@lumiblue/secrets 0.1.15

package/dist/index.d.ts

@@ -0,0 +1,2501 @@
+// Generated by dts-bundle-generator v9.5.1
+
+export type AuthToken = string | undefined;
+export interface Auth {
+	/**
+	 * Which part of the request do we use to send the auth?
+	 *
+	 * @default 'header'
+	 */
+	in?: "header" | "query" | "cookie";
+	/**
+	 * A unique identifier for the security scheme.
+	 *
+	 * Defined only when there are multiple security schemes whose `Auth`
+	 * shape would otherwise be identical.
+	 */
+	key?: string;
+	/**
+	 * Header or query parameter name.
+	 *
+	 * @default 'Authorization'
+	 */
+	name?: string;
+	scheme?: "basic" | "bearer";
+	type: "apiKey" | "http";
+}
+export interface SerializerOptions<T> {
+	/**
+	 * @default true
+	 */
+	explode: boolean;
+	style: T;
+}
+export type ArrayStyle = "form" | "spaceDelimited" | "pipeDelimited";
+export type ObjectStyle = "form" | "deepObject";
+export type QuerySerializer = (query: Record<string, unknown>) => string;
+export type BodySerializer = (body: unknown) => unknown;
+export type QuerySerializerOptionsObject = {
+	allowReserved?: boolean;
+	array?: Partial<SerializerOptions<ArrayStyle>>;
+	object?: Partial<SerializerOptions<ObjectStyle>>;
+};
+export type QuerySerializerOptions = QuerySerializerOptionsObject & {
+	/**
+	 * Per-parameter serialization overrides. When provided, these settings
+	 * override the global array/object settings for specific parameter names.
+	 */
+	parameters?: Record<string, QuerySerializerOptionsObject>;
+};
+export type HttpMethod = "connect" | "delete" | "get" | "head" | "options" | "patch" | "post" | "put" | "trace";
+export type Client<RequestFn = never, Config = unknown, MethodFn = never, BuildUrlFn = never, SseFn = never> = {
+	/**
+	 * Returns the final request URL.
+	 */
+	buildUrl: BuildUrlFn;
+	getConfig: () => Config;
+	request: RequestFn;
+	setConfig: (config: Config) => Config;
+} & {
+	[K in HttpMethod]: MethodFn;
+} & ([
+	SseFn
+] extends [
+	never
+] ? {
+	sse?: never;
+} : {
+	sse: {
+		[K in HttpMethod]: SseFn;
+	};
+});
+export interface Config {
+	/**
+	 * Auth token or a function returning auth token. The resolved value will be
+	 * added to the request payload as defined by its `security` array.
+	 */
+	auth?: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken;
+	/**
+	 * A function for serializing request body parameter. By default,
+	 * {@link JSON.stringify()} will be used.
+	 */
+	bodySerializer?: BodySerializer | null;
+	/**
+	 * An object containing any HTTP headers that you want to pre-populate your
+	 * `Headers` object with.
+	 *
+	 * {@link https://developer.mozilla.org/docs/Web/API/Headers/Headers#init See more}
+	 */
+	headers?: RequestInit["headers"] | Record<string, string | number | boolean | (string | number | boolean)[] | null | undefined | unknown>;
+	/**
+	 * The request method.
+	 *
+	 * {@link https://developer.mozilla.org/docs/Web/API/fetch#method See more}
+	 */
+	method?: Uppercase<HttpMethod>;
+	/**
+	 * A function for serializing request query parameters. By default, arrays
+	 * will be exploded in form style, objects will be exploded in deepObject
+	 * style, and reserved characters are percent-encoded.
+	 *
+	 * This method will have no effect if the native `paramsSerializer()` Axios
+	 * API function is used.
+	 *
+	 * {@link https://swagger.io/docs/specification/serialization/#query View examples}
+	 */
+	querySerializer?: QuerySerializer | QuerySerializerOptions;
+	/**
+	 * A function validating request data. This is useful if you want to ensure
+	 * the request conforms to the desired shape, so it can be safely sent to
+	 * the server.
+	 */
+	requestValidator?: (data: unknown) => Promise<unknown>;
+	/**
+	 * A function transforming response data before it's returned. This is useful
+	 * for post-processing data, e.g., converting ISO strings into Date objects.
+	 */
+	responseTransformer?: (data: unknown) => Promise<unknown>;
+	/**
+	 * A function validating response data. This is useful if you want to ensure
+	 * the response conforms to the desired shape, so it can be safely passed to
+	 * the transformers and returned to the user.
+	 */
+	responseValidator?: (data: unknown) => Promise<unknown>;
+}
+/**
+ * Arbitrary metadata passed through the `meta` request option.
+ */
+export interface ClientMeta {
+}
+export type ServerSentEventsOptions<TData = unknown> = Omit<RequestInit, "method"> & Pick<Config, "method" | "responseTransformer" | "responseValidator"> & {
+	/**
+	 * Fetch API implementation. You can use this option to provide a custom
+	 * fetch instance.
+	 *
+	 * @default globalThis.fetch
+	 */
+	fetch?: typeof fetch;
+	/**
+	 * Implementing clients can call request interceptors inside this hook.
+	 */
+	onRequest?: (url: string, init: RequestInit) => Promise<Request>;
+	/**
+	 * Callback invoked when a network or parsing error occurs during streaming.
+	 *
+	 * This option applies only if the endpoint returns a stream of events.
+	 *
+	 * @param error The error that occurred.
+	 */
+	onSseError?: (error: unknown) => void;
+	/**
+	 * Callback invoked when an event is streamed from the server.
+	 *
+	 * This option applies only if the endpoint returns a stream of events.
+	 *
+	 * @param event Event streamed from the server.
+	 * @returns Nothing (void).
+	 */
+	onSseEvent?: (event: StreamEvent<TData>) => void;
+	serializedBody?: RequestInit["body"];
+	/**
+	 * Default retry delay in milliseconds.
+	 *
+	 * This option applies only if the endpoint returns a stream of events.
+	 *
+	 * @default 3000
+	 */
+	sseDefaultRetryDelay?: number;
+	/**
+	 * Maximum number of retry attempts before giving up.
+	 */
+	sseMaxRetryAttempts?: number;
+	/**
+	 * Maximum retry delay in milliseconds.
+	 *
+	 * Applies only when exponential backoff is used.
+	 *
+	 * This option applies only if the endpoint returns a stream of events.
+	 *
+	 * @default 30000
+	 */
+	sseMaxRetryDelay?: number;
+	/**
+	 * Optional sleep function for retry backoff.
+	 *
+	 * Defaults to using `setTimeout`.
+	 */
+	sseSleepFn?: (ms: number) => Promise<void>;
+	url: string;
+};
+export interface StreamEvent<TData = unknown> {
+	data: TData;
+	event?: string;
+	id?: string;
+	retry?: number;
+}
+export type ServerSentEventsResult<TData = unknown, TReturn = void, TNext = unknown> = {
+	stream: AsyncGenerator<TData extends Record<string, unknown> ? TData[keyof TData] : TData, TReturn, TNext>;
+};
+export type ErrInterceptor<Err, Res, Req, Options> = (error: Err, 
+/** response may be undefined due to a network error where no response object is produced */
+response: Res | undefined, 
+/** request may be undefined, because error may be from building the request object itself */
+request: Req | undefined, options: Options) => Err | Promise<Err>;
+export type ReqInterceptor<Req, Options> = (request: Req, options: Options) => Req | Promise<Req>;
+export type ResInterceptor<Res, Req, Options> = (response: Res, request: Req, options: Options) => Res | Promise<Res>;
+declare class Interceptors<Interceptor> {
+	fns: Array<Interceptor | null>;
+	clear(): void;
+	eject(id: number | Interceptor): void;
+	exists(id: number | Interceptor): boolean;
+	getInterceptorIndex(id: number | Interceptor): number;
+	update(id: number | Interceptor, fn: Interceptor): number | Interceptor | false;
+	use(fn: Interceptor): number;
+}
+export interface Middleware<Req, Res, Err, Options> {
+	error: Interceptors<ErrInterceptor<Err, Res, Req, Options>>;
+	request: Interceptors<ReqInterceptor<Req, Options>>;
+	response: Interceptors<ResInterceptor<Res, Req, Options>>;
+}
+export type ResponseStyle = "data" | "fields";
+interface Config$1<T extends ClientOptions = ClientOptions> extends Omit<RequestInit, "body" | "headers" | "method">, Config {
+	/**
+	 * Base URL for all requests made by this client.
+	 */
+	baseUrl?: T["baseUrl"];
+	/**
+	 * Fetch API implementation. You can use this option to provide a custom
+	 * fetch instance.
+	 *
+	 * @default globalThis.fetch
+	 */
+	fetch?: typeof fetch;
+	/**
+	 * Please don't use the Fetch client for Next.js applications. The `next`
+	 * options won't have any effect.
+	 *
+	 * Install {@link https://www.npmjs.com/package/@hey-api/client-next `@hey-api/client-next`} instead.
+	 */
+	next?: never;
+	/**
+	 * Return the response data parsed in a specified format. By default, `auto`
+	 * will infer the appropriate method from the `Content-Type` response header.
+	 * You can override this behavior with any of the {@link Body} methods.
+	 * Select `stream` if you don't want to parse response data at all.
+	 *
+	 * @default 'auto'
+	 */
+	parseAs?: "arrayBuffer" | "auto" | "blob" | "formData" | "json" | "stream" | "text";
+	/**
+	 * Should we return only data or multiple fields (data, error, response, etc.)?
+	 *
+	 * @default 'fields'
+	 */
+	responseStyle?: ResponseStyle;
+	/**
+	 * Throw an error instead of returning it in the response?
+	 *
+	 * @default false
+	 */
+	throwOnError?: T["throwOnError"];
+}
+export interface RequestOptions<TData = unknown, TResponseStyle extends ResponseStyle = "fields", ThrowOnError extends boolean = boolean, Url extends string = string> extends Config$1<{
+	responseStyle: TResponseStyle;
+	throwOnError: ThrowOnError;
+}>, Pick<ServerSentEventsOptions<TData>, "onRequest" | "onSseError" | "onSseEvent" | "sseDefaultRetryDelay" | "sseMaxRetryAttempts" | "sseMaxRetryDelay"> {
+	/**
+	 * Any body that you want to add to your request.
+	 *
+	 * {@link https://developer.mozilla.org/docs/Web/API/fetch#body}
+	 */
+	body?: unknown;
+	path?: Record<string, unknown>;
+	query?: Record<string, unknown>;
+	/**
+	 * Security mechanism(s) to use for the request.
+	 */
+	security?: ReadonlyArray<Auth>;
+	url: Url;
+}
+export interface ResolvedRequestOptions<TResponseStyle extends ResponseStyle = "fields", ThrowOnError extends boolean = boolean, Url extends string = string> extends RequestOptions<unknown, TResponseStyle, ThrowOnError, Url> {
+	headers: Headers;
+	serializedBody?: string;
+}
+export type RequestResult<TData = unknown, TError = unknown, ThrowOnError extends boolean = boolean, TResponseStyle extends ResponseStyle = "fields"> = ThrowOnError extends true ? Promise<TResponseStyle extends "data" ? TData extends Record<string, unknown> ? TData[keyof TData] : TData : {
+	data: TData extends Record<string, unknown> ? TData[keyof TData] : TData;
+	request: Request;
+	response: Response;
+}> : Promise<TResponseStyle extends "data" ? (TData extends Record<string, unknown> ? TData[keyof TData] : TData) | undefined : ({
+	data: TData extends Record<string, unknown> ? TData[keyof TData] : TData;
+	error: undefined;
+} | {
+	data: undefined;
+	error: TError extends Record<string, unknown> ? TError[keyof TError] : TError;
+}) & {
+	/** request may be undefined, because error may be from building the request object itself */
+	request?: Request;
+	/** response may be undefined, because error may be from building the request object itself or from a network error */
+	response?: Response;
+}>;
+export interface ClientOptions {
+	baseUrl?: string;
+	responseStyle?: ResponseStyle;
+	throwOnError?: boolean;
+}
+export type MethodFn = <TData = unknown, TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = "fields">(options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, "method">) => RequestResult<TData, TError, ThrowOnError, TResponseStyle>;
+export type SseFn = <TData = unknown, _TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = "fields">(options: Omit<RequestOptions<never, TResponseStyle, ThrowOnError>, "method">) => Promise<ServerSentEventsResult<TData>>;
+export type RequestFn = <TData = unknown, TError = unknown, ThrowOnError extends boolean = false, TResponseStyle extends ResponseStyle = "fields">(options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, "method"> & Pick<Required<RequestOptions<TData, TResponseStyle, ThrowOnError>>, "method">) => RequestResult<TData, TError, ThrowOnError, TResponseStyle>;
+export type BuildUrlFn = <TData extends {
+	body?: unknown;
+	path?: Record<string, unknown>;
+	query?: Record<string, unknown>;
+	url: string;
+}>(options: TData & Options<TData>) => string;
+type Client$1 = Client<RequestFn, Config$1, MethodFn, BuildUrlFn, SseFn> & {
+	interceptors: Middleware<Request, Response, unknown, ResolvedRequestOptions>;
+};
+export interface TDataShape {
+	body?: unknown;
+	headers?: unknown;
+	path?: unknown;
+	query?: unknown;
+	url: string;
+}
+export type OmitKeys<T, K> = Pick<T, Exclude<keyof T, K>>;
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown, TResponseStyle extends ResponseStyle = "fields"> = OmitKeys<RequestOptions<TResponse, TResponseStyle, ThrowOnError>, "body" | "path" | "query" | "url"> & ([
+	TData
+] extends [
+	never
+] ? unknown : Omit<TData, "url">);
+export type GetApiHealthData = {
+	body?: never;
+	path?: never;
+	query?: never;
+	url: "/api/health";
+};
+export type GetApiHealthResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		status: string;
+		environment?: string;
+		ts: string;
+	};
+};
+export type GetApiHealthMeData = {
+	body?: never;
+	path?: never;
+	query?: never;
+	url: "/api/health/me";
+};
+export type GetApiHealthMeErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiHealthMeResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		status: string;
+		environment?: string;
+		ts: string;
+		sub?: string;
+		exp?: number;
+		iat?: number;
+		org?: string;
+		role?: string;
+		aud?: Array<string>;
+		is_admin?: boolean;
+		image?: string | null;
+	};
+};
+export type DeleteApiVaultProjectsData = {
+	body: {
+		ids: Array<string>;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/vault/projects";
+};
+export type DeleteApiVaultProjectsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type DeleteApiVaultProjectsResponses = {
+	/**
+	 * Projects deleted
+	 */
+	204: void;
+};
+export type GetApiVaultProjectsData = {
+	body?: never;
+	path?: never;
+	query?: never;
+	url: "/api/vault/projects";
+};
+export type GetApiVaultProjectsErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiVaultProjectsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		projects: Array<{
+			id: string;
+			name: string;
+			description: string | null;
+			secretCount: number;
+			isAdmin: boolean;
+			isOwner: boolean;
+		}>;
+	};
+};
+export type PatchApiVaultProjectsData = {
+	body: Array<{
+		id: string;
+		name?: string;
+		description?: string;
+	}>;
+	path?: never;
+	query?: never;
+	url: "/api/vault/projects";
+};
+export type PatchApiVaultProjectsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PatchApiVaultProjectsResponses = {
+	/**
+	 * Projects updated
+	 */
+	200: Array<{
+		id: string;
+		name: string;
+		description: string | null;
+		secretCount: number;
+		isAdmin: boolean;
+		isOwner: boolean;
+	}>;
+};
+export type PutApiVaultProjectsData = {
+	body: Array<{
+		name: string;
+		description?: string;
+	}>;
+	path?: never;
+	query?: never;
+	url: "/api/vault/projects";
+};
+export type PutApiVaultProjectsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PutApiVaultProjectsResponses = {
+	/**
+	 * Projects created
+	 */
+	201: Array<{
+		id: string;
+		name: string;
+		description: string | null;
+		createdAt: number;
+	}>;
+};
+export type GetApiVaultProjectsByProjectIdSecretsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/vault/projects/{projectId}/secrets";
+};
+export type GetApiVaultProjectsByProjectIdSecretsErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiVaultProjectsByProjectIdSecretsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		projectId: string;
+		projectName: string;
+		secrets: Array<{
+			name: string;
+			description: string | null;
+			dev: {
+				secretId: string;
+				updatedAt: number;
+				updatedBy: string;
+			} | null;
+			staging: {
+				secretId: string;
+				updatedAt: number;
+				updatedBy: string;
+			} | null;
+			production: {
+				secretId: string;
+				updatedAt: number;
+				updatedBy: string;
+			} | null;
+		}>;
+	};
+};
+export type GetApiVaultSecretsBySecretIdData = {
+	body?: never;
+	path: {
+		secretId: string;
+	};
+	query?: never;
+	url: "/api/vault/secrets/{secretId}";
+};
+export type GetApiVaultSecretsBySecretIdErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiVaultSecretsBySecretIdResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		secretId: string;
+		updatedAt: number;
+		updatedBy: string;
+		value: string;
+	};
+};
+export type PatchApiVaultSecretsBySecretIdData = {
+	body: {
+		value: string;
+	};
+	path: {
+		secretId: string;
+	};
+	query?: never;
+	url: "/api/vault/secrets/{secretId}";
+};
+export type PatchApiVaultSecretsBySecretIdErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PatchApiVaultSecretsBySecretIdResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		secretId: string;
+		updatedAt: number;
+		updatedBy: string;
+	};
+};
+export type PostApiVaultInjectData = {
+	body: {
+		machineId: string;
+		projectId: string;
+		environment: "dev" | "staging" | "production";
+		org: string;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/vault/inject";
+};
+export type PostApiVaultInjectErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Server error
+	 */
+	500: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiVaultInjectResponses = {
+	/**
+	 * Secrets retrieved successfully (may be empty)
+	 */
+	200: {
+		projectId: string;
+		environment: "dev" | "staging" | "production";
+		secrets: {
+			[key: string]: string;
+		};
+	};
+};
+export type PostApiVaultProjectsQueryData = {
+	body: {
+		ids: Array<string>;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/vault/projects/query";
+};
+export type PostApiVaultProjectsQueryErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiVaultProjectsQueryResponses = {
+	/**
+	 * Projects found
+	 */
+	200: {
+		projects: Array<{
+			id: string;
+			name: string;
+			description: string | null;
+			secretCount: number;
+			isAdmin: boolean;
+			isOwner: boolean;
+		}>;
+	};
+};
+export type DeleteApiVaultSecretsData = {
+	body: {
+		ids: Array<string>;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/vault/secrets";
+};
+export type DeleteApiVaultSecretsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type DeleteApiVaultSecretsResponses = {
+	/**
+	 * Secrets deleted
+	 */
+	204: void;
+};
+export type PatchApiVaultSecretsData = {
+	body: Array<{
+		id: string;
+		name?: string;
+		description?: string;
+		value?: string;
+	}>;
+	path?: never;
+	query?: never;
+	url: "/api/vault/secrets";
+};
+export type PatchApiVaultSecretsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PatchApiVaultSecretsResponses = {
+	/**
+	 * Secrets updated
+	 */
+	200: {
+		success: true;
+	};
+};
+export type PutApiVaultSecretsData = {
+	body: Array<{
+		id?: string;
+		projectId: string;
+		environment: "dev" | "staging" | "production";
+		name: string;
+		description?: string;
+		value: string;
+	}>;
+	path?: never;
+	query?: never;
+	url: "/api/vault/secrets";
+};
+export type PutApiVaultSecretsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Conflict
+	 */
+	409: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PutApiVaultSecretsResponses = {
+	/**
+	 * Secrets created
+	 */
+	201: {
+		secrets: Array<{
+			id: string;
+			projectId: string;
+			environment: string;
+			name: string;
+		}>;
+	};
+};
+export type PostApiVaultSecretsQueryData = {
+	body: {
+		ids: Array<string>;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/vault/secrets/query";
+};
+export type PostApiVaultSecretsQueryErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiVaultSecretsQueryResponses = {
+	/**
+	 * Secrets found (only IDs the caller may access)
+	 */
+	200: {
+		secrets: Array<{
+			secretId: string;
+			updatedAt: number;
+			updatedBy: string;
+			value: string;
+		}>;
+	};
+};
+export type DeleteApiVaultProjectsByProjectIdDmsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/vault/projects/{projectId}/dms";
+};
+export type DeleteApiVaultProjectsByProjectIdDmsErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type DeleteApiVaultProjectsByProjectIdDmsResponses = {
+	/**
+	 * DMS cancelled
+	 */
+	204: void;
+};
+export type GetApiVaultProjectsByProjectIdDmsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/vault/projects/{projectId}/dms";
+};
+export type GetApiVaultProjectsByProjectIdDmsErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiVaultProjectsByProjectIdDmsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		projectId: string;
+		deliveryDate: string | null;
+		emails: Array<string>;
+		deliveredAt: string | null;
+		claimExpiresAt: string | null;
+		projectDescription: string | null;
+	};
+};
+export type PatchApiVaultProjectsByProjectIdDmsData = {
+	body: {
+		deliveryDate?: string;
+		emails?: Array<string>;
+		projectDescription?: string | null;
+	};
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/vault/projects/{projectId}/dms";
+};
+export type PatchApiVaultProjectsByProjectIdDmsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Resource not found
+	 */
+	404: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PatchApiVaultProjectsByProjectIdDmsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		projectId: string;
+		deliveryDate: string | null;
+		emails: Array<string>;
+		deliveredAt: string | null;
+		claimExpiresAt: string | null;
+		projectDescription: string | null;
+	};
+};
+export type PutApiVaultProjectsByProjectIdDmsData = {
+	body: {
+		deliveryDate: string;
+		emails: Array<string>;
+		projectDescription?: string | null;
+	};
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/vault/projects/{projectId}/dms";
+};
+export type PutApiVaultProjectsByProjectIdDmsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PutApiVaultProjectsByProjectIdDmsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		projectId: string;
+		deliveryDate: string | null;
+		emails: Array<string>;
+		deliveredAt: string | null;
+		claimExpiresAt: string | null;
+		projectDescription: string | null;
+	};
+};
+export type GetApiDmsProofByTokenData = {
+	body?: never;
+	path: {
+		token: string;
+	};
+	query?: never;
+	url: "/api/dms/proof/{token}";
+};
+export type GetApiDmsProofByTokenErrors = {
+	/**
+	 * Invalid or expired proof token (HTML)
+	 */
+	400: string;
+};
+export type GetApiDmsProofByTokenResponses = {
+	/**
+	 * HTML page
+	 */
+	200: string;
+};
+export type PatchApiDmsProofByTokenData = {
+	body?: never;
+	path: {
+		token: string;
+	};
+	query?: never;
+	url: "/api/dms/proof/{token}";
+};
+export type PatchApiDmsProofByTokenErrors = {
+	/**
+	 * Invalid token or past delivery date (HTML)
+	 */
+	400: string;
+};
+export type PatchApiDmsProofByTokenResponses = {
+	/**
+	 * HTML page
+	 */
+	200: string;
+};
+export type DeleteApiDmsClaimByTokenData = {
+	body?: never;
+	path: {
+		token: string;
+	};
+	query?: never;
+	url: "/api/dms/claim/{token}";
+};
+export type DeleteApiDmsClaimByTokenErrors = {
+	/**
+	 * Invalid token or wrong confirmation (HTML)
+	 */
+	400: string;
+};
+export type DeleteApiDmsClaimByTokenResponses = {
+	/**
+	 * HTML page
+	 */
+	200: string;
+};
+export type GetApiDmsClaimByTokenData = {
+	body?: never;
+	path: {
+		token: string;
+	};
+	query?: never;
+	url: "/api/dms/claim/{token}";
+};
+export type GetApiDmsClaimByTokenErrors = {
+	/**
+	 * Invalid or expired claim token (HTML)
+	 */
+	400: string;
+};
+export type GetApiDmsClaimByTokenResponses = {
+	/**
+	 * HTML page
+	 */
+	200: string;
+};
+export type GetApiProjectsByProjectIdAuditLogsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: {
+		page?: number;
+		pageSize?: number;
+		startDate?: string;
+		endDate?: string;
+		eventType?: string;
+		subjectId?: string;
+		environment?: "dev" | "staging" | "production";
+		success?: boolean;
+		secretNames?: string;
+	};
+	url: "/api/projects/{projectId}/audit-logs";
+};
+export type GetApiProjectsByProjectIdAuditLogsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiProjectsByProjectIdAuditLogsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		logs: Array<{
+			id: string;
+			eventType: string;
+			subjectId: string;
+			subjectName: string | null;
+			projectId: string | null;
+			environment: string | null;
+			secretNames: string | null;
+			success: boolean;
+			details: string | null;
+			createdAt: number;
+		}>;
+		total: number;
+		page: number;
+		pageSize: number;
+		totalPages: number;
+	};
+};
+export type GetApiProjectsByProjectIdAdminsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/projects/{projectId}/admins";
+};
+export type GetApiProjectsByProjectIdAdminsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiProjectsByProjectIdAdminsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		admins: Array<{
+			id: string;
+			subjectId: string;
+			email: string | null;
+			name: string;
+			type: "user" | "machine";
+			grantedBy: string;
+			createdAt: number;
+		}>;
+	};
+};
+export type PostApiProjectsByProjectIdAdminsData = {
+	body: {
+		email: string;
+	};
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/projects/{projectId}/admins";
+};
+export type PostApiProjectsByProjectIdAdminsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Conflict
+	 */
+	409: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiProjectsByProjectIdAdminsResponses = {
+	/**
+	 * Admin added
+	 */
+	201: {
+		id: string;
+		subjectId: string;
+		projectId: string;
+		grantedBy: string;
+		createdAt: number;
+	};
+};
+export type DeleteApiProjectsByProjectIdAdminsBySubjectIdData = {
+	body?: never;
+	path: {
+		projectId: string;
+		subjectId: string;
+	};
+	query?: never;
+	url: "/api/projects/{projectId}/admins/{subjectId}";
+};
+export type DeleteApiProjectsByProjectIdAdminsBySubjectIdErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type DeleteApiProjectsByProjectIdAdminsBySubjectIdResponses = {
+	/**
+	 * Admin removed
+	 */
+	204: void;
+};
+export type GetApiProjectsByProjectIdAccessData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/projects/{projectId}/access";
+};
+export type GetApiProjectsByProjectIdAccessErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiProjectsByProjectIdAccessResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		users: Array<{
+			subjectId: string;
+			name: string;
+			email: string | null;
+			isAdmin: boolean;
+			permissionCount: number;
+		}>;
+	};
+};
+export type GetApiSubjectsData = {
+	body?: never;
+	path?: never;
+	query?: {
+		q?: string;
+		type?: "user" | "machine";
+		limit?: number;
+		offset?: number;
+	};
+	url: "/api/subjects";
+};
+export type GetApiSubjectsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiSubjectsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		subjects: Array<{
+			id: string;
+			name: string;
+			email: string | null;
+			type: "user" | "machine";
+		}>;
+		total: number;
+	};
+};
+export type GetApiProjectsByProjectIdSubjectsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: {
+		q?: string;
+		limit?: number;
+		offset?: number;
+	};
+	url: "/api/projects/{projectId}/subjects";
+};
+export type GetApiProjectsByProjectIdSubjectsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiProjectsByProjectIdSubjectsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		subjects: Array<{
+			id: string;
+			name: string;
+			email: string | null;
+			type: "user";
+			isAdmin: boolean;
+			permissionCount: number;
+		}>;
+		total: number;
+	};
+};
+export type GetApiProjectsByProjectIdPermissionsMatrixData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query: {
+		subjectId: string;
+	};
+	url: "/api/projects/{projectId}/permissions/matrix";
+};
+export type GetApiProjectsByProjectIdPermissionsMatrixErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiProjectsByProjectIdPermissionsMatrixResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		subject: {
+			id: string;
+			name: string;
+			type: "user" | "machine";
+		};
+		secrets: Array<{
+			name: string;
+			description: string | null;
+			environments: Array<"dev" | "staging" | "production">;
+			secretIds: {
+				dev?: string;
+				staging?: string;
+				production?: string;
+			};
+		}>;
+		permissions: Array<{
+			secretId: string;
+			environment: "dev" | "staging" | "production";
+			permissionId: string;
+		}>;
+	};
+};
+export type PostApiProjectsByProjectIdPermissionsBatchData = {
+	body: {
+		subjectId: string;
+		add: Array<{
+			secretId: string;
+			environment: "dev" | "staging" | "production";
+		}>;
+		remove: Array<{
+			permissionId: string;
+		}>;
+	};
+	path: {
+		projectId: string;
+	};
+	query?: never;
+	url: "/api/projects/{projectId}/permissions/batch";
+};
+export type PostApiProjectsByProjectIdPermissionsBatchErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiProjectsByProjectIdPermissionsBatchResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		added: number;
+		removed: number;
+	};
+};
+export type GetApiProjectsByProjectIdPermissionsAuditLogsData = {
+	body?: never;
+	path: {
+		projectId: string;
+	};
+	query?: {
+		eventType?: "permission_granted" | "permission_revoked";
+		subjectId?: string;
+		environment?: "dev" | "staging" | "production";
+		limit?: number;
+		offset?: number;
+	};
+	url: "/api/projects/{projectId}/permissions/audit-logs";
+};
+export type GetApiProjectsByProjectIdPermissionsAuditLogsErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiProjectsByProjectIdPermissionsAuditLogsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		entries: Array<{
+			id: string;
+			eventType: "permission_granted" | "permission_revoked";
+			subjectId: string;
+			subjectName: string;
+			projectId: string;
+			environment: "dev" | "staging" | "production" | null;
+			secretNames: string | null;
+			success: boolean;
+			details: string | null;
+			createdAt: number;
+		}>;
+		total: number;
+	};
+};
+export type GetApiMachinesByIdPermissionsData = {
+	body?: never;
+	path: {
+		id: string;
+	};
+	query?: never;
+	url: "/api/machines/{id}/permissions";
+};
+export type GetApiMachinesByIdPermissionsErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiMachinesByIdPermissionsResponses = {
+	/**
+	 * Successful response
+	 */
+	200: Array<{
+		projectId: string;
+		projectName: string;
+		secretId: string;
+		secretName: string;
+		environment: "dev" | "staging" | "production";
+	}>;
+};
+export type GetApiMachinesByIdPermissionsMatrixData = {
+	body?: never;
+	path: {
+		id: string;
+	};
+	query: {
+		projectId: string;
+	};
+	url: "/api/machines/{id}/permissions/matrix";
+};
+export type GetApiMachinesByIdPermissionsMatrixErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiMachinesByIdPermissionsMatrixResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		machine: {
+			id: string;
+			name: string;
+		};
+		isAdmin: boolean;
+		secrets: Array<{
+			name: string;
+			description: string | null;
+			environments: Array<"dev" | "staging" | "production">;
+			secretIds: {
+				dev?: string;
+				staging?: string;
+				production?: string;
+			};
+		}>;
+		permissions: Array<{
+			secretId: string;
+			environment: "dev" | "staging" | "production";
+			permissionId: string;
+		}>;
+	};
+};
+export type PostApiMachinesByIdPermissionsBatchData = {
+	body: {
+		projectId: string;
+		add: Array<{
+			secretId: string;
+			environment: "dev" | "staging" | "production";
+		}>;
+		remove: Array<{
+			permissionId: string;
+		}>;
+	};
+	path: {
+		id: string;
+	};
+	query?: never;
+	url: "/api/machines/{id}/permissions/batch";
+};
+export type PostApiMachinesByIdPermissionsBatchErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiMachinesByIdPermissionsBatchResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		added: number;
+		removed: number;
+	};
+};
+export type PostApiMachinesByIdRegenerateData = {
+	body?: never;
+	path: {
+		id: string;
+	};
+	query?: never;
+	url: "/api/machines/{id}/regenerate";
+};
+export type PostApiMachinesByIdRegenerateErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiMachinesByIdRegenerateResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		id: string;
+		rawId: string;
+	};
+};
+export type DeleteApiMachinesByIdData = {
+	body?: never;
+	path: {
+		id: string;
+	};
+	query?: never;
+	url: "/api/machines/{id}";
+};
+export type DeleteApiMachinesByIdErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type DeleteApiMachinesByIdResponses = {
+	/**
+	 * Machine deleted
+	 */
+	204: void;
+};
+export type GetApiMachinesByIdData = {
+	body?: never;
+	path: {
+		id: string;
+	};
+	query?: never;
+	url: "/api/machines/{id}";
+};
+export type GetApiMachinesByIdErrors = {
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiMachinesByIdResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		id: string;
+		type: "machine";
+		name: string;
+		idMasked: string;
+		createdBy: string;
+		createdAt: number;
+		updatedAt: number;
+		lastUsed: number | null;
+	};
+};
+export type PatchApiMachinesByIdData = {
+	body: {
+		name: string;
+	};
+	path: {
+		id: string;
+	};
+	query?: never;
+	url: "/api/machines/{id}";
+};
+export type PatchApiMachinesByIdErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PatchApiMachinesByIdResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		id: string;
+		type: "machine";
+		name: string;
+		idMasked: string;
+		createdBy: string;
+		createdAt: number;
+		updatedAt: number;
+		lastUsed: number | null;
+	};
+};
+export type DeleteApiMachinesData = {
+	body: {
+		ids: Array<string>;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/machines";
+};
+export type DeleteApiMachinesErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type DeleteApiMachinesResponses = {
+	/**
+	 * Machines deleted
+	 */
+	204: void;
+};
+export type GetApiMachinesData = {
+	body?: never;
+	path?: never;
+	query?: {
+		limit?: number;
+		offset?: number;
+		search?: string;
+	};
+	url: "/api/machines";
+};
+export type GetApiMachinesErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type GetApiMachinesResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		machines: Array<{
+			id: string;
+			type: "machine";
+			name: string;
+			idMasked: string;
+			createdBy: string;
+			createdAt: number;
+			updatedAt: number;
+			lastUsed: number | null;
+		}>;
+		total: number;
+	};
+};
+export type PatchApiMachinesData = {
+	body: Array<{
+		id: string;
+		name: string;
+	}>;
+	path?: never;
+	query?: never;
+	url: "/api/machines";
+};
+export type PatchApiMachinesErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PatchApiMachinesResponses = {
+	/**
+	 * Successful response
+	 */
+	200: Array<{
+		id: string;
+		type: "machine";
+		name: string;
+		idMasked: string;
+		createdBy: string;
+		createdAt: number;
+		updatedAt: number;
+		lastUsed: number | null;
+	}>;
+};
+export type PostApiMachinesData = {
+	body: {
+		name: string;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/machines";
+};
+export type PostApiMachinesErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiMachinesResponses = {
+	/**
+	 * Machine created
+	 */
+	201: {
+		id: string;
+		type: "machine";
+		name: string;
+		idMasked: string;
+		createdBy: string;
+		createdAt: number;
+		updatedAt: number;
+		lastUsed: number | null;
+		rawId: string;
+	};
+};
+export type PostApiMachinesQueryData = {
+	body: {
+		ids: Array<string>;
+	};
+	path?: never;
+	query?: never;
+	url: "/api/machines/query";
+};
+export type PostApiMachinesQueryErrors = {
+	/**
+	 * Bad Request
+	 */
+	400: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Unauthorized
+	 */
+	401: {
+		message: string;
+		details?: unknown;
+	};
+	/**
+	 * Forbidden — insufficient permissions
+	 */
+	403: {
+		message: string;
+		details?: unknown;
+	};
+};
+export type PostApiMachinesQueryResponses = {
+	/**
+	 * Successful response
+	 */
+	200: {
+		machines: Array<{
+			id: string;
+			type: "machine";
+			name: string;
+			idMasked: string;
+			createdBy: string;
+			createdAt: number;
+			updatedAt: number;
+			lastUsed: number | null;
+		}>;
+		total: number;
+	};
+};
+export type DeleteApiLumiblueTokenData = {
+	body?: never;
+	path?: never;
+	query?: never;
+	url: "/api/lumiblue-token";
+};
+export type DeleteApiLumiblueTokenResponses = {
+	/**
+	 * Cookie cleared; no response body.
+	 */
+	204: void;
+};
+type Options$1<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options<TData, ThrowOnError, TResponse> & {
+	/**
+	 * You can provide a client instance returned by `createClient()` instead of
+	 * individual options. This might be also useful if you want to implement a
+	 * custom client.
+	 */
+	client?: Client$1;
+	/**
+	 * You can pass arbitrary values through the `meta` object. This can be
+	 * used to access values that aren't defined as part of the SDK function.
+	 */
+	meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+declare class HeyApiClient {
+	protected client: Client$1;
+	constructor(args?: {
+		client?: Client$1;
+	});
+}
+declare class HeyApiRegistry<T> {
+	private readonly defaultKey;
+	private readonly instances;
+	get(key?: string): T;
+	set(value: T, key?: string): void;
+}
+export declare class Sdk extends HeyApiClient {
+	static readonly __registry: HeyApiRegistry<Sdk>;
+	constructor(args?: {
+		client?: Client$1;
+		key?: string;
+	});
+	/**
+	 * Service health check response
+	 */
+	getApiHealth<ThrowOnError extends boolean = false>(options?: Options$1<GetApiHealthData, ThrowOnError>): RequestResult<GetApiHealthResponses, unknown, ThrowOnError>;
+	/**
+	 * Bearer Auth - service health check plus JWT payload
+	 */
+	getApiHealthMe<ThrowOnError extends boolean = false>(options?: Options$1<GetApiHealthMeData, ThrowOnError>): RequestResult<GetApiHealthMeResponses, GetApiHealthMeErrors, ThrowOnError>;
+	/**
+	 * Bulk delete projects by array of IDs (project-admin only).
+	 */
+	deleteApiVaultProjects<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiVaultProjectsData, ThrowOnError>): RequestResult<DeleteApiVaultProjectsResponses, DeleteApiVaultProjectsErrors, ThrowOnError>;
+	/**
+	 * List all projects accessible to the authenticated user, with per-project secret count.
+	 */
+	getApiVaultProjects<ThrowOnError extends boolean = false>(options?: Options$1<GetApiVaultProjectsData, ThrowOnError>): RequestResult<GetApiVaultProjectsResponses, GetApiVaultProjectsErrors, ThrowOnError>;
+	/**
+	 * Bulk update projects (project-admin only).
+	 */
+	patchApiVaultProjects<ThrowOnError extends boolean = false>(options: Options$1<PatchApiVaultProjectsData, ThrowOnError>): RequestResult<PatchApiVaultProjectsResponses, PatchApiVaultProjectsErrors, ThrowOnError>;
+	/**
+	 * Create one or more projects and auto-assign the creator as admin on each.
+	 */
+	putApiVaultProjects<ThrowOnError extends boolean = false>(options: Options$1<PutApiVaultProjectsData, ThrowOnError>): RequestResult<PutApiVaultProjectsResponses, PutApiVaultProjectsErrors, ThrowOnError>;
+	/**
+	 * Get all secrets for a project, pivoted by environment (dev, staging, production).
+	 */
+	getApiVaultProjectsByProjectIdSecrets<ThrowOnError extends boolean = false>(options: Options$1<GetApiVaultProjectsByProjectIdSecretsData, ThrowOnError>): RequestResult<GetApiVaultProjectsByProjectIdSecretsResponses, GetApiVaultProjectsByProjectIdSecretsErrors, ThrowOnError>;
+	/**
+	 * Reveal the decrypted plaintext value of a single secret. Call on demand when the user chooses to view it.
+	 */
+	getApiVaultSecretsBySecretId<ThrowOnError extends boolean = false>(options: Options$1<GetApiVaultSecretsBySecretIdData, ThrowOnError>): RequestResult<GetApiVaultSecretsBySecretIdResponses, GetApiVaultSecretsBySecretIdErrors, ThrowOnError>;
+	/**
+	 * Update a single secret value. The plaintext value is encrypted before persisting.
+	 */
+	patchApiVaultSecretsBySecretId<ThrowOnError extends boolean = false>(options: Options$1<PatchApiVaultSecretsBySecretIdData, ThrowOnError>): RequestResult<PatchApiVaultSecretsBySecretIdResponses, PatchApiVaultSecretsBySecretIdErrors, ThrowOnError>;
+	/**
+	 * Inject secrets for a machine identity. Authenticates via SHA-256 hash of machineId.
+	 */
+	postApiVaultInject<ThrowOnError extends boolean = false>(options: Options$1<PostApiVaultInjectData, ThrowOnError>): RequestResult<PostApiVaultInjectResponses, PostApiVaultInjectErrors, ThrowOnError>;
+	/**
+	 * Batch query projects by array of IDs (access-scoped).
+	 */
+	postApiVaultProjectsQuery<ThrowOnError extends boolean = false>(options: Options$1<PostApiVaultProjectsQueryData, ThrowOnError>): RequestResult<PostApiVaultProjectsQueryResponses, PostApiVaultProjectsQueryErrors, ThrowOnError>;
+	/**
+	 * Bulk delete secrets by array of IDs (permission-scoped).
+	 */
+	deleteApiVaultSecrets<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiVaultSecretsData, ThrowOnError>): RequestResult<DeleteApiVaultSecretsResponses, DeleteApiVaultSecretsErrors, ThrowOnError>;
+	/**
+	 * Bulk update secrets (permission-scoped).
+	 */
+	patchApiVaultSecrets<ThrowOnError extends boolean = false>(options: Options$1<PatchApiVaultSecretsData, ThrowOnError>): RequestResult<PatchApiVaultSecretsResponses, PatchApiVaultSecretsErrors, ThrowOnError>;
+	/**
+	 * Bulk create secrets (plaintext values are encrypted before persisting).
+	 */
+	putApiVaultSecrets<ThrowOnError extends boolean = false>(options: Options$1<PutApiVaultSecretsData, ThrowOnError>): RequestResult<PutApiVaultSecretsResponses, PutApiVaultSecretsErrors, ThrowOnError>;
+	/**
+	 * Batch query secrets by array of IDs (permission-scoped).
+	 */
+	postApiVaultSecretsQuery<ThrowOnError extends boolean = false>(options: Options$1<PostApiVaultSecretsQueryData, ThrowOnError>): RequestResult<PostApiVaultSecretsQueryResponses, PostApiVaultSecretsQueryErrors, ThrowOnError>;
+	/**
+	 * Turn DMS off by hard-deleting the dms row (owner only). Idempotent when already off.
+	 */
+	deleteApiVaultProjectsByProjectIdDms<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiVaultProjectsByProjectIdDmsData, ThrowOnError>): RequestResult<DeleteApiVaultProjectsByProjectIdDmsResponses, DeleteApiVaultProjectsByProjectIdDmsErrors, ThrowOnError>;
+	/**
+	 * Read DMS settings for a vault project (owner only). Missing row returns stable off payload.
+	 */
+	getApiVaultProjectsByProjectIdDms<ThrowOnError extends boolean = false>(options: Options$1<GetApiVaultProjectsByProjectIdDmsData, ThrowOnError>): RequestResult<GetApiVaultProjectsByProjectIdDmsResponses, GetApiVaultProjectsByProjectIdDmsErrors, ThrowOnError>;
+	/**
+	 * Edit DMS settings (owner only). Emails-only edits preserve delivery/reminder/claim fields.
+	 */
+	patchApiVaultProjectsByProjectIdDms<ThrowOnError extends boolean = false>(options: Options$1<PatchApiVaultProjectsByProjectIdDmsData, ThrowOnError>): RequestResult<PatchApiVaultProjectsByProjectIdDmsResponses, PatchApiVaultProjectsByProjectIdDmsErrors, ThrowOnError>;
+	/**
+	 * Arm / create DMS for a project (owner only). Resets reminder, delivery, and claim cursors.
+	 */
+	putApiVaultProjectsByProjectIdDms<ThrowOnError extends boolean = false>(options: Options$1<PutApiVaultProjectsByProjectIdDmsData, ThrowOnError>): RequestResult<PutApiVaultProjectsByProjectIdDmsResponses, PutApiVaultProjectsByProjectIdDmsErrors, ThrowOnError>;
+	/**
+	 * Public proof-of-life HTML page (signed magic-link token; no JWT).
+	 */
+	getApiDmsProofByToken<ThrowOnError extends boolean = false>(options: Options$1<GetApiDmsProofByTokenData, ThrowOnError>): RequestResult<GetApiDmsProofByTokenResponses, GetApiDmsProofByTokenErrors, ThrowOnError>;
+	/**
+	 * Public proof-of-life update. Omit deliveryDate to extend by DMS_DEFAULT_EXTEND_DAYS.
+	 */
+	patchApiDmsProofByToken<ThrowOnError extends boolean = false>(options: Options$1<PatchApiDmsProofByTokenData, ThrowOnError>): RequestResult<PatchApiDmsProofByTokenResponses, PatchApiDmsProofByTokenErrors, ThrowOnError>;
+	/**
+	 * Public project wipe via claim token. Confirmation must equal the project name.
+	 */
+	deleteApiDmsClaimByToken<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiDmsClaimByTokenData, ThrowOnError>): RequestResult<DeleteApiDmsClaimByTokenResponses, DeleteApiDmsClaimByTokenErrors, ThrowOnError>;
+	/**
+	 * Public claim HTML page with project notes and decrypted secrets (token credential).
+	 */
+	getApiDmsClaimByToken<ThrowOnError extends boolean = false>(options: Options$1<GetApiDmsClaimByTokenData, ThrowOnError>): RequestResult<GetApiDmsClaimByTokenResponses, GetApiDmsClaimByTokenErrors, ThrowOnError>;
+	/**
+	 * List audit logs for a project. Only accessible by project admins. Supports date range filtering, pagination, and optional filters.
+	 */
+	getApiProjectsByProjectIdAuditLogs<ThrowOnError extends boolean = false>(options: Options$1<GetApiProjectsByProjectIdAuditLogsData, ThrowOnError>): RequestResult<GetApiProjectsByProjectIdAuditLogsResponses, GetApiProjectsByProjectIdAuditLogsErrors, ThrowOnError>;
+	/**
+	 * List all admins for a project
+	 */
+	getApiProjectsByProjectIdAdmins<ThrowOnError extends boolean = false>(options: Options$1<GetApiProjectsByProjectIdAdminsData, ThrowOnError>): RequestResult<GetApiProjectsByProjectIdAdminsResponses, GetApiProjectsByProjectIdAdminsErrors, ThrowOnError>;
+	/**
+	 * Add a new admin to a project
+	 */
+	postApiProjectsByProjectIdAdmins<ThrowOnError extends boolean = false>(options: Options$1<PostApiProjectsByProjectIdAdminsData, ThrowOnError>): RequestResult<PostApiProjectsByProjectIdAdminsResponses, PostApiProjectsByProjectIdAdminsErrors, ThrowOnError>;
+	/**
+	 * Remove an admin from a project
+	 */
+	deleteApiProjectsByProjectIdAdminsBySubjectId<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiProjectsByProjectIdAdminsBySubjectIdData, ThrowOnError>): RequestResult<DeleteApiProjectsByProjectIdAdminsBySubjectIdResponses, DeleteApiProjectsByProjectIdAdminsBySubjectIdErrors, ThrowOnError>;
+	/**
+	 * List all users with access to a project (admins and/or users with permission grants)
+	 */
+	getApiProjectsByProjectIdAccess<ThrowOnError extends boolean = false>(options: Options$1<GetApiProjectsByProjectIdAccessData, ThrowOnError>): RequestResult<GetApiProjectsByProjectIdAccessResponses, GetApiProjectsByProjectIdAccessErrors, ThrowOnError>;
+	/**
+	 * List or search all subjects in the authenticated tenant (users and machines)
+	 */
+	getApiSubjects<ThrowOnError extends boolean = false>(options?: Options$1<GetApiSubjectsData, ThrowOnError>): RequestResult<GetApiSubjectsResponses, GetApiSubjectsErrors, ThrowOnError>;
+	/**
+	 * List all tenant users annotated with admin status and permission-grant count for this project
+	 */
+	getApiProjectsByProjectIdSubjects<ThrowOnError extends boolean = false>(options: Options$1<GetApiProjectsByProjectIdSubjectsData, ThrowOnError>): RequestResult<GetApiProjectsByProjectIdSubjectsResponses, GetApiProjectsByProjectIdSubjectsErrors, ThrowOnError>;
+	/**
+	 * Get the permission matrix for a user subject within a project
+	 */
+	getApiProjectsByProjectIdPermissionsMatrix<ThrowOnError extends boolean = false>(options: Options$1<GetApiProjectsByProjectIdPermissionsMatrixData, ThrowOnError>): RequestResult<GetApiProjectsByProjectIdPermissionsMatrixResponses, GetApiProjectsByProjectIdPermissionsMatrixErrors, ThrowOnError>;
+	/**
+	 * Atomically add and remove permissions for a user subject in a project
+	 */
+	postApiProjectsByProjectIdPermissionsBatch<ThrowOnError extends boolean = false>(options: Options$1<PostApiProjectsByProjectIdPermissionsBatchData, ThrowOnError>): RequestResult<PostApiProjectsByProjectIdPermissionsBatchResponses, PostApiProjectsByProjectIdPermissionsBatchErrors, ThrowOnError>;
+	/**
+	 * Get permission change audit logs for a project
+	 */
+	getApiProjectsByProjectIdPermissionsAuditLogs<ThrowOnError extends boolean = false>(options: Options$1<GetApiProjectsByProjectIdPermissionsAuditLogsData, ThrowOnError>): RequestResult<GetApiProjectsByProjectIdPermissionsAuditLogsResponses, GetApiProjectsByProjectIdPermissionsAuditLogsErrors, ThrowOnError>;
+	/**
+	 * Get a read-only permission summary for a machine
+	 */
+	getApiMachinesByIdPermissions<ThrowOnError extends boolean = false>(options: Options$1<GetApiMachinesByIdPermissionsData, ThrowOnError>): RequestResult<GetApiMachinesByIdPermissionsResponses, GetApiMachinesByIdPermissionsErrors, ThrowOnError>;
+	/**
+	 * Assignable permission matrix for an owned machine (secrets the caller can see)
+	 */
+	getApiMachinesByIdPermissionsMatrix<ThrowOnError extends boolean = false>(options: Options$1<GetApiMachinesByIdPermissionsMatrixData, ThrowOnError>): RequestResult<GetApiMachinesByIdPermissionsMatrixResponses, GetApiMachinesByIdPermissionsMatrixErrors, ThrowOnError>;
+	/**
+	 * Add/remove permissions on an owned machine, capped by secrets the caller can see
+	 */
+	postApiMachinesByIdPermissionsBatch<ThrowOnError extends boolean = false>(options: Options$1<PostApiMachinesByIdPermissionsBatchData, ThrowOnError>): RequestResult<PostApiMachinesByIdPermissionsBatchResponses, PostApiMachinesByIdPermissionsBatchErrors, ThrowOnError>;
+	/**
+	 * Regenerate a machine ID (old ID invalidated immediately)
+	 */
+	postApiMachinesByIdRegenerate<ThrowOnError extends boolean = false>(options: Options$1<PostApiMachinesByIdRegenerateData, ThrowOnError>): RequestResult<PostApiMachinesByIdRegenerateResponses, PostApiMachinesByIdRegenerateErrors, ThrowOnError>;
+	/**
+	 * Delete a machine (cascade permissions)
+	 */
+	deleteApiMachinesById<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiMachinesByIdData, ThrowOnError>): RequestResult<DeleteApiMachinesByIdResponses, DeleteApiMachinesByIdErrors, ThrowOnError>;
+	/**
+	 * Get a single machine by ID (masked)
+	 */
+	getApiMachinesById<ThrowOnError extends boolean = false>(options: Options$1<GetApiMachinesByIdData, ThrowOnError>): RequestResult<GetApiMachinesByIdResponses, GetApiMachinesByIdErrors, ThrowOnError>;
+	/**
+	 * Rename a machine (name only)
+	 */
+	patchApiMachinesById<ThrowOnError extends boolean = false>(options: Options$1<PatchApiMachinesByIdData, ThrowOnError>): RequestResult<PatchApiMachinesByIdResponses, PatchApiMachinesByIdErrors, ThrowOnError>;
+	/**
+	 * Bulk delete machines (cascade permissions)
+	 */
+	deleteApiMachines<ThrowOnError extends boolean = false>(options: Options$1<DeleteApiMachinesData, ThrowOnError>): RequestResult<DeleteApiMachinesResponses, DeleteApiMachinesErrors, ThrowOnError>;
+	/**
+	 * List own machines (creator-scoped, masked IDs)
+	 */
+	getApiMachines<ThrowOnError extends boolean = false>(options?: Options$1<GetApiMachinesData, ThrowOnError>): RequestResult<GetApiMachinesResponses, GetApiMachinesErrors, ThrowOnError>;
+	/**
+	 * Bulk update machine names
+	 */
+	patchApiMachines<ThrowOnError extends boolean = false>(options: Options$1<PatchApiMachinesData, ThrowOnError>): RequestResult<PatchApiMachinesResponses, PatchApiMachinesErrors, ThrowOnError>;
+	/**
+	 * Create a new machine identity (rawId shown once)
+	 */
+	postApiMachines<ThrowOnError extends boolean = false>(options: Options$1<PostApiMachinesData, ThrowOnError>): RequestResult<PostApiMachinesResponses, PostApiMachinesErrors, ThrowOnError>;
+	/**
+	 * Batch-get machines by IDs
+	 */
+	postApiMachinesQuery<ThrowOnError extends boolean = false>(options: Options$1<PostApiMachinesQueryData, ThrowOnError>): RequestResult<PostApiMachinesQueryResponses, PostApiMachinesQueryErrors, ThrowOnError>;
+	/**
+	 * Clears the lumiblue-token HttpOnly cookie so the browser stops sending it on subsequent requests.
+	 */
+	deleteApiLumiblueToken<ThrowOnError extends boolean = false>(options?: Options$1<DeleteApiLumiblueTokenData, ThrowOnError>): RequestResult<DeleteApiLumiblueTokenResponses, unknown, ThrowOnError>;
+}
+/** Hey API client plus Identity helpers (logout, setApiKey, setToken, server list). */
+export type IdentityClient = Client$1 & {
+	logout: () => Promise<void>;
+	getAvailableServers: () => readonly string[];
+	setApiKey: (key?: string) => void;
+	setToken: (token?: string) => void;
+};
+/** Options for {@link createSdkClient}. */
+export type CreateSdkClientOptions = {
+	/** API base URLs for failover (defaults to OpenAPI servers). */
+	servers?: string[];
+	/** Optional M2M API key applied at construction. */
+	apiKey?: string;
+};
+/**
+ * Creates an Identity HTTP client with multi-server failover, JWT refresh,
+ * and optional M2M API-key auth. Each call gets isolated credential state.
+ *
+ * @param options - Optional servers and apiKey overrides.
+ * @returns Augmented client usable with `new Sdk({ client })`.
+ */
+export declare function createSdkClient(options?: CreateSdkClientOptions): IdentityClient;
+/** Default shared client used by `new Sdk()` when no client is passed. */
+export declare const client: IdentityClient;
+
+export {
+	Options$1 as Options,
+};
+
+export {};