field. A maintainer member without can-manage-maintainers may change name. An admin with that feature may change name, defaultConnectionSnowflakeId and defaultFileStorageId on any active maintainer.
      */
     patch: operations['patch_/manage/maintainers/{id}::MaintainerUpdateAction'];
     trace?: never;
@@ -2070,6 +2070,26 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/manage/projects/{projectId}/restorable-objects': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List restorable tables and buckets of a project
+     * @description Lists the tables and buckets dropped from the default branch of a Snowflake project that are still in Snowflake Time Travel and can be restored. Every dropped version is listed, newest first; `droppedOn` identifies the version. The tables of a dropped bucket are listed only once the bucket is restored. Snowflake lists at most 10 000 objects of a database, so a very large project can be listed per bucket with `bucketId`. Read-only. Allowed to a super admin or an admin with the `can-restore-tables` feature.
+     */
+    get: operations['get_/manage/projects/{projectId}/restorable-objects::ProjectListRestorableObjectsAction'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/manage/projects/{projectId}/workspaces': {
     parameters: {
       query?: never;
@@ -2273,6 +2293,66 @@ type paths = {
     patch: operations['patch_/manage/projects/{projectId}/users/{userId}::ProjectUpdateAdministratorAction'];
     trace?: never;
   };
+  '/manage/search': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Search projects, organizations, maintainers and users
+     * @description Looks up the entities an admin navigates to across the whole stack, by name (and email for users).
+     *
+     *     #### Access
+     *
+     *     Each type is searched only when the caller may read it; a type it may not read is **absent** from the
+     *     response, not an empty collection, so "not allowed" and "no hits" can be told apart.
+     *
+     *     * super admin — every type
+     *     * `project`, `organization`, `maintainer` — any L1 support feature (such as `can-manage-features`
+     *       or `can-disable-projects`)
+     *     * `user` — feature `can-manage-users` (the rule of `GET /manage/users`)
+     *
+     *     Any other admin gets 403; membership in a project, organization or maintainer grants nothing here.
+     *     Admin and session tokens are accepted.
+     *
+     *     #### Matching
+     *
+     *     * *q* - required, trimmed, 2 to 255 characters. Matched as a case-insensitive substring of the name,
+     *       and of the email for users. `%` and `_` match themselves. An all-digit `q` also matches the row with
+     *       that exact `id`.
+     *     * Deleted projects, organizations and maintainers and anonymized users are never found. Disabled
+     *       projects are found and carry `isDisabled: true`.
+     *     * *filter[types]* - comma-separated subset of `project`, `organization`, `maintainer`, `user`;
+     *       omitted, every type the caller may read is searched. A listed type the caller may not read is
+     *       left out like an unlisted one.
+     *
+     *     #### Ranking and pagination
+     *
+     *     Each type is its own cursor-paginated collection (`data`, `meta`, `links`). Every item carries its
+     *     `rank`: `0` exact id match, `1` the name (or user email) starts with `q`, `2` any other match.
+     *     Items are ordered `rank ASC, id DESC`.
+     *
+     *     * *page[limit]* - items returned per type; default value: 10, maximum: 50
+     *     * *page[after]* - cursor of the last item already read, for a single type: it requires exactly one
+     *       type in `filter[types]`. It is the base64url (padding optional) of `{"rank": <integer>, "id": <integer>}`
+     *       copied from that item, e.g. `{"rank":2,"id":4088}` → `eyJyYW5rIjoyLCJpZCI6NDA4OH0`.
+     *       Each type's `links.next` already carries its next page, with `filter[types]` narrowed to that type.
+     *
+     *     A `q` that is missing or too short or long, an unknown or repeated type, an undecodable cursor,
+     *     `page[after]` without exactly one type, and bare `limit` / `offset` or `page[offset]` are rejected
+     *     with a validation error.
+     */
+    get: operations['get_/manage/search::SearchAction'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/manage/storage-backend/{backendId}/activate': {
     parameters: {
       query?: never;
@@ -2382,10 +2462,18 @@ type paths = {
     put?: never;
     /**
      * Create a new BigQuery backend
-     * @description You must create a new project and service account in a folder in your organization,
-     *     this service account must have the right to create new projects (roles/resourcemanager.projectCreator) in this folder (only in this folder)
+     * @description You must create a new project and service account in a folder in your organization
      *     and use the generated json [keyFile](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)
      *     for this `service account` in the `credentials` parameter, the folder id then as `folderId`.
+     *
+     *     The service account needs, as effective access (direct, inherited or through a group):
+     *     - on the folder (only this folder): `roles/resourcemanager.projectCreator` and `roles/browser`;
+     *     - on its own project: `roles/owner` and `roles/storage.objectAdmin`;
+     *     - on the billing account of its project: `roles/billing.user`;
+     *     - on the bucket of every GCS file storage used with this backend: `roles/storage.admin`.
+     *
+     *     The registration checks all but the bucket and lists every grant as held or missing; project
+     *     creation checks the bucket before it creates anything.
      */
     post: operations['post_/manage/storage-backend/bigquery::StorageBackendCreateBigqueryAction'];
     delete?: never;
@@ -2496,9 +2584,9 @@ type paths = {
     };
     /**
      * BigQuery policy-tag enablement guide
-     * @description Returns what the customer sets up in Google Cloud before Keboola can enable BigQuery policy tags on this backend: the custom roles, the root service account's bindings on the taxonomy, its probe tag, and the enable command with the values filled in. `format=markdown` returns a document, `format=terraform` a module that creates the same resources.
+     * @description Returns what the customer sets up in Google Cloud before Keboola can enable BigQuery policy tags on this backend: the custom setter role, its bindings on the taxonomy for the root service account and for the principal set of the backend folder, the probe tag, and the enable command with the values filled in. `format=markdown` returns a document, `format=terraform` a module that creates the same resources.
      *
-     *     A backend uses one taxonomy. Pass the existing one as the single item of `resourceScopes`, or `createTaxonomy=true` for a new one in `roleProject`; a second taxonomy is refused. The taxonomy must be in the backend region, and in `roleProject`: the custom roles are project-level and can be granted only on resources of their own project.
+     *     A backend uses one taxonomy. Pass the existing one as the single item of `resourceScopes`, or `createTaxonomy=true` for a new one in `roleProject`; a second taxonomy is refused. The taxonomy must be in the backend region, and in `roleProject`: the custom role is project-level and can be granted only on resources of its own project.
      *
      *     Available to a super admin only, the same as creating a BigQuery backend.
      */
@@ -2633,7 +2721,7 @@ type paths = {
      *
      *     With `includeInactive=true` it returns every registered application instead, including
      *     those that have no active version — their `version`, `basePath`, `type` and `commitSha`
-     *     are then null and `scripts`/`styles` empty. That variant requires a super admin.
+     *     are then null and `scripts`/`styles`/`preloads` empty. That variant requires a super admin.
      */
     get: operations['get_/manage/ui-apps::UiAppsListAction'];
     put?: never;
@@ -2719,6 +2807,9 @@ type paths = {
      * @description It will completely remove user from everywhere (projects, organizations and maintainers).
      *     Removes also personal data of user (e-mail and name).
      *
+     *     A holder of the `can-manage-users` feature can delete any user except a super admin, including users
+     *     in organizations, projects and maintainers the holder is not a member of.
+     *
      *     The path parameter accepts an integer user ID or an email address.
      */
     delete: operations['delete_/manage/users/{idOrEmail}::UserDeleteAction'];
@@ -3093,6 +3184,26 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/pay-as-you-go/x402/projects/{projectId}/credits': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Buy pay-as-you-go credits with x402
+     * @description Buys credits for a pay-as-you-go project with a USDC payment over the x402 V2 protocol. Without the `PAYMENT-SIGNATURE` header the call answers `402` with the payment requirements in the base64 JSON `PAYMENT-REQUIRED` header. Repeat the same request with a signed payment in `PAYMENT-SIGNATURE`; it answers `200` with the credit row and the base64 JSON settlement in `PAYMENT-RESPONSE`. The payment must carry the required `payment-identifier` extension: a retry with the same identifier returns the stored result instead of paying again. Authenticated by a Manage API token (admin or session type) or a programmatic bearer token; the browser session cookie and personal access tokens are refused.
+     */
+    post: operations['post_/pay-as-you-go/x402/projects/{projectId}/credits::X402TopUpAction'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/integration/partners/gcp/project/{projectId}/set-up/big-query': {
     parameters: {
       query?: never;
@@ -3271,7 +3382,7 @@ type components = {
        */
       accountKey: string;
     };
-    FileStorageUsageListRequest: Record<string, never>;
+    FileStorageProjectListRequest: Record<string, never>;
     /** @description Partial update of a file storage; at least one of `owner`, `region` must be supplied. */
     FileStorageUpdateRequest: {
       /**
@@ -3804,6 +3915,7 @@ type components = {
       /** @description Project time zone (e.g., “America/New_York”, “Europe/London”). Only supported with the BigQuery backend. */
       timezone?: string | null;
     };
+    SearchRequest: Record<string, never>;
     CreateSnowflakeBackendWithCertRequest: {
       /**
        * @description Snowflake host name.
@@ -3964,7 +4076,7 @@ type components = {
        */
       format?: 'markdown' | 'terraform' | null;
       /**
-       * @description GCP project ID that holds the custom roles (and the new taxonomy when `createTaxonomy` is true).
+       * @description GCP project ID that holds the custom setter role (and the new taxonomy when `createTaxonomy` is true).
        * @example acme-data-governance
        */
       roleProject: string;
@@ -4164,6 +4276,17 @@ type components = {
       /** @description Identifier of the project to top up. Must be a positive integer. */
       idProject: number;
     };
+    X402TopUpQueryRequest: {
+      /**
+       * @description The amount to pay in USD, tax-inclusive, with at most two decimals and within the stack's minimum and maximum. The credits are the amount divided by the stack's credit price.
+       * @example 25.00
+       */
+      amountUsd: string;
+    };
+    X402TopUpHeaderRequest: {
+      /** @description Base64 JSON x402 V2 `PaymentPayload`. */
+      'payment-signature'?: string | null;
+    };
     SetUpBigQueryRequest: {
       /** @description GCP service account credentials. */
       serviceAccountKey: {
@@ -4713,6 +4836,31 @@ type components = {
       /** @description Projects awaiting purge whose scheduled purge time has passed; a subset of `deleted`. */
       overdue: number;
     };
+    /**
+     * @example {
+     *       "id": 1,
+     *       "name": "Test user",
+     *       "email": "test@example.com"
+     *     }
+     */
+    FeatureAdminResponse: {
+      /**
+       * @description Admin identifier.
+       * @example 1
+       */
+      id: number;
+      /**
+       * @description Admin name.
+       * @example Test user
+       */
+      name: string;
+      /**
+       * @description Admin email address.
+       * @example test@example.com
+       */
+      email: string;
+    };
+    FeatureAdminListResponse: components['schemas']['FeatureAdminResponse'][];
     /**
      * @example {
      *       "id": 1,
@@ -4723,7 +4871,7 @@ type components = {
      *       "canBeManageByAdmin": false,
      *       "canBeManagedByAdmin": false,
      *       "canBeManagedViaAPI": true,
-     *       "created": "2016-04-28T15:24:51.620Z"
+     *       "created": "2016-04-28T15:24:51+0200"
      *     }
      */
     FeatureResponse: {
@@ -4742,7 +4890,7 @@ type components = {
        * @example admin
        * @enum {string}
        */
-      type: 'admin' | 'project';
+      type: 'admin' | 'project' | 'global';
       /**
        * @description Feature title.
        * @example Show new design
@@ -4770,9 +4918,8 @@ type components = {
        */
       canBeManagedViaAPI: boolean;
       /**
-       * Format: date-time
-       * @description Feature creation time.
-       * @example 2016-04-28T15:24:51.620Z
+       * @description Feature creation time in ISO 8601 with a UTC offset and no fraction (`Y-m-d\TH:i:sO`); an empty string when the time is not recorded.
+       * @example 2016-04-28T15:24:51+0200
        */
       created: string;
     };
@@ -5303,7 +5450,7 @@ type components = {
        * @example 2016-02-29T08:01:13+0200
        */
       created: string | null;
-      /** @description User who invited this user; null when the user was not invited. */
+      /** @description User who invited this user; null when the user was not invited or the inviting user was deleted. */
       invitor: {
         /** @example 124 */
         id: number;
@@ -5506,6 +5653,14 @@ type components = {
       /** @description Organizations belonging to this maintainer. */
       organizations: components['schemas']['OrganizationResponse'][];
     };
+    OrganizationAdministratorReferenceResponse: {
+      /** @example 23423 */
+      id: number;
+      /** @example Martin Halamicek */
+      name: string;
+      /** @example martin@keboola.com */
+      email: string;
+    };
     /**
      * @example {
      *       "id": 88,
@@ -5797,6 +5952,67 @@ type components = {
       };
     };
     OrganizationsListResponse: components['schemas']['OrganizationListResponse'][];
+    /**
+     * @example {
+     *       "id": 123,
+     *       "key": "KBC.SomeEnity.metadataKey",
+     *       "value": "Some value",
+     *       "provider": "user",
+     *       "timestamp": "2021-02-17T15:05:21+0100"
+     *     }
+     */
+    OrganizationMetadataResponse: {
+      /**
+       * @description Metadata identifier.
+       * @example 123
+       */
+      id: number;
+      /**
+       * @description Metadata key.
+       * @example KBC.SomeEnity.metadataKey
+       */
+      key: string;
+      /**
+       * @description Metadata value; null only for a row written outside the API.
+       * @example Some value
+       */
+      value: string | null;
+      /**
+       * @description Metadata provider.
+       * @example user
+       */
+      provider: string;
+      /**
+       * Format: date-time
+       * @description Time of the last change.
+       * @example 2021-02-17T15:05:21+0100
+       */
+      timestamp: string;
+    };
+    /**
+     * @example {
+     *       "id": 123,
+     *       "name": "test user",
+     *       "email": "martin@keboola.com"
+     *     }
+     */
+    OrganizationProjectUserResponse: {
+      /**
+       * @description User identifier.
+       * @example 123
+       */
+      id: number;
+      /**
+       * @description User name.
+       * @example test user
+       */
+      name: string;
+      /**
+       * @description User e-mail.
+       * @example martin@keboola.com
+       */
+      email: string;
+    };
     ProgrammaticProjectClaimDetailResponse: {
       /** @description Whether the browser carries a parked claim. */
       present: boolean;
@@ -5860,6 +6076,25 @@ type components = {
       confirmUrl: string;
       /** @description Identifier of the claim, safe to log. Correlates the provisioning audit record with the later confirmation without exposing the token. */
       claimId: string;
+      /** @description How to buy more credits for this project with USDC over x402, or null when this stack does not offer it or the card credit price cannot be read right now. Send `method` to `urlTemplate` with `{amountUsd}` replaced by the amount in USD (at most two decimals, between `minAmountUsd` and `maxAmountUsd`); the first call answers 402 with the payment requirements. The endpoint refuses the project until a human confirms it through `confirmUrl`, and confirming revokes `accessToken`, so the call is authenticated by a Manage API token (admin or session type) or a programmatic bearer token of a project admin, such as the confirming human's session. */
+      x402TopUp: {
+        /** @example POST */
+        method: string;
+        /**
+         * @description Absolute URL with an RFC 6570 `{amountUsd}` placeholder.
+         * @example https://connection.keboola.com/pay-as-you-go/x402/projects/1234/credits?amountUsd={amountUsd}
+         */
+        urlTemplate: string;
+        /** @example 1.00 */
+        minAmountUsd: string;
+        /** @example 1000.00 */
+        maxAmountUsd: string;
+        /**
+         * @description USD per credit, the same as the card credit price; the top-up buys `amountUsd / creditPriceUsd` credits.
+         * @example 8.40
+         */
+        creditPriceUsd: string;
+      } | null;
     };
     /**
      * @example {
@@ -6004,8 +6239,8 @@ type components = {
        * @example temporary test
        */
       reason: string | null;
-      /** @description User who created the join request. Present only in the list and detail responses, not in the request-access response. */
-      user?: {
+      /** @description User who created the join request, with the name and email stored when the request was made. */
+      user: {
         /** @example 1 */
         id: number;
         /** @example admin 1 */
@@ -6170,6 +6405,130 @@ type components = {
         };
       };
     };
+    /**
+     * @example {
+     *       "id": 123,
+     *       "key": "KBC.SomeEnity.metadataKey",
+     *       "value": "Some value",
+     *       "provider": "user",
+     *       "timestamp": "2021-02-17T15:05:21+0100"
+     *     }
+     */
+    ProjectMetadataResponse: {
+      /**
+       * @description Metadata identifier.
+       * @example 123
+       */
+      id: number;
+      /**
+       * @description Metadata key.
+       * @example KBC.SomeEnity.metadataKey
+       */
+      key: string;
+      /**
+       * @description Metadata value; null only for a row written outside the API.
+       * @example Some value
+       */
+      value: string | null;
+      /**
+       * @description Metadata provider.
+       * @example user
+       */
+      provider: string;
+      /**
+       * Format: date-time
+       * @description Time of the last change.
+       * @example 2021-02-17T15:05:21+0100
+       */
+      timestamp: string;
+    };
+    RestorableTableResponse: {
+      /**
+       * @description Bucket the table was dropped from.
+       * @example in.c-sales
+       */
+      bucketId: string;
+      /**
+       * @description Name of the dropped table.
+       * @example orders
+       */
+      tableName: string;
+      /**
+       * @description Identifier the table had.
+       * @example in.c-sales.orders
+       */
+      tableId: string;
+      /**
+       * @description When this version was dropped, in UTC with nanoseconds. Identifies the version to restore; pass it back unchanged.
+       * @example 2026-10-25T08:00:00.123456789Z
+       */
+      droppedOn: string;
+      /**
+       * Format: date-time
+       * @description End of the Time Travel retention of this version; it cannot be restored after that.
+       * @example 2026-11-01T08:00:00+0000
+       */
+      restorableUntil: string;
+      /**
+       * @description Time Travel retention of the table in days.
+       * @example 7
+       */
+      retentionTimeDays: number;
+      /**
+       * @description Rows of the table when it was dropped.
+       * @example 1234
+       */
+      rowsCount: number;
+      /**
+       * @description Size of the table when it was dropped.
+       * @example 56789
+       */
+      dataSizeBytes: number;
+      /**
+       * @description A table or alias with the same name exists in the bucket today, so the version can only be restored under another name.
+       * @example false
+       */
+      liveTableExists: boolean;
+      /**
+       * @description The bucket of the table does not exist today; it is listed under `buckets` and has to be restored first.
+       * @example false
+       */
+      bucketDropped: boolean;
+    };
+    RestorableBucketResponse: {
+      /**
+       * @description Identifier the dropped bucket had.
+       * @example in.c-sales
+       */
+      bucketId: string;
+      /**
+       * @description When this version was dropped, in UTC with nanoseconds. Identifies the version to restore; pass it back unchanged.
+       * @example 2026-10-25T08:00:00.123456789Z
+       */
+      droppedOn: string;
+      /**
+       * Format: date-time
+       * @description End of the Time Travel retention of this version; it cannot be restored after that.
+       * @example 2026-11-01T08:00:00+0000
+       */
+      restorableUntil: string;
+      /**
+       * @description Time Travel retention of the bucket in days.
+       * @example 7
+       */
+      retentionTimeDays: number;
+      /**
+       * @description A bucket with the same identifier exists today, so the version can only be restored under another name.
+       * @example false
+       */
+      liveBucketExists: boolean;
+    };
+    RestorableObjectsResponse: {
+      /** @description Dropped table versions, ordered by bucket, table and newest drop first. */
+      tables: components['schemas']['RestorableTableResponse'][];
+      /** @description Dropped bucket versions, ordered by bucket and newest drop first. The tables of a dropped bucket are listed only once the bucket is restored. */
+      buckets: components['schemas']['RestorableBucketResponse'][];
+    };
     ProjectRetentionWorkspaceResponse: {
       /**
        * @description Workspace identifier.
@@ -6228,6 +6587,92 @@ type components = {
         email: string;
       } | null;
     };
+    ProjectSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name prefix, `2` name substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 4088 */
+      id: number;
+      /** @example Sales reporting */
+      name: string;
+      organization: {
+        /** @example 123 */
+        id: number;
+        /** @example Acme */
+        name: string;
+      };
+      /** @description The project is disabled; it is still found. */
+      isDisabled: boolean;
+    };
+    OrganizationSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name prefix, `2` name substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 123 */
+      id: number;
+      /** @example Acme */
+      name: string;
+      maintainer: {
+        /** @example 1 */
+        id: number;
+        /** @example Keboola */
+        name: string | null;
+      };
+    };
+    MaintainerSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name prefix, `2` name substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 1 */
+      id: number;
+      /** @example Keboola */
+      name: string | null;
+    };
+    UserSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name or email prefix, `2` name or email substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 42 */
+      id: number;
+      /** @example John Doe */
+      name: string;
+      /** @example john.doe@keboola.com */
+      email: string;
+    };
+    SearchResponse: {
+      /** @description Projects matching `q`; absent when the caller may not read projects or `filter[types]` leaves them out. */
+      project?: {
+        data: components['schemas']['ProjectSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+      /** @description Organizations matching `q`; absent when the caller may not read organizations or `filter[types]` leaves them out. */
+      organization?: {
+        data: components['schemas']['OrganizationSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+      /** @description Maintainers matching `q`; absent when the caller may not read maintainers or `filter[types]` leaves them out. */
+      maintainer?: {
+        data: components['schemas']['MaintainerSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+      /** @description Users matching `q`; absent when the caller may not read users or `filter[types]` leaves them out. */
+      user?: {
+        data: components['schemas']['UserSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+    };
     StorageBackendResponse: {
       /** @description Root credentials identifier. */
       id: number;
@@ -6418,6 +6863,44 @@ type components = {
       serviceAccountEmail?: string | null;
       /** @description Detail endpoint only (absent on the list endpoint). Whether the BigQuery policy-tag capability is enabled on the backend. BigQuery backends only; absent otherwise. */
       policyTagsEnabled?: boolean;
+      /** @description Detail endpoint only (absent on the list endpoint). The stored BigQuery policy-tag capability, as `manage:storage-backend:policy-tags --status` prints it without its live taxonomy read. Always present on a BigQuery backend and absent on every other backend. Null when the capability was never configured; `policyTagsEnabled` is false both then and when it is disabled. Every key of the object is always present. */
+      policyTagCapability?: {
+        /** @enum {string} */
+        state: 'enabled' | 'disabled';
+        /**
+         * @description Custom role the customer granted for setting policy tags.
+         * @example projects/my-gov-project/roles/kbcPolicyTagSetter
+         */
+        roleName: string;
+        /**
+         * @description Taxonomy the role is granted on.
+         * @example projects/123456789/locations/us/taxonomies/987654321
+         */
+        resourceScope: string;
+        /**
+         * @description Policy tag the enablement probe attaches.
+         * @example projects/123456789/locations/us/taxonomies/987654321/policyTags/111
+         */
+        probeTag: string;
+        /**
+         * Format: date-time
+         * @description When the capability was enabled; null while it is disabled.
+         */
+        enabledAt: string | null;
+        /**
+         * Format: date-time
+         * @description Last probe run, successful or not; null when it never ran.
+         */
+        verifiedAt: string | null;
+        /** @description Operator of the last probe run. */
+        verifiedBy: string | null;
+        /** @description Error of the last probe run; null when it succeeded or never ran. */
+        lastVerificationError: string | null;
+        /** @description Whether the taxonomy enforces fine-grained access, as stored by the last enablement; null when not recorded. */
+        fineGrainedAccessEnforced: boolean | null;
+        /** @description Projects on this backend holding the `bigquery-policy-tags` feature. */
+        projectsWithFeature: number;
+      } | null;
     };
     StorageBackendListResponse: components['schemas']['StorageBackendDetailResponse'][];
     StorageBackendMaintainerListResponse: {
@@ -6611,6 +7094,8 @@ type components = {
       scripts: string[];
       /** @description List of style URLs. */
       styles: string[];
+      /** @description List of module URLs the entry script imports, for `<link rel="modulepreload">`. */
+      preloads: string[];
       /** @description Whether the application is marked as critical. */
       isCritical: boolean;
       /** @description Git commit SHA that produced this build. */
@@ -6626,6 +7111,7 @@ type components = {
       type: string | null;
       scripts: string[];
       styles: string[];
+      preloads: string[];
       isCritical: boolean;
       commitSha: string | null;
     }[];
@@ -6664,13 +7150,49 @@ type components = {
         name: string | null;
       };
     }[];
-    UserListOrganizationsResponse: {
-      organization: {
-        /** @example 1 */
-        id: number;
-        /** @example Keboola Tests */
-        name: string;
-      };
+    /**
+     * @example {
+     *       "id": 123,
+     *       "key": "KBC.SomeEnity.metadataKey",
+     *       "value": "Some value",
+     *       "provider": "user",
+     *       "timestamp": "2021-02-17T15:05:21+0100"
+     *     }
+     */
+    UserMetadataResponse: {
+      /**
+       * @description Metadata identifier.
+       * @example 123
+       */
+      id: number;
+      /**
+       * @description Metadata key.
+       * @example KBC.SomeEnity.metadataKey
+       */
+      key: string;
+      /**
+       * @description Metadata value; null only for a value stored outside the API.
+       * @example Some value
+       */
+      value: string | null;
+      /**
+       * @description Metadata provider.
+       * @example user
+       */
+      provider: string;
+      /**
+       * @description Last update timestamp (ISO 8601 with `+HHMM` offset).
+       * @example 2021-02-17T15:05:21+0100
+       */
+      timestamp: string;
+    };
+    UserListOrganizationsResponse: {
+      organization: {
+        /** @example 1 */
+        id: number;
+        /** @example Keboola Tests */
+        name: string;
+      };
       /**
        * Format: date-time
        * @example 2014-11-11T08:40:51+00:00
@@ -6740,6 +7262,25 @@ type components = {
        */
       state: string;
     };
+    X402TopUpQuoteResponse: {
+      /** @example payment_required */
+      error: string;
+      /**
+       * @description The quoted amount in USD.
+       * @example 42.00
+       */
+      amountUsd: string;
+      /**
+       * @description The credits the payment buys.
+       * @example 5
+       */
+      credits: number;
+      /**
+       * @description USD per credit: the card credit price, the credits are `amountUsd / creditPriceUsd`.
+       * @example 8.40
+       */
+      creditPriceUsd: string;
+    };
     SetUpBigQueryResponse: {
       /** @description Job ID. */
       id: number;
@@ -8373,7 +8914,7 @@ interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description List of admins with the feature assigned. */
+      /** @description List of admins with the feature assigned, ordered by admin ID. */
       200: {
         headers: {
           [name: string]: unknown;
@@ -8388,23 +8929,7 @@ interface operations {
            *       }
            *     ]
            */
-          'application/json': {
-            /**
-             * @description Admin identifier.
-             * @example 1
-             */
-            id: number;
-            /**
-             * @description Admin name.
-             * @example Test user
-             */
-            name: string;
-            /**
-             * @description Admin email address.
-             * @example test@example.com
-             */
-            email: string;
-          }[];
+          'application/json': components['schemas']['FeatureAdminListResponse'];
         };
       };
       /** @description Returned when the Manage token is missing or invalid. */
@@ -8459,22 +8984,22 @@ interface operations {
            *         "type": "admin",
            *         "title": "Show new design",
            *         "description": "Users with this feature will see new UI",
-           *         "created": "2016-04-28T15:24:51.620Z"
+           *         "created": "2016-04-28T15:24:51+0200"
            *       }
            *     ]
            */
           'application/json': components['schemas']['FeatureListResponse'];
         };
       };
-      /** @description Returned when the Manage token is missing or invalid. */
-      401: {
+      /** @description Returned when request parameters are invalid. */
+      400: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
-      /** @description Returned when request parameters are invalid. */
-      422: {
+      /** @description Returned when the Manage token is missing or invalid. */
+      401: {
         headers: {
           [name: string]: unknown;
         };
@@ -8510,7 +9035,7 @@ interface operations {
            *       "description": "Users with this feature will see new UI",
            *       "canBeManageByAdmin": false,
            *       "canBeManagedViaAPI": true,
-           *       "created": "2016-04-28T15:24:51.620Z"
+           *       "created": "2016-04-28T15:24:51+0200"
            *     }
            */
           'application/json': components['schemas']['FeatureResponse'];
@@ -8567,7 +9092,7 @@ interface operations {
            *       "type": "admin",
            *       "title": "Show new design",
            *       "description": "Users with this feature will see new UI",
-           *       "created": "2016-04-28T15:24:51.620Z"
+           *       "created": "2016-04-28T15:24:51+0200"
            *     }
            */
           'application/json': components['schemas']['FeatureResponse'];
@@ -8668,7 +9193,7 @@ interface operations {
            *       "description": "Users with this feature will see new UI",
            *       "canBeManageByAdmin": false,
            *       "canBeManagedViaAPI": true,
-           *       "created": "2016-04-28T15:24:51.620Z"
+           *       "created": "2016-04-28T15:24:51+0200"
            *     }
            */
           'application/json': components['schemas']['FeatureResponse'];
@@ -8813,7 +9338,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token does not have admin privileges or the current admin is not a super admin. */
+      /** @description Returned when the caller is not a super admin and does not hold can-manage-maintainers. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -9268,7 +9793,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token does not have admin privileges or the current admin is not a super admin. */
+      /** @description Returned when the caller is not a super admin and does not hold can-manage-maintainers. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -9339,7 +9864,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token does not have admin privileges. Superuser credentials are not required for storage registration. */
+      /** @description Returned when the Manage token does not have admin privileges, or when a session token belongs to an admin who is not a super admin. Superuser credentials are not required for registration with a personal access token. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -9486,7 +10011,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the Manage token does not have admin privileges or the current admin is not a super admin. */
+      /** @description Returned when the caller is not a super admin and does not hold can-manage-maintainers. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -9684,7 +10209,23 @@ interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    /** @description Optional, display-only. A missing, malformed or unusable body never fails the exchange; the name is then simply not stored. */
+    requestBody?: {
+      content: {
+        'application/json': {
+          /**
+           * @description OAuth client row of the app the login is for. The name is stored only for the active `local-mcp-client` row with loopback-only callbacks.
+           * @example local-mcp-client
+           */
+          app_client_id?: string;
+          /**
+           * @description Name the local MCP client reported for itself; not verified by Keboola. Sanitised and capped at 48 characters, returned as `reportedClientName` by `GET /v1/auth/sessions`.
+           * @example Codex
+           */
+          reported_client_name?: string;
+        };
+      };
+    };
     responses: {
       /** @description Programmatic session issued. */
       200: {
@@ -11209,14 +11750,7 @@ interface operations {
            *       }
            *     ]
            */
-          'application/json': (components['schemas']['UserMembershipResponse'] | {
-            /** @example 23423 */
-            id: number;
-            /** @example Martin Halamicek */
-            name: string;
-            /** @example martin@keboola.com */
-            email: string;
-          })[];
+          'application/json': (components['schemas']['UserMembershipResponse'] | components['schemas']['OrganizationAdministratorReferenceResponse'])[];
         };
       };
       /** @description Returned when MFA is required. */
@@ -12195,42 +12729,13 @@ interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description List of organization metadata. */
+      /** @description List of organization metadata, ordered by provider, then key. */
       200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          /**
-           * @example [
-           *       {
-           *         "id": 123,
-           *         "provider": "user",
-           *         "timestamp": "2021-02-17T15:05:21+0100",
-           *         "key": "KBC.SomeEnity.metadataKey",
-           *         "value": "Some value"
-           *       },
-           *       {
-           *         "id": 124,
-           *         "provider": "user",
-           *         "timestamp": "2021-02-17T15:05:21+0100",
-           *         "key": "someMetadataKey",
-           *         "value": "Some value"
-           *       }
-           *     ]
-           */
-          'application/json': {
-            /** @example 123 */
-            id: number;
-            /** @example user */
-            provider: string;
-            /** @example 2021-02-17T15:05:21+0100 */
-            timestamp: string;
-            /** @example KBC.SomeEnity.metadataKey */
-            key: string;
-            /** @example Some value */
-            value: string;
-          }[];
+          'application/json': components['schemas']['OrganizationMetadataResponse'][];
         };
       };
       /** @description Returned when the organization requires MFA and the current user does not have MFA enabled. */
@@ -12380,7 +12885,7 @@ interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description List of users across projects in the organization. */
+      /** @description Users who are members of at least one not deleted project in the organization, one entry per user, ordered by e-mail. */
       200: {
         headers: {
           [name: string]: unknown;
@@ -12400,14 +12905,7 @@ interface operations {
            *       }
            *     ]
            */
-          'application/json': {
-            /** @example 123 */
-            id: number;
-            /** @example test user */
-            name: string;
-            /** @example martin@keboola.com */
-            email: string;
-          }[];
+          'application/json': components['schemas']['OrganizationProjectUserResponse'][];
         };
       };
       /** @description Returned when the organization requires MFA and the current user does not have MFA enabled. */
@@ -12424,7 +12922,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the token does not have permission to list project users. */
+      /** @description Returned when the user has no access to the organization, or has access only as a super admin or a maintainer member and is not a member of the organization. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -13186,7 +13684,13 @@ interface operations {
           [name: string]: unknown;
         };
         content: {
-          'application/json': components['schemas']['ProjectResponse'];
+          'application/json': components['schemas']['ProjectResponse'] & {
+            /** @description Present only when the feature was added but needs attention: `bigquery-policy-tags` in a project of a taxonomy that enforces fine-grained access, whose service account cannot read the protected data (`manage.feature.policyTagsReaderMissing`) or could not be checked (`manage.feature.policyTagsReaderNotVerified`). */
+            warnings?: {
+              code?: string;
+              message?: string;
+            }[];
+          };
         };
       };
       /** @description Returned when the Manage token is missing or invalid. */
@@ -13248,6 +13752,13 @@ interface operations {
           'application/json': components['schemas']['ProjectJoinRequestDetailResponse'];
         };
       };
+      /** @description Returned when the project requires MFA and the current user does not have MFA enabled. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
         headers: {
@@ -13539,6 +14050,13 @@ interface operations {
           'application/json': components['schemas']['ProjectInvitationDetailResponse'];
         };
       };
+      /** @description Returned when the project requires MFA and the current user does not have MFA enabled. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
         headers: {
@@ -13837,6 +14355,13 @@ interface operations {
           'application/json': components['schemas']['ProjectInvitationDetailResponse'][];
         };
       };
+      /** @description Returned when the project requires MFA and the current user does not have MFA enabled. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
         headers: {
@@ -14572,6 +15097,13 @@ interface operations {
           'application/json': components['schemas']['ProjectJoinRequestDetailResponse'][];
         };
       };
+      /** @description Returned when the project requires MFA and the current user does not have MFA enabled. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
         headers: {
@@ -14610,43 +15142,21 @@ interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description List of project metadata. */
+      /** @description List of project metadata, ordered by provider, then key. */
       200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          /**
-           * @example [
-           *       {
-           *         "id": 123,
-           *         "provider": "user",
-           *         "timestamp": "2021-02-17T15:05:21+0100",
-           *         "key": "KBC.SomeEnity.metadataKey",
-           *         "value": "Some value"
-           *       },
-           *       {
-           *         "id": 124,
-           *         "provider": "user",
-           *         "timestamp": "2021-02-17T15:05:21+0100",
-           *         "key": "someMetadataKey",
-           *         "value": "Some value"
-           *       }
-           *     ]
-           */
-          'application/json': {
-            /** @example 123 */
-            id: number;
-            /** @example user */
-            provider: string;
-            /** @example 2021-02-17T15:05:21+0100 */
-            timestamp: string;
-            /** @example KBC.SomeEnity.metadataKey */
-            key: string;
-            /** @example Some value */
-            value: string;
-          }[];
+          'application/json': components['schemas']['ProjectMetadataResponse'][];
+        };
+      };
+      /** @description Returned when the project requires MFA and the current user does not have MFA enabled. */
+      400: {
+        headers: {
+          [name: string]: unknown;
         };
+        content?: never;
       };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
@@ -14773,6 +15283,66 @@ interface operations {
       };
     };
   };
+  'get_/manage/projects/{projectId}/restorable-objects::ProjectListRestorableObjectsAction': {
+    parameters: {
+      query?: {
+        /**
+         * @description Only list the dropped tables of this existing bucket. Dropped buckets are then not listed. Linked, external-schema and non-Snowflake buckets have nothing in Time Travel and return 404.
+         * @example in.c-sales
+         */
+        bucketId?: string;
+      };
+      header?: never;
+      path: {
+        /**
+         * @description Identifier of the project.
+         * @example 4088
+         */
+        projectId: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Dropped tables and buckets that can be restored. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['RestorableObjectsResponse'];
+        };
+      };
+      /** @description Returned when the project has no Snowflake storage. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the Manage token is missing or invalid. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the current admin is neither a super admin nor holds the can-restore-tables feature. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the project, or the bucket given in `bucketId`, does not exist. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'get_/manage/projects/{projectId}/workspaces::ProjectListRetentionWorkspacesAction': {
     parameters: {
       query?: {
@@ -15094,7 +15664,7 @@ interface operations {
            *       }
            *     }
            */
-          'application/json': components['schemas']['ProjectJoinRequestDetailResponse'];
+          'application/json': components['schemas']['ProjectJoinRequestResponse'];
         };
       };
       /** @description Returned when the request body is invalid or the user is not activated. */
@@ -15448,26 +16018,137 @@ interface operations {
       };
     };
   };
-  'post_/manage/storage-backend/{backendId}/activate::StorageBackendActivateAction': {
+  'get_/manage/search::SearchAction': {
     parameters: {
-      query?: never;
-      header?: never;
-      path: {
+      query: {
         /**
-         * @description Backend ID.
-         * @example 123
+         * @description Search term: 2 to 255 characters after trimming. An all-digit term also matches by exact `id`.
+         * @example acme
          */
-        backendId: number;
-      };
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description Snowflake storage backend activated successfully. The backend is now ready for use. */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
+        q: string;
+        /**
+         * @description Pagination: `page[limit]` (default 10, maximum 50) and `page[after]`, the cursor of the last row read — base64url(json) of `{"rank": integer, "id": integer}`, rows ordered `rank ASC, id DESC`. Omit `page[after]` for the first page; `links.next` carries the next one.
+         * @example {
+         *       "limit": 10
+         *     }
+         */
+        page?: {
+          /** @description base64url(json) of `{"rank": integer, "id": integer}`. */
+          after?: string;
+          /** @default 10 */
+          limit?: number;
+        };
+        /** @description Filters, JSON:API style: `filter[<name>]=<value>`. Filters combine with AND. */
+        filter?: {
+          /**
+           * @description Comma-separated subset of `project`, `organization`, `maintainer`, `user`; omitted, every type the caller may read.
+           * @example project,organization
+           */
+          types?: string;
+        };
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Hits grouped by type; only the types the caller may read and asked for are present. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          /**
+           * @example {
+           *       "project": {
+           *         "data": [
+           *           {
+           *             "rank": 1,
+           *             "id": 4088,
+           *             "name": "Acme reporting",
+           *             "organization": {
+           *               "id": 123,
+           *               "name": "Acme"
+           *             },
+           *             "isDisabled": false
+           *           }
+           *         ],
+           *         "meta": {
+           *           "total": 1,
+           *           "limit": 10,
+           *           "cursor": {
+           *             "param": "page[after]",
+           *             "encoding": "base64url(json)",
+           *             "fields": [
+           *               {
+           *                 "name": "rank",
+           *                 "type": "integer",
+           *                 "nullable": false
+           *               },
+           *               {
+           *                 "name": "id",
+           *                 "type": "integer",
+           *                 "nullable": false
+           *               }
+           *             ],
+           *             "order": "rank ASC, id DESC"
+           *           }
+           *         },
+           *         "links": {
+           *           "self": "https://connection.keboola.com/manage/search?q=acme&filter[types]=project&page[limit]=10",
+           *           "first": "https://connection.keboola.com/manage/search?q=acme&filter[types]=project&page[limit]=10",
+           *           "next": null
+           *         }
+           *       }
+           *     }
+           */
+          'application/json': components['schemas']['SearchResponse'];
+        };
+      };
+      /** @description Returned when `q`, `filter[types]` or the `page` parameters are invalid. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the Manage token is missing or invalid. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the token is not an admin or session token, or its admin may search no type. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/manage/storage-backend/{backendId}/activate::StorageBackendActivateAction': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /**
+         * @description Backend ID.
+         * @example 123
+         */
+        backendId: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Snowflake storage backend activated successfully. The backend is now ready for use. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
         content: {
           /**
            * @example {
@@ -15948,7 +16629,7 @@ interface operations {
         /** @description Guide format. */
         format?: 'markdown' | 'terraform';
         /**
-         * @description GCP project ID that holds the custom roles, and the new taxonomy when `createTaxonomy` is true.
+         * @description GCP project ID that holds the custom setter role, and the new taxonomy when `createTaxonomy` is true.
          * @example acme-data-governance
          */
         roleProject: string;
@@ -16028,7 +16709,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the backend has no valid stored service account or region to render the guide from. */
+      /** @description Returned when the backend has no valid stored service account, region or BigQuery folder to render the guide from. */
       409: {
         headers: {
           [name: string]: unknown;
@@ -16376,6 +17057,7 @@ interface operations {
            *           "https://kbc-uis.s3.amazonaws.com/kbc.manageApps/0.0.3-33-ga6bc947/styles/libs.css",
            *           "https://kbc-uis.s3.amazonaws.com/kbc.manageApps/0.0.3-33-ga6bc947/styles/select2.png"
            *         ],
+           *         "preloads": [],
            *         "isCritical": false,
            *         "commitSha": "a6bc947f1e2d3c4b5a6bc947f1e2d3c4b5a6bc94"
            *       }
@@ -16619,14 +17301,14 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the current admin cannot access the user. */
+      /** @description Returned with code `manage.users.cannotAccessOtherUsers` when the current admin is neither a super admin nor has the `can-manage-users` feature, also for their own user and for an unknown one. */
       403: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
-      /** @description Returned when the user does not exist. */
+      /** @description Returned with code `manage.user.notFound` when the user does not exist. */
       404: {
         headers: {
           [name: string]: unknown;
@@ -16739,6 +17421,13 @@ interface operations {
         };
         content?: never;
       };
+      /** @description Returned when the user cannot be removed from one of their organizations or maintainers (its last member), or when the current admin is not activated and the user has a project invitation. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Returned when the Manage token is missing or invalid. */
       401: {
         headers: {
@@ -16746,7 +17435,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the current admin has no privilege to delete other users. */
+      /** @description Returned when the current admin has no privilege to delete other users, or when a non-super-admin deletes a super admin. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -16951,47 +17640,21 @@ interface operations {
            * @example [
            *       {
            *         "id": 123,
-           *         "provider": "user",
-           *         "timestamp": "2021-02-17T15:05:21+0100",
            *         "key": "KBC.SomeEnity.metadataKey",
-           *         "value": "Some value"
+           *         "value": "Some value",
+           *         "provider": "user",
+           *         "timestamp": "2021-02-17T15:05:21+0100"
            *       },
            *       {
            *         "id": 124,
-           *         "provider": "user",
-           *         "timestamp": "2021-02-17T15:05:21+0100",
            *         "key": "someMetadataKey",
-           *         "value": "Some value"
+           *         "value": "Some value",
+           *         "provider": "user",
+           *         "timestamp": "2021-02-17T15:05:21+0100"
            *       }
            *     ]
            */
-          'application/json': {
-            /**
-             * @description Metadata identifier.
-             * @example 123
-             */
-            id: number;
-            /**
-             * @description Metadata provider.
-             * @example user
-             */
-            provider: string;
-            /**
-             * @description Last update timestamp.
-             * @example 2021-02-17T15:05:21+0100
-             */
-            timestamp: string;
-            /**
-             * @description Metadata key.
-             * @example KBC.SomeEnity.metadataKey
-             */
-            key: string;
-            /**
-             * @description Metadata value.
-             * @example Some value
-             */
-            value: string;
-          }[];
+          'application/json': components['schemas']['UserMetadataResponse'][];
         };
       };
       /** @description Returned when the Manage token is missing or invalid. */
@@ -17001,7 +17664,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Returned when the user does not exist. */
+      /** @description Returned with code `manage.user.notFound` when the user does not exist, or when the token may not access the user. */
       404: {
         headers: {
           [name: string]: unknown;
@@ -17482,6 +18145,15 @@ interface operations {
             description: string | null;
             invoiceTopUpType: string | null;
             stripeInvoiceStatus: string | null;
+            /** @description Provider of a non-Stripe-invoice payment, `x402-base` for an x402 top-up; null otherwise. */
+            paymentProvider: string | null;
+            /**
+             * @description State of an x402 top-up; only `settled` rows count as purchased credits. Null on other rows.
+             * @enum {string|null}
+             */
+            paymentStatus: 'pending' | 'settled' | 'expired' | null;
+            /** @description On-chain transaction hash of a settled x402 top-up; null otherwise. */
+            externalPaymentId: string | null;
             /** Format: date-time */
             created: string;
           }[];
@@ -17919,6 +18591,129 @@ interface operations {
       };
     };
   };
+  'post_/pay-as-you-go/x402/projects/{projectId}/credits::X402TopUpAction': {
+    parameters: {
+      query: {
+        /**
+         * @description The amount to pay in USD, tax-inclusive, with at most two decimals and within the stack's minimum and maximum. The credits are the amount divided by the stack's credit price.
+         * @example 25.00
+         */
+        amountUsd: string;
+      };
+      header?: {
+        /** @description Base64 JSON x402 V2 `PaymentPayload` of an `exact` EVM payment for exactly the requirements from `PAYMENT-REQUIRED`, with the `payment-identifier` extension. Omit it to get the payment requirements. */
+        'PAYMENT-SIGNATURE'?: string;
+      };
+      path: {
+        /** @description The pay-as-you-go project to credit. */
+        projectId: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The payment is settled and the credits are added. */
+      200: {
+        headers: {
+          /** @description Base64 JSON x402 `SettlementResponse` with `success`, `transaction` and `network`. */
+          'PAYMENT-RESPONSE'?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            id: number;
+            idProject: number;
+            creditsAmount: number;
+            /** @description The amount paid in USD cents. */
+            moneyAmount: number;
+            idStripeInvoice: string | null;
+            urlStripeInvoice: string | null;
+            description: string | null;
+            /** @example x402 */
+            invoiceTopUpType: string;
+            stripeInvoiceStatus: string | null;
+            /** @example x402-base */
+            paymentProvider: string;
+            /** @example settled */
+            paymentStatus: string;
+            /** @description On-chain transaction hash of the settled payment. */
+            externalPaymentId: string;
+            /** Format: date-time */
+            created: string;
+          };
+        };
+      };
+      /** @description Invalid `amountUsd` (`x402.invalidAmount`), a `PAYMENT-SIGNATURE` that does not decode or does not match the requirements (`x402.invalidPaymentSignature`), a missing `payment-identifier` (`x402.paymentIdentifierMissing`), or a project without pay-as-you-go. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Payment required: the call carried no payment (`error: payment_required`), or the facilitator rejected the payment or it expired (`x402.paymentRejected`, reason in `params.reason`). Sign a new payment for the requirements in `PAYMENT-REQUIRED`. */
+      402: {
+        headers: {
+          /** @description Base64 JSON x402 V2 `PaymentRequired`: the resource, one `exact` requirement (network, USDC asset, amount in atomic units, recipient) and the required `payment-identifier` extension. */
+          'PAYMENT-REQUIRED'?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['X402TopUpQuoteResponse'] | {
+            /** @description The error message. */
+            error: string;
+            /** @example x402.paymentRejected */
+            code: string;
+            /** @description Includes `reason`, the facilitator reason or `expired`. */
+            params?: Record<string, never>;
+          };
+        };
+      };
+      /** @description No valid token credential, a browser session cookie or a personal access token, or no access to the project. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description The project does not exist, or pay-as-you-go or the x402 top-up is not enabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description The project is an unconfirmed agent project (`x402.agentProjectUnclaimed`), the `payment-identifier` or the authorization is recorded for another payment (`x402.paymentIdentifierConflict`), or another top-up of the project is in progress (`x402.topUpInProgress`). */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many x402 top-up requests by the admin or for the project (`x402.rateLimited`). */
+      429: {
+        headers: {
+          'Retry-After'?: number;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description The facilitator failed to verify the payment (`x402.facilitatorUnavailable`). Nothing was recorded and no money moved; a retry is safe. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description The settlement outcome is not known yet (`x402.settlementPending`). Retry the same request with the same `payment-identifier` after `Retry-After`; do not sign a new payment. Also answered when the card credit price cannot be read (`x402.creditPriceUnavailable`): for a quote, for the first request with a payment whose identifier has nothing recorded, or for the 402 of an expired payment, whose `PAYMENT-REQUIRED` needs the current price. Nothing was recorded and no money moved; retry the same request, with the same `payment-identifier` if it carried a payment, after `Retry-After`. */
+      503: {
+        headers: {
+          'Retry-After'?: number;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   post_keboola_integration_partners_gcp_project_bigquery_bigquerysetupaction__invoke: {
     parameters: {
       query?: never;
@@ -18225,237 +19020,93 @@ type CreatePaymentRequestBody = OpenapiBodyType<paths['/pay-as-you-go/billing/cr
 type ProgrammaticProjectClaim = OpenapiReturnType<paths['/manage/programmatic-projects/claim']['get']>;
 type ConfirmProgrammaticProjectBody = OpenapiBodyType<paths['/manage/programmatic-projects/confirm']['post']>;
 type ConfirmProgrammaticProjectResult = OpenapiReturnType<paths['/manage/programmatic-projects/confirm']['post']>;
-type AddUserFeaturePath = {
-  userIdOrMail: string;
-};
-type AddUserFeatureBody = {
-  feature: string;
-};
-type RemoveUserFeaturePath = {
-  userIdOrMail: string;
-  feature: string;
-};
-type ProjectUsersResponse = OpenapiReturnType<paths['/manage/projects/{projectId}/users']['get']>;
-type User = {
-  id: number;
-  name: string;
-  email: string;
-  mfaEnabled: boolean;
-  features: string[];
-  canAccessLogs: boolean;
-  role: 'guest' | 'readOnly' | 'admin' | 'share' | 'productionManager' | 'developer' | 'reviewer';
-  isSuperAdmin: boolean;
-  canApproveMergeRequests: boolean;
-  /** Project users only; older stacks and other user endpoints omit this field. */
-  isOrganizationMember?: ProjectUsersResponse[number]['isOrganizationMember'];
-};
-type UserDetail = components['schemas']['UserResponse'];
-type UserListItem = components['schemas']['UserListResponse'][number];
-type UserOrganizationMembership = components['schemas']['UserListOrganizationsResponse'][number];
-type UserProjectMembership = components['schemas']['UserListProjectsResponse'][number];
-type UserMaintainerMembership = components['schemas']['UserListMaintainersResponse'][number];
-type GetUsersQuery = NonNullable<operations['get_/manage/users::UserListAction']['parameters']['query']>;
-/** The schema path parameter is `idOrEmail`; these methods take a numeric `id`, as their neighbours do. */
-type UserPath = {
-  id: number;
-};
-type UpdateUserBody = OpenapiBodyType<paths['/manage/users/{idOrEmail}']['put']>;
-type UpdateUserInput = UserPath & UpdateUserBody;
-type SetUserMetadataBody = components['schemas']['MetadataRequest'];
-type SetUserMetadataInput = UserPath & SetUserMetadataBody;
-type DeleteUserMetadataPath = UserPath & {
-  metadataId: number;
-};
-type UpdateProjectBody = components['schemas']['ProjectUpdateRequest'];
-type ProjectTemplate = components['schemas']['ProjectTemplateResponse'];
-type MoveProjectBody = paths['/manage/projects/{projectId}/organizations']['post']['requestBody']['content']['application/json'];
-/** Body for POST /manage/projects/{projectId}/disabled — hand-written, no schema entry.
- * The backend 400s without `disableReason` when disabling. */
-type SetProjectDisabledBody = {
-  isDisabled: true;
-  disableReason: string;
-  estimatedEndTime?: string;
-} | {
-  isDisabled: false;
-};
-/** Super admins may set any limit; `can-manage-project-limits` admins only a whitelisted subset. */
-type SetProjectLimitsBody = {
-  limits: {
-    name: string;
-    value: number;
-  }[];
-};
 type GetProjectPath = {
   projectId: number | string;
 };
+type Project = OpenapiReturnType<paths['/manage/projects/{projectId}']['get']>;
+type UpdateProjectPath = OpenapiPathType<paths['/manage/projects/{projectId}']['put']>;
+type UpdateProjectBody = OpenapiBodyType<paths['/manage/projects/{projectId}']['put']>;
+type UpdateProjectInput = UpdateProjectPath & UpdateProjectBody;
+type MoveProjectPath = OpenapiPathType<paths['/manage/projects/{projectId}/organizations']['post']>;
+type MoveProjectBody = OpenapiBodyType<paths['/manage/projects/{projectId}/organizations']['post']>;
+type MoveProjectInput = MoveProjectPath & MoveProjectBody;
+type SetProjectDisabledPath = OpenapiPathType<paths['/manage/projects/{projectId}/disabled']['post']>;
+type SetProjectDisabledBody = OpenapiBodyType<paths['/manage/projects/{projectId}/disabled']['post']>;
+type SetProjectDisabledInput = SetProjectDisabledPath & SetProjectDisabledBody;
+type SetProjectLimitsPath = OpenapiPathType<paths['/manage/projects/{projectId}/limits']['post']>;
+/** Super admins may set any limit; `can-manage-project-limits` admins only a whitelisted subset. */
+type SetProjectLimitsBody = OpenapiBodyType<paths['/manage/projects/{projectId}/limits']['post']>;
+type SetProjectLimitsInput = SetProjectLimitsPath & SetProjectLimitsBody;
+type RemoveProjectLimitPath = OpenapiPathType<paths['/manage/projects/{projectId}/limits/{limitName}']['delete']>;
+type CreateProjectFeaturePath = OpenapiPathType<paths['/manage/projects/{projectId}/features']['post']>;
+type CreateProjectFeatureBody = OpenapiBodyType<paths['/manage/projects/{projectId}/features']['post']>;
+type CreateProjectFeatureInput = CreateProjectFeaturePath & CreateProjectFeatureBody;
+type ProjectFeatureWarning = NonNullable<OpenapiReturnType<paths['/manage/projects/{projectId}/features']['post']>['warnings']>[number];
+type RemoveProjectFeaturePath = OpenapiPathType<paths['/manage/projects/{projectId}/features/{feature}']['delete']>;
 type ListProjectUsersPath = {
   projectId: number | string;
 };
-type CreateProjectFeaturePath = {
-  projectId: number;
-};
-type CreateProjectFeatureBody = {
-  feature: string;
-};
-type RemoveProjectFeaturePath = {
-  projectId: number;
-  feature: string;
-};
-type ProjectLimit = {
-  name: string;
-  value: number;
-};
-type ProjectOrganization = {
-  id: number;
-  name: string;
-  created: string;
-  allowAutoJoin: boolean;
-  crmId: string;
-  activityCenterProjectId: number | null;
-  mfaRequired: boolean;
-};
-type ProjectFileStorage = {
-  id: number;
-  accountName: string;
-  region: string;
-  containerName: string;
-  provider: string;
-  owner: string;
-  isDefault: boolean;
-  created: string;
-  creator: {
-    id: number;
-    name: string;
-  };
-};
-type ProjectBackends = Record<string, {
-  id: number;
-  host: string;
-  region: string;
-  owner: string;
-}>;
-type GetProjectMetadataPath = {
-  projectId: number;
-};
-type SetProjectMetadataPath = {
-  projectId: number;
-};
-type ProjectMetadataItem = OpenapiReturnType<paths['/manage/projects/{projectId}/metadata']['get']>[number];
-type SetProjectMetadataBody = components['schemas']['MetadataRequest'];
-type ProjectMetadataInput = SetProjectMetadataBody['metadata'][number];
-type GetProjectReviewersPath = {
-  projectId: number;
-};
-type Reviewer = {
-  id: number;
-  name: string;
-  email: string;
-};
-type SetProjectReviewersPath = {
+type ProjectMember = OpenapiReturnType<paths['/manage/projects/{projectId}/users']['get']>[number];
+type AddProjectUserPath = OpenapiPathType<paths['/manage/projects/{projectId}/users']['post']>;
+type AddProjectUserBody = OpenapiBodyType<paths['/manage/projects/{projectId}/users']['post']>;
+type AddProjectUserInput = AddProjectUserPath & AddProjectUserBody;
+type RemoveProjectUserPath = {
   projectId: number;
+  idOrEmail: number | string;
 };
-type SetProjectReviewersBody = {
-  adminIds: number[];
-};
-type ListProjectInvitationsPath = {
-  projectId: number | string;
-};
-type ProjectInvitationDetail = components['schemas']['ProjectInvitationDetailResponse'];
+type ChangeProjectUserRolePath = OpenapiPathType<paths['/manage/projects/{projectId}/users/{userId}']['patch']>;
+type ChangeProjectUserRoleBody = OpenapiBodyType<paths['/manage/projects/{projectId}/users/{userId}']['patch']>;
+type ChangeProjectUserRoleInput = ChangeProjectUserRolePath & ChangeProjectUserRoleBody;
 /** The roles a non-SOX project offers on invite / add; a SOX project offers
  * `productionManager`, `developer` and `reviewer` instead. */
-type ProjectInvitableRole = 'admin' | 'guest' | 'readOnly' | 'share';
-type CreateProjectInvitationPath = {
-  projectId: number;
-};
-type CreateProjectInvitationBody = {
-  email: string;
-  role?: User['role'];
-  /** Seconds until the invitation and the resulting membership expire. */
-  expirationSeconds?: number;
-  /** `ui_apps` key the invitation leads to instead of the project; honoured only with the
-   * matching project feature, else (and on stacks unaware of it) the ordinary email is sent. */
-  landingApp?: 'business-workspace';
-};
-type DeleteProjectInvitationPath = {
-  projectId: number;
-  invitationId: number;
-};
-type AddProjectUserPath = {
-  projectId: number;
-};
-type AddProjectUserBody = {
-  email: string;
-  role?: ProjectInvitableRole;
-};
-type RemoveProjectUserPath = {
-  projectId: number;
-  idOrEmail: number | string;
+type ProjectInvitableRole = Exclude<NonNullable<AddProjectUserBody['role']>, 'productionManager' | 'developer' | 'reviewer'>;
+type ListProjectInvitationsPath = {
+  projectId: number | string;
 };
+type CreateProjectInvitationPath = OpenapiPathType<paths['/manage/projects/{projectId}/invitations']['post']>;
+type CreateProjectInvitationBody = OpenapiBodyType<paths['/manage/projects/{projectId}/invitations']['post']>;
+type CreateProjectInvitationInput = CreateProjectInvitationPath & CreateProjectInvitationBody;
+type GetProjectInvitationPath = OpenapiPathType<paths['/manage/projects/{projectId}/invitations/{invitationId}']['get']>;
+type ProjectInvitationDetail = OpenapiReturnType<paths['/manage/projects/{projectId}/invitations/{invitationId}']['get']>;
+type DeleteProjectInvitationPath = OpenapiPathType<paths['/manage/projects/{projectId}/invitations/{invitationId}']['delete']>;
 type ListProjectJoinRequestsPath = {
   projectId: number | string;
 };
-type ProjectJoinRequestDetail = components['schemas']['ProjectJoinRequestDetailResponse'];
-type ProjectJoinRequestPath = {
-  projectId: number;
-  joinRequestId: number;
-};
-/** Returned by `updateProject`, `moveProject` and `setProjectDisabled`;
- * the detail and `setProjectLimits` return the richer {@link Project}. */
-type ProjectBase = Omit<components['schemas']['ProjectResponse'], 'limits' | 'metrics'> & {
-  limits: Record<string, ProjectLimit>;
-  metrics: Record<string, unknown>;
-};
-/** A warning the API attaches to a feature it added but that needs attention. */
-type ProjectFeatureWarning = {
-  code?: string;
-  message?: string;
-};
-/**
- * Returned by `addProjectFeature`: the project, plus `warnings` when the added feature needs attention.
- *
- * - `warnings` is in the live manage OpenAPI (connection #9057) but not yet in the committed schema.
- * - Drop this overlay once a schema regen brings it in.
- */
-type ProjectWithFeatureWarnings = ProjectBase & {
-  warnings?: ProjectFeatureWarning[];
-};
-/**
- * `ProjectDetailResponse` with the parts the swagger under-models replaced:
- * - `fileStorage` is documented S3-only, so ABS/GCS projects don't fit it
- * - `backends` is documented as `{ snowflake }` only
- * - `organization` is missing `mfaRequired`
- * - `usersCount` isn't documented
- */
-type Project = Omit<components['schemas']['ProjectDetailResponse'], 'organization' | 'fileStorage' | 'backends' | 'limits' | 'metrics'> & {
-  organization: ProjectOrganization;
-  fileStorage: ProjectFileStorage;
-  backends: ProjectBackends;
-  limits: Record<string, ProjectLimit>;
-  metrics: Record<string, unknown>;
-  usersCount?: number;
-};
-type ProjectTemplatePath = OpenapiPathType<paths['/manage/project-templates/{templateId}']['get']>;
-type AssignFeatureBody = components['schemas']['AssignFeatureRequest'];
-type AssignProjectTemplateFeatureInput = ProjectTemplatePath & AssignFeatureBody;
-type RemoveProjectTemplateFeaturePath = OpenapiPathType<paths['/manage/project-templates/{templateId}/features/{featureName}']['delete']>;
-type ProjectPath = OpenapiPathType<paths['/manage/projects/{projectId}']['put']>;
+type GetProjectJoinRequestPath = OpenapiPathType<paths['/manage/projects/{projectId}/join-requests/{joinRequestId}']['get']>;
+type ProjectJoinRequestDetail = OpenapiReturnType<paths['/manage/projects/{projectId}/join-requests/{joinRequestId}']['get']>;
+type ApproveProjectJoinRequestPath = OpenapiPathType<paths['/manage/projects/{projectId}/join-requests/{joinRequestId}']['put']>;
+type RejectProjectJoinRequestPath = OpenapiPathType<paths['/manage/projects/{projectId}/join-requests/{joinRequestId}']['delete']>;
+type JoinProjectPath = OpenapiPathType<paths['/manage/projects/{projectId}/join-project']['post']>;
 type JoinProjectBody = OpenapiBodyType<paths['/manage/projects/{projectId}/join-project']['post']>;
-type JoinProjectInput = ProjectPath & JoinProjectBody;
+type JoinProjectInput = JoinProjectPath & JoinProjectBody;
+type RequestProjectAccessPath = OpenapiPathType<paths['/manage/projects/{projectId}/request-access']['post']>;
 type RequestProjectAccessBody = OpenapiBodyType<paths['/manage/projects/{projectId}/request-access']['post']>;
-type RequestProjectAccessInput = ProjectPath & RequestProjectAccessBody;
-type RemoveProjectLimitPath = OpenapiPathType<paths['/manage/projects/{projectId}/limits/{limitName}']['delete']>;
+type RequestProjectAccessInput = RequestProjectAccessPath & RequestProjectAccessBody;
+type GetProjectMetadataPath = OpenapiPathType<paths['/manage/projects/{projectId}/metadata']['get']>;
+type ProjectMetadataItem = OpenapiReturnType<paths['/manage/projects/{projectId}/metadata']['get']>[number];
+type SetProjectMetadataPath = OpenapiPathType<paths['/manage/projects/{projectId}/metadata']['post']>;
+type SetProjectMetadataBody = OpenapiBodyType<paths['/manage/projects/{projectId}/metadata']['post']>;
+type SetProjectMetadataInput = SetProjectMetadataPath & SetProjectMetadataBody;
+type ProjectMetadataInput = SetProjectMetadataBody['metadata'][number];
 type DeleteProjectMetadataPath = OpenapiPathType<paths['/manage/projects/{projectId}/metadata/{metadataId}']['delete']>;
-type UpdateProjectInput = ProjectPath & UpdateProjectBody;
-type MoveProjectInput = ProjectPath & MoveProjectBody;
-type SetProjectDisabledInput = ProjectPath & SetProjectDisabledBody;
-type SetProjectLimitsInput = ProjectPath & SetProjectLimitsBody;
-type ChangeProjectUserRolePath = ProjectPath & {
-  userId: number;
-};
-type ChangeProjectUserRoleBody = {
-  role: User['role'];
-};
-type ChangeProjectUserRoleInput = ChangeProjectUserRolePath & ChangeProjectUserRoleBody;
+type GetProjectReviewersPath = OpenapiPathType<paths['/manage/projects/{projectId}/reviewers']['get']>;
+type SetProjectReviewersPath = OpenapiPathType<paths['/manage/projects/{projectId}/reviewers']['put']>;
+type SetProjectReviewersBody = OpenapiBodyType<paths['/manage/projects/{projectId}/reviewers']['put']>;
+type SetProjectReviewersInput = SetProjectReviewersPath & SetProjectReviewersBody;
+type ProjectTemplate = OpenapiReturnType<paths['/manage/project-templates']['get']>[number];
+type ProjectTemplatePath = OpenapiPathType<paths['/manage/project-templates/{templateId}']['get']>;
+type AssignProjectTemplateFeaturePath = OpenapiPathType<paths['/manage/project-templates/{templateId}/features']['post']>;
+type AssignFeatureBody = OpenapiBodyType<paths['/manage/project-templates/{templateId}/features']['post']>;
+type AssignProjectTemplateFeatureInput = AssignProjectTemplateFeaturePath & AssignFeatureBody;
+type RemoveProjectTemplateFeaturePath = OpenapiPathType<paths['/manage/project-templates/{templateId}/features/{featureName}']['delete']>;
+/** Query parameters of `GET /manage/search`: `q` plus the `filter[types]` and `page` deep objects. */
+type SearchQuery = OpenapiQueryType<paths['/manage/search']['get']>;
+/** `GET /manage/search`: one cursor-paginated collection per type the caller may read and asked for. */
+type SearchResult = OpenapiReturnType<paths['/manage/search']['get']>;
+type ProjectSearchItem = components['schemas']['ProjectSearchItem'];
+type OrganizationSearchItem = components['schemas']['OrganizationSearchItem'];
+type MaintainerSearchItem = components['schemas']['MaintainerSearchItem'];
+type UserSearchItem = components['schemas']['UserSearchItem'];
 /**
  * A storage backend as returned by `GET /manage/storage-backend/{id}`.
  *
@@ -18475,6 +19126,9 @@ type StorageBackend = Omit<components['schemas']['StorageBackendDetailResponse']
   /** BigQuery detail only; `null` = never configured. Overlay until connection#9129 deploys and
    * the schema is regenerated. */
   policyTagCapability?: PolicyTagCapability | null;
+  /** BigQuery only, on detail and list: the GCP folder id, `null` when the backend has none.
+   * Overlay until connection#9187 deploys and the schema is regenerated. */
+  folderId?: string | null;
 };
 /** The stored policy-tag capability of a BigQuery backend, as the console `--status` shows it. */
 type PolicyTagCapability = {
@@ -18529,6 +19183,47 @@ type PolicyTagEnablementGuideQuery = Omit<PolicyTagEnablementGuideSchemaQuery, '
 };
 type PolicyTagEnablementGuideInput = PolicyTagEnablementGuidePath & PolicyTagEnablementGuideQuery;
 type PolicyTagEnablementGuide = components['schemas']['PolicyTagEnablementGuideResponse'];
+type AddUserFeaturePath = {
+  userIdOrMail: string;
+};
+type AddUserFeatureBody = {
+  feature: string;
+};
+type RemoveUserFeaturePath = {
+  userIdOrMail: string;
+  feature: string;
+};
+type ProjectUsersResponse = OpenapiReturnType<paths['/manage/projects/{projectId}/users']['get']>;
+type User = {
+  id: number;
+  name: string;
+  email: string;
+  mfaEnabled: boolean;
+  features: string[];
+  canAccessLogs: boolean;
+  role: 'guest' | 'readOnly' | 'admin' | 'share' | 'productionManager' | 'developer' | 'reviewer';
+  isSuperAdmin: boolean;
+  canApproveMergeRequests: boolean;
+  /** Project users only; older stacks and other user endpoints omit this field. */
+  isOrganizationMember?: ProjectUsersResponse[number]['isOrganizationMember'];
+};
+type UserDetail = components['schemas']['UserResponse'];
+type UserListItem = components['schemas']['UserListResponse'][number];
+type UserOrganizationMembership = components['schemas']['UserListOrganizationsResponse'][number];
+type UserProjectMembership = components['schemas']['UserListProjectsResponse'][number];
+type UserMaintainerMembership = components['schemas']['UserListMaintainersResponse'][number];
+type GetUsersQuery = NonNullable<operations['get_/manage/users::UserListAction']['parameters']['query']>;
+/** The schema path parameter is `idOrEmail`; these methods take a numeric `id`, as their neighbours do. */
+type UserPath = {
+  id: number;
+};
+type UpdateUserBody = OpenapiBodyType<paths['/manage/users/{idOrEmail}']['put']>;
+type UpdateUserInput = UserPath & UpdateUserBody;
+type SetUserMetadataBody = components['schemas']['MetadataRequest'];
+type SetUserMetadataInput = UserPath & SetUserMetadataBody;
+type DeleteUserMetadataPath = UserPath & {
+  metadataId: number;
+};
 /**
  * One entry of the UI-application listing.
  *
@@ -18589,5 +19284,9 @@ type ProjectRetentionWorkspace = {
   } | null;
 };
 type ManagementToken = components['schemas']['ManageTokenVerifyResponse'];
-export { MoveProjectBody as $, OrganizationProject as $n, PayAsYouGoBillingConfiguration as $t, UpdateStorageBackendBody as A, SamlConfigPath as An, GetAllFeaturesQuery as Ar, UpdateProjectInput as At, CreateProjectFeaturePath as B, AdminUser as Bn, ProjectInvitation as Br, User as Bt, StorageBackend as C, MaintainerInvitationPath as Cn, RotateFileStorageS3Input as Cr, SetProjectLimitsBody as Ct, StorageBackendProject as D, MaintainerUserPath as Dn, FeatureAdmin as Dr, SetProjectReviewersBody as Dt, StorageBackendPath as E, MaintainerUser as En, Feature as Er, SetProjectMetadataPath as Et, AssignProjectTemplateFeatureInput as F, UpdateMaintainerInput as Fn, DeletedProjectsPage as Fr, RemoveUserFeaturePath as Ft, GetProjectMetadataPath as G, Organization as Gn, CreatedApplicationToken as Gr, UserPath as Gt, CreateProjectInvitationPath as H, CreateOrganizationInvitationInput as Hn, ApplicationToken as Hr, UserListItem as Ht, ChangeProjectUserRoleBody as I, UpdateSamlConfigBody as In, DeletedProjectsStats as Ir, SetUserMetadataBody as It, JoinProjectBody as J, OrganizationInvitationPath as Jn, ConfirmProgrammaticProjectResult as Jt, GetProjectPath as K, OrganizationDetail as Kn, components as Kr, UserProjectMembership as Kt, ChangeProjectUserRoleInput as L, UpdateSamlConfigInput as Ln, DeletedProjectsStatus as Lr, SetUserMetadataInput as Lt, AddProjectUserBody as M, SetMaintainerMetadataBody as Mn, DeletedProjectPurgeResult as Mr, AddUserFeaturePath as Mt, AddProjectUserPath as N, SetMaintainerMetadataInput as Nn, DeletedProjectsListFilter as Nr, DeleteUserMetadataPath as Nt, UpdateBigqueryStorageBackendBody as O, MetadataItem as On, FeatureProject as Or, SetProjectReviewersPath as Ot, AssignFeatureBody as P, UpdateMaintainerBody as Pn, DeletedProjectsListQuery as Pr, GetUsersQuery as Pt, ListProjectUsersPath as Q, OrganizationPath as Qn, CreditPurchase as Qt, ChangeProjectUserRolePath as R, AddOrganizationUserBody as Rn, MaintainerInvitation as Rr, UpdateUserBody as Rt, PolicyTagEnablementGuideSchemaQuery as S, MaintainerInvitationDetail as Sn, RotateFileStorageS3Body as Sr, SetProjectDisabledInput as St, StorageBackendMaintainer as T, MaintainerPath as Tn, UpdateFileStorageBody as Tr, SetProjectMetadataBody as Tt, DeleteProjectInvitationPath as U, CreateOrganizationProjectBody as Un, ApplicationTokenScope as Ur, UserMaintainerMembership as Ut, CreateProjectInvitationBody as V, CreateOrganizationInvitationBody as Vn, ProjectJoinRequest as Vr, UserDetail as Vt, DeleteProjectMetadataPath as W, CreateOrganizationProjectInput as Wn, CreateApplicationTokenBody as Wr, UserOrganizationMembership as Wt, ListProjectInvitationsPath as X, OrganizationMaintainer as Xn, CreatePaymentRequestBody as Xt, JoinProjectInput as Y, OrganizationListItem as Yn, ProgrammaticProjectClaim as Yt, ListProjectJoinRequestsPath as Z, OrganizationMetadataItemPath as Zn, CreditPaymentRequest as Zt, PolicyTagCapability as _, CreateSamlConfigBody as _n, RotateFileStorageAbsInput as _r, RemoveProjectUserPath as _t, GetUiAppsQuery as a, X402PaymentStatus as an, SetUpBigQueryBody as ar, ProjectInvitationDetail as at, PolicyTagEnablementGuidePath as b, Maintainer as bn, RotateFileStorageGcsInput as br, Reviewer as bt, UiApp as c, AddMaintainerUserBody as cn, CreateFileStorageS3Body as cr, ProjectMetadataInput as ct, UiAppVersion as d, CompleteSamlSetupInput as dn, FileStorageGcs as dr, ProjectTemplate as dt, StripeCustomer as en, OrganizationUserPath as er, MoveProjectInput as et, CreateBigqueryServerSideStorageBackendBody as f, CreateMaintainerBody as fn, FileStorageProject as fr, ProjectTemplatePath as ft, GetStorageBackendProjectsQuery as g, CreateMaintainerOrganizationInput as gn, RotateFileStorageAbsBody as gr, RemoveProjectTemplateFeaturePath as gt, CreateSnowflakeStorageBackendResponse as h, CreateMaintainerOrganizationBody as hn, FileStorageS3 as hr, RemoveProjectLimitPath as ht, ReactivateWorkspaceResult as i, UpdateTopUpSettingBody as in, UpdateOrganizationInput as ir, ProjectInvitableRole as it, UpdateStorageBackendInput as j, SamlConfigSummary as jn, DeletedProject as jr, AddUserFeatureBody as jt, UpdateBigqueryStorageBackendInput as k, SamlConfigDetail as kn, FeatureType as kr, UpdateProjectBody as kt, UiAppDetail as l, AddMaintainerUserInput as ln, FileStorage as lr, ProjectMetadataItem as lt, CreateSnowflakeStorageBackendBody as m, CreateMaintainerInvitationInput as mn, FileStorageProjectsQuery as mr, RemoveProjectFeaturePath as mt, ProjectRetentionWorkspace as n, TopUpSetting as nn, SetOrganizationMetadataInput as nr, ProjectBase as nt, RegisterUiAppBody as o, X402_PAYMENT_STATUS as on, CreateFileStorageAbsBody as or, ProjectJoinRequestDetail as ot, CreateBigqueryStorageBackendBody as p, CreateMaintainerInvitationBody as pn, FileStorageProjectsPage as pr, ProjectWithFeatureWarnings as pt, GetProjectReviewersPath as q, OrganizationInvitationDetail as qn, paths as qr, ConfirmProgrammaticProjectBody as qt, ProjectRetentionWorkspaceState as r, UpdateStripeCustomerBody as rn, UpdateOrganizationBody as rr, ProjectFeatureWarning as rt, RenameUiAppBody as s, X402_TOP_UP_TYPE as sn, CreateFileStorageGcsBody as sr, ProjectJoinRequestPath as st, ManagementToken as t, StripeCustomerCard as tn, SetOrganizationMetadataBody as tr, Project as tt, UiAppRegistrationResult as u, CompleteSamlSetupBody as un, FileStorageAbs as ur, ProjectPath as ut, PolicyTagEnablementGuide as v, CreateSamlConfigInput as vn, RotateFileStorageAbsPath as vr, RequestProjectAccessBody as vt, StorageBackendBigquery as w, MaintainerMetadataItemPath as wn, RotateFileStorageS3Path as wr, SetProjectLimitsInput as wt, PolicyTagEnablementGuideQuery as x, MaintainerDetail as xn, RotateFileStorageGcsPath as xr, SetProjectDisabledBody as xt, PolicyTagEnablementGuideInput as y, CreateSamlConfigPath as yn, RotateFileStorageGcsBody as yr, RequestProjectAccessInput as yt, CreateProjectFeatureBody as z, AddOrganizationUserInput as zn, OrganizationInvitation as zr, UpdateUserInput as zt };
-//# sourceMappingURL=types-DNldEa7i.d.ts.map
+/** A Manage token Connection minted for an admin's session: it always carries `user`. */
+type ManagementSessionToken = ManagementToken & {
+  user: NonNullable<ManagementToken['user']>;
+};
+export { SearchResult as $, UpdateMaintainerBody as $n, DeletedProjectsListQuery as $r, SetProjectDisabledPath as $t, CreateBigqueryStorageBackendBody as A, CompleteSamlSetupInput as An, FileStorageGcs as Ar, MoveProjectBody as At, StorageBackend as B, MaintainerDetail as Bn, RotateFileStorageGcsPath as Br, ProjectMetadataItem as Bt, UserDetail as C, UpdateTopUpSettingBody as Cn, UpdateOrganizationInput as Cr, GetProjectReviewersPath as Ct, UserPath as D, AddMaintainerUserBody as Dn, CreateFileStorageS3Body as Dr, ListProjectInvitationsPath as Dt, UserOrganizationMembership as E, X402_TOP_UP_TYPE as En, CreateFileStorageGcsBody as Er, JoinProjectPath as Et, PolicyTagEnablementGuide as F, CreateMaintainerOrganizationInput as Fn, RotateFileStorageAbsBody as Fr, ProjectInvitableRole as Ft, UpdateBigqueryStorageBackendBody as G, MaintainerUser as Gn, Feature as Gr, RemoveProjectLimitPath as Gt, StorageBackendMaintainer as H, MaintainerInvitationPath as Hn, RotateFileStorageS3Input as Hr, ProjectTemplatePath as Ht, PolicyTagEnablementGuideInput as I, CreateSamlConfigBody as In, RotateFileStorageAbsInput as Ir, ProjectInvitationDetail as It, UpdateStorageBackendInput as J, SamlConfigDetail as Jn, FeatureType as Jr, RequestProjectAccessBody as Jt, UpdateBigqueryStorageBackendInput as K, MaintainerUserPath as Kn, FeatureAdmin as Kr, RemoveProjectTemplateFeaturePath as Kt, PolicyTagEnablementGuidePath as L, CreateSamlConfigInput as Ln, RotateFileStorageAbsPath as Lr, ProjectJoinRequestDetail as Lt, CreateSnowflakeStorageBackendResponse as M, CreateMaintainerInvitationBody as Mn, FileStorageProjectsPage as Mr, MoveProjectPath as Mt, GetStorageBackendProjectsQuery as N, CreateMaintainerInvitationInput as Nn, FileStorageProjectsQuery as Nr, Project as Nt, UserProjectMembership as O, AddMaintainerUserInput as On, FileStorage as Or, ListProjectJoinRequestsPath as Ot, PolicyTagCapability as P, CreateMaintainerOrganizationBody as Pn, FileStorageS3 as Pr, ProjectFeatureWarning as Pt, SearchQuery as Q, SetMaintainerMetadataInput as Qn, DeletedProjectsListFilter as Qr, SetProjectDisabledInput as Qt, PolicyTagEnablementGuideQuery as R, CreateSamlConfigPath as Rn, RotateFileStorageGcsBody as Rr, ProjectMember as Rt, User as S, UpdateStripeCustomerBody as Sn, UpdateOrganizationBody as Sr, GetProjectPath as St, UserMaintainerMembership as T, X402_PAYMENT_STATUS as Tn, CreateFileStorageAbsBody as Tr, JoinProjectInput as Tt, StorageBackendPath as U, MaintainerMetadataItemPath as Un, RotateFileStorageS3Path as Ur, RejectProjectJoinRequestPath as Ut, StorageBackendBigquery as V, MaintainerInvitationDetail as Vn, RotateFileStorageS3Body as Vr, ProjectTemplate as Vt, StorageBackendProject as W, MaintainerPath as Wn, UpdateFileStorageBody as Wr, RemoveProjectFeaturePath as Wt, OrganizationSearchItem as X, SamlConfigSummary as Xn, DeletedProject as Xr, RequestProjectAccessPath as Xt, MaintainerSearchItem as Y, SamlConfigPath as Yn, GetAllFeaturesQuery as Yr, RequestProjectAccessInput as Yt, ProjectSearchItem as Z, SetMaintainerMetadataBody as Zn, DeletedProjectPurgeResult as Zr, SetProjectDisabledBody as Zt, RemoveUserFeaturePath as _, CreditPurchase as _n, OrganizationPath as _r, DeleteProjectInvitationPath as _t, ReactivateWorkspaceResult as a, ProjectInvitation as ai, SetProjectMetadataPath as an, AdminUser as ar, AssignFeatureBody as at, UpdateUserBody as b, StripeCustomerCard as bn, SetOrganizationMetadataBody as br, GetProjectJoinRequestPath as bt, RenameUiAppBody as c, ApplicationTokenScope as ci, SetProjectReviewersPath as cn, CreateOrganizationProjectBody as cr, ChangeProjectUserRoleBody as ct, UiAppRegistrationResult as d, components as di, UpdateProjectPath as dn, OrganizationDetail as dr, CreateProjectFeatureBody as dt, DeletedProjectsPage as ei, SetProjectLimitsBody as en, UpdateMaintainerInput as er, UserSearchItem as et, UiAppVersion as f, paths as fi, ConfirmProgrammaticProjectBody as fn, OrganizationInvitationDetail as fr, CreateProjectFeatureInput as ft, GetUsersQuery as g, CreditPaymentRequest as gn, OrganizationMetadataItemPath as gr, CreateProjectInvitationPath as gt, DeleteUserMetadataPath as h, CreatePaymentRequestBody as hn, OrganizationMaintainer as hr, CreateProjectInvitationInput as ht, ProjectRetentionWorkspaceState as i, OrganizationInvitation as ii, SetProjectMetadataInput as in, AddOrganizationUserInput as ir, ApproveProjectJoinRequestPath as it, CreateSnowflakeStorageBackendBody as j, CreateMaintainerBody as jn, FileStorageProject as jr, MoveProjectInput as jt, CreateBigqueryServerSideStorageBackendBody as k, CompleteSamlSetupBody as kn, FileStorageAbs as kr, ListProjectUsersPath as kt, UiApp as l, CreateApplicationTokenBody as li, UpdateProjectBody as ln, CreateOrganizationProjectInput as lr, ChangeProjectUserRoleInput as lt, AddUserFeaturePath as m, ProgrammaticProjectClaim as mn, OrganizationListItem as mr, CreateProjectInvitationBody as mt, ManagementToken as n, DeletedProjectsStatus as ni, SetProjectLimitsPath as nn, UpdateSamlConfigInput as nr, AddProjectUserInput as nt, GetUiAppsQuery as o, ProjectJoinRequest as oi, SetProjectReviewersBody as on, CreateOrganizationInvitationBody as or, AssignProjectTemplateFeatureInput as ot, AddUserFeatureBody as p, ConfirmProgrammaticProjectResult as pn, OrganizationInvitationPath as pr, CreateProjectFeaturePath as pt, UpdateStorageBackendBody as q, MetadataItem as qn, FeatureProject as qr, RemoveProjectUserPath as qt, ProjectRetentionWorkspace as r, MaintainerInvitation as ri, SetProjectMetadataBody as rn, AddOrganizationUserBody as rr, AddProjectUserPath as rt, RegisterUiAppBody as s, ApplicationToken as si, SetProjectReviewersInput as sn, CreateOrganizationInvitationInput as sr, AssignProjectTemplateFeaturePath as st, ManagementSessionToken as t, DeletedProjectsStats as ti, SetProjectLimitsInput as tn, UpdateSamlConfigBody as tr, AddProjectUserBody as tt, UiAppDetail as u, CreatedApplicationToken as ui, UpdateProjectInput as un, Organization as ur, ChangeProjectUserRolePath as ut, SetUserMetadataBody as v, PayAsYouGoBillingConfiguration as vn, OrganizationProject as vr, DeleteProjectMetadataPath as vt, UserListItem as w, X402PaymentStatus as wn, SetUpBigQueryBody as wr, JoinProjectBody as wt, UpdateUserInput as x, TopUpSetting as xn, SetOrganizationMetadataInput as xr, GetProjectMetadataPath as xt, SetUserMetadataInput as y, StripeCustomer as yn, OrganizationUserPath as yr, GetProjectInvitationPath as yt, PolicyTagEnablementGuideSchemaQuery as z, Maintainer as zn, RotateFileStorageGcsInput as zr, ProjectMetadataInput as zt };
+//# sourceMappingURL=types-J_dgwMjP.d.ts.map