@ninedeploy/sdk 0.18.4 → 0.18.10

package/dist/resources/traefik.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traefik.d.ts","sourceRoot":"","sources":["../../src/resources/traefik.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;QACrC,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAClD;;;;;;;;WAQG;QACH,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC7F;;;;WAIG;QACH,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,yBAAyB,EAAE,CAAA;SAAE,CAAC,CAAC;QAC7I,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC1D,sEAAsE;QACtE,WAAW,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChE,sFAAsF;QACtF,MAAM,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC5C,+DAA+D;QAC/D,OAAO,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3C;;;;WAIG;QACH,MAAM,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAClE;;;WAGG;QACH,sGAAsG;QACtG,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;YACzC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SAC1D,CAAC;QACF,YAAY,EAAE;YACZ,GAAG,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACxC,uBAAuB;YACvB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;YACtE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC9D,KAAK,EAAE,MAAM,OAAO,CAAC;gBAAE,EAAE,EAAE,OAAO,CAAC;gBAAC,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SACzD,CAAC;QACF,0FAA0F;QAC1F,kBAAkB,EAAE;YAClB,IAAI,EAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,EAAE,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SAClD,CAAC;KACH,CAAC;CACH;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CA2CnD"}
+{"version":3,"file":"traefik.d.ts","sourceRoot":"","sources":["../../src/resources/traefik.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;QACrC,YAAY,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAClD;;;;;;;;WAQG;QACH,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC7F;;;;WAIG;QACH,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,yBAAyB,EAAE,CAAA;SAAE,CAAC,CAAC;QAC7I,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC1D,sEAAsE;QACtE,WAAW,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChE,sFAAsF;QACtF,MAAM,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC5C,+DAA+D;QAC/D,OAAO,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3C;;;;WAIG;QACH,MAAM,EAAE,MAAM,OAAO,CAAC;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAClE;;;WAGG;QACH,sGAAsG;QACtG,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;YACzC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SAC1D,CAAC;QACF,YAAY,EAAE;YACZ,GAAG,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACxC,uBAAuB;YACvB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;YACtE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC9D,KAAK,EAAE,MAAM,OAAO,CAAC;gBAAE,EAAE,EAAE,OAAO,CAAC;gBAAC,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SACzD,CAAC;QACF,0FAA0F;QAC1F,kBAAkB,EAAE;YAClB,IAAI,EAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;gBAAE,EAAE,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SAClD,CAAC;QACF,iHAAiH;QACjH,kBAAkB,EAAE;YAClB,GAAG,EAAE,MAAM,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;YACzC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,CAAA;aAAE,CAAC,CAAC;SAC1D,CAAC;KACH,CAAC;CACH;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CA+CnD"}

package/dist/resources/traefik.js

@@ -33,6 +33,10 @@ export function traefikApi(t) {
                 replace: (id, input) => send('PUT', `/v1/traefik/certificates/custom/${id}`, input),
                 delete: (id) => send('DELETE', `/v1/traefik/certificates/custom/${id}`),
             },
+            sharedCertificates: {
+                get: () => get('/v1/traefik/certificates/shared'),
+                set: (enabled) => send('PUT', '/v1/traefik/certificates/shared', { enabled }),
+            },
         },
     };
 }

package/dist/resources/traefik.js.map

@@ -1 +1 @@
-{"version":3,"file":"traefik.js","sourceRoot":"","sources":["../../src/resources/traefik.ts"],"names":[],"mappings":"AAiFA,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO;QACL,OAAO,EAAE;YACP,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAc,aAAa,CAAC;YAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,oBAAoB,CAAC;YACtD,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,0BAA0B,CAAC;YACzE,oBAAoB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7B,GAAG;YACD,mEAAmE;YACnE,+DAA+D;YAC/D,6BAA6B;YAC7B,qCAAqC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACrG;YACH,oBAAoB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7B,GAAG,CACD,oCAAoC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACrF;YACH,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAqB,0BAA0B,KAAK,EAAE,CAAC;YAChF,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAmC,MAAM,EAAE,qBAAqB,CAAC;YACpF,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAsC,MAAM,EAAE,0BAA0B,CAAC;YAChG,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,oBAAoB,CAAC;YAC7D,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAqB,qBAAqB,CAAC;YAC7D,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAA6C,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;YACxH,KAAK,EAAE;gBACL,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,mBAAmB,CAAC;gBACzD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAuB,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC;aACtF;YACD,YAAY,EAAE;gBACZ,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAsB,2BAA2B,CAAC;gBAChE,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAgC,MAAM,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,CAAC;gBACrH,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,CAA6B,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACxH,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAoC,QAAQ,EAAE,2BAA2B,CAAC;aAC5F;YACD,kBAAkB,EAAE;gBAClB,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAsB,iCAAiC,CAAC;gBACvE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAyB,MAAM,EAAE,iCAAiC,EAAE,KAAK,CAAC;gBACjG,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAyB,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,KAAK,CAAC;gBAC3G,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAkB,QAAQ,EAAE,mCAAmC,EAAE,EAAE,CAAC;aACzF;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"traefik.js","sourceRoot":"","sources":["../../src/resources/traefik.ts"],"names":[],"mappings":"AAsFA,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO;QACL,OAAO,EAAE;YACP,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAc,aAAa,CAAC;YAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAgB,oBAAoB,CAAC;YACtD,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,0BAA0B,CAAC;YACzE,oBAAoB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7B,GAAG;YACD,mEAAmE;YACnE,+DAA+D;YAC/D,6BAA6B;YAC7B,qCAAqC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACrG;YACH,oBAAoB,EAAE,CAAC,IAAI,EAAE,EAAE,CAC7B,GAAG,CACD,oCAAoC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACrF;YACH,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAqB,0BAA0B,KAAK,EAAE,CAAC;YAChF,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAmC,MAAM,EAAE,qBAAqB,CAAC;YACpF,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAsC,MAAM,EAAE,0BAA0B,CAAC;YAChG,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,oBAAoB,CAAC;YAC7D,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAqB,qBAAqB,CAAC;YAC7D,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAA6C,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;YACxH,KAAK,EAAE;gBACL,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,mBAAmB,CAAC;gBACzD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAuB,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC;aACtF;YACD,YAAY,EAAE;gBACZ,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAsB,2BAA2B,CAAC;gBAChE,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAgC,MAAM,EAAE,oCAAoC,EAAE,EAAE,OAAO,EAAE,CAAC;gBACrH,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,CAA6B,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACxH,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAoC,QAAQ,EAAE,2BAA2B,CAAC;aAC5F;YACD,kBAAkB,EAAE;gBAClB,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAsB,iCAAiC,CAAC;gBACvE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAyB,MAAM,EAAE,iCAAiC,EAAE,KAAK,CAAC;gBACjG,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAyB,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,KAAK,CAAC;gBAC3G,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAkB,QAAQ,EAAE,mCAAmC,EAAE,EAAE,CAAC;aACzF;YACD,kBAAkB,EAAE;gBAClB,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAuB,iCAAiC,CAAC;gBACvE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAuB,KAAK,EAAE,iCAAiC,EAAE,EAAE,OAAO,EAAE,CAAC;aACpG;SACF;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ninedeploy/sdk",
-  "version": "0.18.4",
+  "version": "0.18.10",
   "description": "Official TypeScript SDK for NineDeploy PaaS",
   "license": "MIT",
   "repository": {
@@ -25,7 +25,7 @@
     }
   },
   "dependencies": {
-    "@ninedeploy/schemas": "0.18.4",
+    "@ninedeploy/schemas": "0.18.10",
     "js-yaml": "^4.3.1"
   },
   "devDependencies": {

package/src/index.ts

@@ -116,7 +116,7 @@ export type {
 
 export { createClient } from './client.js';
 export type { NineDeployClient } from './client.js';
-export type { AutoUrlMode, AutoUrlEffective, AutoUrlSettings, OnboardingStatus, OnboardingStepId } from './resources/settings.js';
-export type { SourceUpload } from './resources/services.js';
+export type { AutoUrlMode, AutoUrlEffective, AutoUrlSettings, OnboardingStatus, OnboardingStepId, DnsCredentialProviderName, DnsProviderSettings } from './resources/settings.js';
+export type { RegistryHookView, SourceUpload } from './resources/services.js';
 export type { HostIpEntry } from './resources/network.js';
 export type { MonitorCheckNowResult } from './resources/uptime.js';

package/src/resources/auth.ts

@@ -37,6 +37,9 @@ import type {
   AccessGrantUpdate,
   AccessMe,
   ProjectAccessEntry,
+  TwoFactorRequirementView,
+  WorkspaceTwoFactorInput,
+  WorkspaceTwoFactorView,
 } from '@ninedeploy/schemas';
 import { apiGetUrl } from '../apiPath.js';
 import type { TokenIntrospection } from '../types.js';
@@ -85,6 +88,8 @@ export interface AuthApi {
         status: () => Promise<{ totpEnabled: boolean; remaining: number }>;
         regenerate: (input: { code: string; password?: string }) => Promise<{ recoveryCodes: string[] }>;
       };
+      /** G1.4: what the workspace 2FA policies ask of this session (403 `two_factor_required` elsewhere until enrolled). */
+      requirement: () => Promise<TwoFactorRequirementView>;
     };
     me: () => Promise<PublicUser>;
     tokens: {
@@ -113,6 +118,12 @@ export interface AuthApi {
       list: () => Promise<ActiveSession[]>;
       revoke: (id: number) => Promise<{ ok: boolean }>;
     };
+    /** G3.6: SAML providers for the sign-in page; start each `authUrl` like an OIDC one. */
+    saml: {
+      publicProviders: () => Promise<Array<{ id: number; name: string; authUrl: string }>>;
+      /** Link a SAML identity to the signed-in account: open the answer's `authUrl`. */
+      link: (id: number) => Promise<{ authUrl: string }>;
+    };
     oidc: {
       publicProviders: () => Promise<OidcPublicProvider[]>;
       link: (slug: string) => Promise<{ authUrl: string }>;
@@ -133,6 +144,11 @@ export interface AuthApi {
     create: (input: WorkspaceCreateInput) => Promise<WorkspaceEntry>;
     update: (id: number, input: WorkspaceUpdateInput) => Promise<WorkspaceEntry>;
     delete: (id: number) => Promise<{ ok: boolean }>;
+    /** G1.4: require TOTP or a passkey of every member (admins and owners). */
+    twoFactor: {
+      get: (id: number) => Promise<WorkspaceTwoFactorView>;
+      set: (id: number, input: WorkspaceTwoFactorInput) => Promise<WorkspaceTwoFactorView>;
+    };
     /**
      * Add a member by email. r604: only an instance operator gets a direct
      * add (a `WorkspaceMemberEntry`) for a registered address; for everyone
@@ -253,6 +269,7 @@ export function authApi(t: Transport): AuthApi {
           status: () => get<{ totpEnabled: boolean; remaining: number }>('/v1/auth/2fa/recovery-codes'),
           regenerate: (input) => send<{ recoveryCodes: string[] }>('POST', '/v1/auth/2fa/recovery-codes', input),
         },
+        requirement: () => get<TwoFactorRequirementView>('/v1/auth/2fa/requirement'),
       },
       me: () => get<PublicUser>('/v1/auth/me'),
       tokens: {
@@ -283,6 +300,10 @@ export function authApi(t: Transport): AuthApi {
         list: () => get<ActiveSession[]>('/v1/auth/sessions'),
         revoke: (id) => send<{ ok: boolean }>('DELETE', `/v1/auth/sessions/${id}`),
       },
+      saml: {
+        publicProviders: () => get<Array<{ id: number; name: string; authUrl: string }>>('/v1/auth/saml/providers/public'),
+        link: (id) => send<{ authUrl: string }>('POST', `/v1/auth/saml/${id}/link`, {}),
+      },
       oidc: {
         publicProviders: () => get<OidcPublicProvider[]>('/v1/auth/oidc/providers/public'),
         link: (slug) => request<{ authUrl: string }>(`/v1/auth/oidc/${encodeURIComponent(slug)}/link`, { method: 'POST', credentials: 'include' }),
@@ -302,6 +323,10 @@ export function authApi(t: Transport): AuthApi {
       get: (id) => get<WorkspaceDetail>(`/v1/workspaces/${id}`),
       create: (input) => send<WorkspaceEntry>('POST', '/v1/workspaces', input),
       update: (id, input) => send<WorkspaceEntry>('PATCH', `/v1/workspaces/${id}`, input),
+      twoFactor: {
+        get: (id) => get<WorkspaceTwoFactorView>(`/v1/workspaces/${id}/two-factor`),
+        set: (id, input) => send<WorkspaceTwoFactorView>('PUT', `/v1/workspaces/${id}/two-factor`, input),
+      },
       delete: (id) => send<{ ok: boolean }>('DELETE', `/v1/workspaces/${id}`),
       addMember: (id, input) =>
         send<WorkspaceMemberEntry | WorkspaceMemberInviteEntry>('POST', `/v1/workspaces/${id}/members`, input),

package/src/resources/databases.ts

@@ -16,6 +16,8 @@ import type {
   DatabaseImport,
   DatabaseImportCreate,
   BackupDestinationObject,
+  BackupReplica,
+  BackupReplicasView,
 } from '@ninedeploy/schemas';
 import type { ImportWaitOptions, ImportFileData, ImportFileOptions } from '../databaseImport.js';
 import type { BackupDrillResult, BackupDrillEntry, PgbouncerStatus, DatabaseCredentialsWithPublic } from '../types.js';
@@ -115,6 +117,11 @@ export interface DatabasesApi {
     getPolicy: (databaseId: number) => Promise<BackupPolicy>;
     /** 0.12: save (replace) the database's backup schedule, retention and destination. */
     setPolicy: (databaseId: number, input: BackupPolicyInput) => Promise<BackupPolicy>;
+    /** G3.3: more destinations for the scheduled dumps, each with its own retention (operators set them). */
+    replicas: {
+      get: (databaseId: number) => Promise<BackupReplicasView>;
+      set: (databaseId: number, replicas: BackupReplica[]) => Promise<BackupReplicasView>;
+    };
   };
   backupDestinations: {
     list: () => Promise<Array<{ id: number; name: string; endpoint: string; region: string; bucket: string; prefix: string; active: boolean; createdAt: string }>>;
@@ -201,6 +208,10 @@ export function databasesApi(t: Transport): DatabasesApi {
       downloadUrl: (backupId) => `/v1/backups/${backupId}/download`,
       getPolicy: (databaseId) => get<BackupPolicy>(`/v1/databases/${databaseId}/backup-policy`),
       setPolicy: (databaseId, input) => send<BackupPolicy>('PUT', `/v1/databases/${databaseId}/backup-policy`, input),
+      replicas: {
+        get: (databaseId) => get<BackupReplicasView>(`/v1/databases/${databaseId}/backup-replicas`),
+        set: (databaseId, replicas) => send<BackupReplicasView>('PUT', `/v1/databases/${databaseId}/backup-replicas`, { replicas }),
+      },
     },
     backupDestinations: {
       list: () => get('/v1/backup-destinations'),

package/src/resources/deploys.ts

@@ -17,6 +17,11 @@ import type {
   TriggerDeploy,
   Webhook,
   ImageTransfer,
+  DeployFreeze,
+  DeployFreezeCreate,
+  ImageScanPolicy,
+  ImageScanPolicyPatch,
+  ImageScanResult,
 } from '@ninedeploy/schemas';
 import type { JobKind, ScheduledJob, JobRun } from '../types.js';
 import type { Transport } from '../transport.js';
@@ -144,11 +149,43 @@ export interface DeploysApi {
      */
     analyzeLogs: (serviceId: number, input?: { tail?: number }) => Promise<RuntimeLogAnalysis>;
   };
+  /**
+   * G5.5 deploy freezes (operator only). A freeze holds every deploy of the
+   * instance, a workspace, a project or an environment in the queue until it
+   * ends (`until`) or is lifted; held deploys then start.
+   */
+  deployFreezes: {
+    list: () => Promise<DeployFreeze[]>;
+    create: (input: DeployFreezeCreate) => Promise<DeployFreeze>;
+    lift: (id: string) => Promise<DeployFreeze>;
+  };
+  /**
+   * G5.1 image vulnerability scanning (Trivy on the panel host). The policy is
+   * operator only; a service's latest scan is readable by its viewers, and
+   * `scan` (service admin) starts a scan of what runs now in the background.
+   */
+  imageScans: {
+    policy: () => Promise<{ policy: ImageScanPolicy; trivyImage: string }>;
+    setPolicy: (patch: ImageScanPolicyPatch) => Promise<{ policy: ImageScanPolicy; trivyImage: string }>;
+    get: (serviceId: number) => Promise<{ result: ImageScanResult | null; scanning: boolean }>;
+    scan: (serviceId: number) => Promise<{ started: true; imageId: string | null }>;
+  };
 }
 
 export function deploysApi(t: Transport): DeploysApi {
   const { get, send, request } = t;
   return {
+    imageScans: {
+      policy: () => get<{ policy: ImageScanPolicy; trivyImage: string }>('/v1/image-scanning'),
+      setPolicy: (patch) => send<{ policy: ImageScanPolicy; trivyImage: string }>('PUT', '/v1/image-scanning', patch),
+      get: (serviceId) => get<{ result: ImageScanResult | null; scanning: boolean }>(`/v1/services/${serviceId}/image-scan`),
+      scan: (serviceId) => send<{ started: true; imageId: string | null }>('POST', `/v1/services/${serviceId}/image-scan`),
+    },
+    deployFreezes: {
+      list: () => get<DeployFreeze[]>('/v1/deploy-freezes'),
+      create: (input) => send<DeployFreeze>('POST', '/v1/deploy-freezes', input),
+      lift: (id) => send<DeployFreeze>('DELETE', `/v1/deploy-freezes/${encodeURIComponent(id)}`),
+    },
     deploys: {
       trigger: (serviceId, input) =>
         send<{ deploymentId: number; alreadyInProgress?: boolean }>('POST', `/v1/services/${serviceId}/deploys`, input ?? {}),

package/src/resources/domains.ts

@@ -2,6 +2,12 @@
 // Split out of the former single-file SDK entry (src/index.ts); the public
 // surface is re-exported unchanged from there.
 import type {
+  ComposeRoute,
+  ComposeRouteView,
+  ForwardAuthConfig,
+  ForwardAuthGrant,
+  ForwardAuthGrantInput,
+  ForwardAuthView,
   CreateDomainInput,
   Domain,
   DomainPatch,
@@ -12,6 +18,21 @@ import type { Transport } from '../transport.js';
 
 export interface DomainsApi {
   domains: {
+    /**
+     * G2.3: panel sign-in in front of a domain. `set(id, null)` takes it off;
+     * `grant` is what the panel's /forward-auth page calls to send a signed-in
+     * user back to the protected domain.
+     */
+    forwardAuth: {
+      get: (domainId: number) => Promise<ForwardAuthView>;
+      set: (domainId: number, forwardAuth: Partial<ForwardAuthConfig> | null) => Promise<ForwardAuthView>;
+      grant: (input: ForwardAuthGrantInput) => Promise<ForwardAuthGrant>;
+    };
+    /** G2.1: route a compose stack's domain to another service of the stack (null for the main service). */
+    composeRoute: {
+      get: (domainId: number) => Promise<ComposeRouteView>;
+      set: (domainId: number, route: ComposeRoute | null) => Promise<ComposeRouteView>;
+    };
     list: (serviceId: number) => Promise<Domain[]>;
     /** Add a domain. A non-operator's hostname outside the instance zone comes back `pending` with a TXT `verification` challenge. */
     create: (serviceId: number, input: CreateDomainInput) => Promise<CreatedDomain>;
@@ -100,6 +121,15 @@ export function domainsApi(t: Transport): DomainsApi {
   const { get, send, request } = t;
   return {
     domains: {
+      forwardAuth: {
+        get: (domainId) => get<ForwardAuthView>(`/v1/domains/${domainId}/forward-auth`),
+        set: (domainId, forwardAuth) => send<ForwardAuthView>('PUT', `/v1/domains/${domainId}/forward-auth`, { forwardAuth }),
+        grant: (input) => send<ForwardAuthGrant>('POST', '/v1/forward-auth/grant', input),
+      },
+      composeRoute: {
+        get: (domainId) => get<ComposeRouteView>(`/v1/domains/${domainId}/compose-route`),
+        set: (domainId, route) => send<ComposeRouteView>('PUT', `/v1/domains/${domainId}/compose-route`, { route }),
+      },
       list: (serviceId) => get<Domain[]>(`/v1/services/${serviceId}/domains`),
       create: (serviceId, input) => send<CreatedDomain>('POST', `/v1/services/${serviceId}/domains`, input),
       verify: (serviceId, domainId) =>

package/src/resources/servers.ts

@@ -10,12 +10,22 @@ import type {
   SwarmInitInput,
   SwarmSettingsInput,
   SwarmStatus,
+  OsUpdateStatus,
+  CloudServer,
+  DigitalOceanOptions,
+  DigitalOceanServerCreate,
+  DigitalOceanStatus,
+  HetznerOptions,
+  HetznerServerCreate,
+  HetznerStatus,
 } from '@ninedeploy/schemas';
 import type { ServerListEntry, ServerRolesResult, SwarmJoinResult, SwarmLeaveResult } from '../types.js';
 import type { Transport } from '../transport.js';
 
 /** Long Swarm calls: a leave drains for up to 5 minutes; init and join run Docker on two hosts. */
 const SWARM_CALL_TIMEOUT_MS = 10 * 60_000;
+/** G4.2: a refresh or an install of unattended-upgrades / dnf-automatic can take minutes. */
+const OS_UPDATE_CALL_TIMEOUT_MS = 18 * 60_000;
 
 export interface ServersApi {
   servers: {
@@ -69,6 +79,40 @@ export interface ServersApi {
     /** Enable (step-up; 409 `swarm_not_manager`) or disable Swarm deploys. */
     settings: (input: SwarmSettingsInput) => Promise<SwarmStatus>;
   };
+  /**
+   * G4.2 OS security updates (operator only). `serverId` null is the panel
+   * host. `refresh` refreshes the package lists first. Nothing here reboots.
+   */
+  osUpdates: {
+    get: (serverId: number | null, options?: { refresh?: boolean }) => Promise<OsUpdateStatus>;
+    /** Turn automatic security updates on or off; answers the status read afterwards. */
+    setAuto: (serverId: number | null, enabled: boolean) => Promise<OsUpdateStatus>;
+  };
+  /**
+   * G4.3 cloud servers (operator only). The Hetzner Cloud token is write-only;
+   * a created server bootstraps the agent itself and turns online when it answers.
+   */
+  cloud: {
+    digitalocean: {
+      status: () => Promise<DigitalOceanStatus>;
+      setToken: (token: string) => Promise<DigitalOceanStatus>;
+      deleteToken: () => Promise<DigitalOceanStatus>;
+      options: () => Promise<DigitalOceanOptions>;
+      servers: () => Promise<CloudServer[]>;
+      createServer: (input: DigitalOceanServerCreate) => Promise<{ serverId: number; providerServerId: number; ipv4: string }>;
+      deleteServer: (serverId: number) => Promise<{ ok: boolean }>;
+    };
+    hetzner: {
+      status: () => Promise<HetznerStatus>;
+      setToken: (token: string) => Promise<HetznerStatus>;
+      deleteToken: () => Promise<HetznerStatus>;
+      options: () => Promise<HetznerOptions>;
+      servers: () => Promise<CloudServer[]>;
+      createServer: (input: HetznerServerCreate) => Promise<{ serverId: number; providerServerId: number; ipv4: string }>;
+      /** Delete the VM and its node (409 while the node hosts anything). */
+      deleteServer: (serverId: number) => Promise<{ ok: boolean }>;
+    };
+  };
   orchestrators: {
     /** Every `IOrchestrator` the running kernel has registered. G-10 PR-A. */
     list: () => Promise<{
@@ -122,6 +166,42 @@ export function serversApi(t: Transport): ServersApi {
       init: (input) => request<SwarmStatus>('/v1/swarm/init', { method: 'POST', body: input }, SWARM_CALL_TIMEOUT_MS),
       settings: (input) => send<SwarmStatus>('PUT', '/v1/swarm/settings', input),
     },
+    osUpdates: {
+      get: (serverId, options) =>
+        request<OsUpdateStatus>(
+          `${serverId == null ? '/v1/os-updates' : `/v1/servers/${serverId}/os-updates`}${options?.refresh ? '?refresh=1' : ''}`,
+          { method: 'GET' },
+          OS_UPDATE_CALL_TIMEOUT_MS,
+        ),
+      setAuto: (serverId, enabled) =>
+        request<OsUpdateStatus>(
+          serverId == null ? '/v1/os-updates/auto' : `/v1/servers/${serverId}/os-updates/auto`,
+          { method: 'POST', body: { enabled } },
+          OS_UPDATE_CALL_TIMEOUT_MS,
+        ),
+    },
+    cloud: {
+      digitalocean: {
+        status: () => get<DigitalOceanStatus>('/v1/cloud/digitalocean'),
+        setToken: (token) => send<DigitalOceanStatus>('PUT', '/v1/cloud/digitalocean/token', { token }),
+        deleteToken: () => send<DigitalOceanStatus>('DELETE', '/v1/cloud/digitalocean/token'),
+        options: () => get<DigitalOceanOptions>('/v1/cloud/digitalocean/options'),
+        servers: () => get<CloudServer[]>('/v1/cloud/digitalocean/servers'),
+        createServer: (input) =>
+          send<{ serverId: number; providerServerId: number; ipv4: string }>('POST', '/v1/cloud/digitalocean/servers', input),
+        deleteServer: (serverId) => send<{ ok: boolean }>('DELETE', `/v1/cloud/digitalocean/servers/${serverId}`),
+      },
+      hetzner: {
+        status: () => get<HetznerStatus>('/v1/cloud/hetzner'),
+        setToken: (token) => send<HetznerStatus>('PUT', '/v1/cloud/hetzner/token', { token }),
+        deleteToken: () => send<HetznerStatus>('DELETE', '/v1/cloud/hetzner/token'),
+        options: () => get<HetznerOptions>('/v1/cloud/hetzner/options'),
+        servers: () => get<CloudServer[]>('/v1/cloud/hetzner/servers'),
+        createServer: (input) =>
+          send<{ serverId: number; providerServerId: number; ipv4: string }>('POST', '/v1/cloud/hetzner/servers', input),
+        deleteServer: (serverId) => send<{ ok: boolean }>('DELETE', `/v1/cloud/hetzner/servers/${serverId}`),
+      },
+    },
     orchestrators: {
       list: () => get<{
         orchestrators: Array<{ name: string; stacks: Array<{ name: string; serviceCount: number }> }>;

package/src/resources/services.ts

@@ -4,6 +4,12 @@
 import type {
   Attachment,
   AutoscaleStatusView,
+  SizingReport,
+  RestartLimitConfig,
+  RestartLimitView,
+  PendingChangesView,
+  PendingApplyInput,
+  PendingApplyResult,
   ComposePreviewRequestInput,
   ComposePreviewResponse,
   CreateProjectInput,
@@ -42,12 +48,31 @@ import type {
   ServiceLifecycleResult,
   ServiceLifecycleView,
   ServiceLifecycleRetry,
+  ErrorPagesInput,
+  InlineDockerfileView,
+  ServiceMoveView,
+  ServiceCommitStatusView,
+  ErrorEventView,
+  ErrorIngestView,
+  ErrorIssueView,
+  ErrorPagesView,
+  MaintenanceInput,
+  MaintenanceView,
 } from '@ninedeploy/schemas';
 import { apiGetUrl } from '../apiPath.js';
 import type { ApplyManifestResult, ApplyManifestInput, ServiceDetail } from '../types.js';
 import type { Transport } from '../transport.js';
 
 /** 0.16.1: one kept upload of a service's source archive. */
+/** G1.7: the registry push webhook of one service. `url` is set only in the answer that made it. */
+export interface RegistryHookView {
+  enabled: boolean;
+  mine: boolean;
+  url: string | null;
+  createdAt: string | null;
+  lastPushAt: string | null;
+}
+
 export interface SourceUpload {
   /** First 40 hex chars of the archive's SHA-256 (the deployment's `commitSha`). */
   sha: string;
@@ -194,6 +219,72 @@ export interface ServicesApi {
     swarmRecovery: (id: number) => Promise<SwarmRecoveryEntry | null>;
     retrySwarmRecovery: (id: number) => Promise<SwarmRecoveryResult>;
     autoscale: (id: number) => Promise<AutoscaleStatusView>;
+    /** G5.6: memory and CPU limit suggestions from the metric history (viewer; advisory). */
+    sizing: (id: number) => Promise<SizingReport>;
+    /** G2.2: maintenance mode (a config turns it on, null off) and custom 502/503/504 pages. */
+    maintenance: {
+      get: (id: number) => Promise<MaintenanceView>;
+      set: (id: number, maintenance: MaintenanceInput['maintenance']) => Promise<MaintenanceView>;
+    };
+    errorPages: {
+      get: (id: number) => Promise<ErrorPagesView>;
+      set: (id: number, pages: ErrorPagesInput['pages']) => Promise<ErrorPagesView>;
+    };
+    /** G1.1: a Dockerfile pasted in the panel (null builds from the repository again). */
+    /** G5.4: errors reported by Sentry SDKs, grouped into issues. */
+    errors: {
+      list: (id: number, status?: 'unresolved' | 'resolved' | 'ignored') => Promise<ErrorIssueView[]>;
+      get: (id: number, issueId: number) => Promise<{ issue: ErrorIssueView; events: ErrorEventView[] }>;
+      setStatus: (id: number, issueId: number, status: 'unresolved' | 'resolved' | 'ignored') => Promise<ErrorIssueView>;
+      /** The DSN: `create` answers it once and replaces any earlier one. */
+      ingest: {
+        get: (id: number) => Promise<ErrorIngestView>;
+        create: (id: number) => Promise<ErrorIngestView>;
+        remove: (id: number) => Promise<ErrorIngestView>;
+      };
+    };
+    /** G3.1: move a stopped docker service to another host with its data volume (operators). */
+    move: {
+      get: (id: number) => Promise<ServiceMoveView>;
+      /** `serverId` null = the panel host. Answers at once; follow it with `get`. */
+      start: (id: number, serverId: number | null) => Promise<ServiceMoveView>;
+    };
+    inlineDockerfile: {
+      get: (id: number) => Promise<InlineDockerfileView>;
+      set: (id: number, content: string | null) => Promise<InlineDockerfileView>;
+    };
+    /**
+     * G1.7 registry push webhook: a secret URL a registry (Docker Hub, GHCR,
+     * Harbor, registry:2) calls after a push; the service redeploys when the
+     * pushed tag is its image. The URL is returned once, by `enable`.
+     */
+    /** GitLab, Gitea and Bitbucket commit statuses (ROADMAP 0.16.8 item 8). */
+    commitStatus: {
+      get: (id: number) => Promise<ServiceCommitStatusView>;
+      set: (id: number, enabled: boolean) => Promise<ServiceCommitStatusView>;
+    };
+    registryHook: {
+      get: (id: number) => Promise<RegistryHookView>;
+      enable: (id: number) => Promise<RegistryHookView>;
+      disable: (id: number) => Promise<RegistryHookView>;
+    };
+    /** G1.3: stop the service when its containers keep restarting (opt-in; member to set). */
+    restartLimit: {
+      get: (id: number) => Promise<RestartLimitView>;
+      set: (id: number, limit: RestartLimitConfig | null) => Promise<RestartLimitView>;
+    };
+    /**
+     * G5.2 pending changes tray. With staging on, edits collect (`stage`, a
+     * PATCH body) instead of applying; `apply` sends them through
+     * `update` together, optionally with a deploy.
+     */
+    pending: {
+      get: (id: number) => Promise<PendingChangesView>;
+      stage: (id: number, patch: UpdateServiceInput) => Promise<PendingChangesView>;
+      setStaging: (id: number, staging: boolean) => Promise<PendingChangesView>;
+      discard: (id: number) => Promise<PendingChangesView>;
+      apply: (id: number, input?: PendingApplyInput) => Promise<PendingApplyResult>;
+    };
     // ── 0.16.11 scale to zero ──
     /**
      * Put a docker service to sleep now (`POST /v1/services/:id/sleep`,
@@ -337,6 +428,53 @@ export function servicesApi(t: Transport): ServicesApi {
       swarmRecovery: async id => (await get<{ entry: SwarmRecoveryEntry | null }>(`/v1/services/${id}/swarm/recovery`)).entry,
       retrySwarmRecovery: id => request<SwarmRecoveryResult>(`/v1/services/${id}/swarm/recovery`, { method: 'POST' }, 600_000),
       autoscale: (id) => get<AutoscaleStatusView>(`/v1/services/${id}/autoscale`),
+      sizing: (id) => get<SizingReport>(`/v1/services/${id}/sizing`),
+      maintenance: {
+        get: (id) => get<MaintenanceView>(`/v1/services/${id}/maintenance`),
+        set: (id, maintenance) => send<MaintenanceView>('PUT', `/v1/services/${id}/maintenance`, { maintenance }),
+      },
+      errorPages: {
+        get: (id) => get<ErrorPagesView>(`/v1/services/${id}/error-pages`),
+        set: (id, pages) => send<ErrorPagesView>('PUT', `/v1/services/${id}/error-pages`, { pages }),
+      },
+      errors: {
+        list: (id, status) => get<ErrorIssueView[]>(`/v1/services/${id}/errors${status ? `?status=${status}` : ''}`),
+        get: (id, issueId) => get<{ issue: ErrorIssueView; events: ErrorEventView[] }>(`/v1/services/${id}/errors/${issueId}`),
+        setStatus: (id, issueId, status) => send<ErrorIssueView>('PATCH', `/v1/services/${id}/errors/${issueId}`, { status }),
+        ingest: {
+          get: (id) => get<ErrorIngestView>(`/v1/services/${id}/error-ingest`),
+          create: (id) => send<ErrorIngestView>('POST', `/v1/services/${id}/error-ingest`),
+          remove: (id) => send<ErrorIngestView>('DELETE', `/v1/services/${id}/error-ingest`),
+        },
+      },
+      move: {
+        get: (id) => get<ServiceMoveView>(`/v1/services/${id}/move`),
+        start: (id, serverId) => send<ServiceMoveView>('POST', `/v1/services/${id}/move`, { serverId }),
+      },
+      inlineDockerfile: {
+        get: (id) => get<InlineDockerfileView>(`/v1/services/${id}/inline-dockerfile`),
+        set: (id, content) => send<InlineDockerfileView>('PUT', `/v1/services/${id}/inline-dockerfile`, { content }),
+      },
+      commitStatus: {
+        get: (id) => get<ServiceCommitStatusView>(`/v1/services/${id}/commit-status`),
+        set: (id, enabled) => send<ServiceCommitStatusView>('PUT', `/v1/services/${id}/commit-status`, { enabled }),
+      },
+      registryHook: {
+        get: (id) => get<RegistryHookView>(`/v1/services/${id}/registry-hook`),
+        enable: (id) => send<RegistryHookView>('POST', `/v1/services/${id}/registry-hook`),
+        disable: (id) => request<RegistryHookView>(`/v1/services/${id}/registry-hook`, { method: 'DELETE' }),
+      },
+      restartLimit: {
+        get: (id) => get<RestartLimitView>(`/v1/services/${id}/restart-limit`),
+        set: (id, limit) => send<RestartLimitView>('PUT', `/v1/services/${id}/restart-limit`, { limit }),
+      },
+      pending: {
+        get: (id) => get<PendingChangesView>(`/v1/services/${id}/pending`),
+        stage: (id, patch) => send<PendingChangesView>('PUT', `/v1/services/${id}/pending`, patch),
+        setStaging: (id, staging) => send<PendingChangesView>('PUT', `/v1/services/${id}/pending/staging`, { staging }),
+        discard: (id) => send<PendingChangesView>('DELETE', `/v1/services/${id}/pending`),
+        apply: (id, input) => send<PendingApplyResult>('POST', `/v1/services/${id}/pending/apply`, input ?? {}),
+      },
       sleep: (id) => send<{ ok: boolean; asleep: boolean }>('POST', `/v1/services/${id}/sleep`),
       wake: (id) => send<{ ok: boolean; status: string }>('POST', `/v1/services/${id}/wake`),
       // ── end 0.16 T8 ──

package/src/resources/settings.ts

@@ -11,10 +11,36 @@ import type {
   SecretProviderView,
   VaultProviderPut,
   AwsProviderPut,
+  GcpProviderPut,
+  AzureProviderPut,
+  OnePasswordProviderPut,
+  ExecProviderPut,
 } from '@ninedeploy/schemas';
 import type { VaultAllowlistView, VaultSettings, EmailTemplateName, EmailTemplateEntry, EmailTemplateRender } from '../types.js';
 import type { Transport } from '../transport.js';
 
+/** The PUT body of each secret provider kind (G3.2 added gcp, azure, onepassword, exec). */
+export type SecretProviderPutFor<K extends SecretProviderKind> = {
+  vault: VaultProviderPut;
+  aws: AwsProviderPut;
+  gcp: GcpProviderPut;
+  azure: AzureProviderPut;
+  onepassword: OnePasswordProviderPut;
+  exec: ExecProviderPut;
+}[K];
+
+/** G3.5: the DNS record providers configured through `settings.dnsProvider`. */
+export type DnsCredentialProviderName = 'route53' | 'ovh' | 'porkbun' | 'hetzner';
+export interface DnsProviderSettings {
+  providers: DnsCredentialProviderName[];
+  /** The active `dns_records_provider` (may be cloudflare, dnsimple, …). */
+  provider: string | null;
+  /** Which of these four has credentials saved. */
+  configured: DnsCredentialProviderName | null;
+  /** The saved non-secret fields (an access key id, an OVH endpoint). */
+  fields: Record<string, string>;
+}
+
 export type AutoUrlMode = 'off' | 'domain' | 'sslip';
 export interface AutoUrlEffective {
   mode: AutoUrlMode;
@@ -88,6 +114,17 @@ export interface SettingsApi {
       get: () => Promise<{ configured: boolean; apiUser: string | null; clientIp: string | null; hasKey: boolean }>;
       set: (input: { apiUser: string; apiKey: string; clientIp: string }) => Promise<{ ok: boolean; apiUser: string }>;
     };
+    /**
+     * G3.5: Route 53, OVH, Porkbun and Hetzner DNS record auto-provisioning.
+     * Saving credentials makes that provider the active one; `get` never
+     * returns a secret.
+     */
+    dnsProvider: {
+      get: () => Promise<DnsProviderSettings>;
+      set: (input: { provider: DnsCredentialProviderName; credentials: Record<string, string> }) => Promise<{ ok: boolean; provider: string }>;
+      clear: () => Promise<{ ok: boolean }>;
+      test: () => Promise<{ ok: boolean; provider?: string; zones?: string[]; zoneCount?: number; error?: string }>;
+    };
     /**
      * Master-key rotation. `rotate` re-encrypts every stored secret onto the
      * highest key version in `NINEDEPLOY_MASTER_KEYS`; it does NOT rewrite
@@ -114,7 +151,7 @@ export interface SettingsApi {
      */
     secretProviders: {
       list: () => Promise<SecretProviderView[]>;
-      set: <K extends SecretProviderKind>(kind: K, input: K extends 'vault' ? VaultProviderPut : AwsProviderPut) => Promise<SecretProviderView>;
+      set: <K extends SecretProviderKind>(kind: K, input: SecretProviderPutFor<K>) => Promise<SecretProviderView>;
       delete: (kind: SecretProviderKind) => Promise<{ ok: boolean; deleted: boolean }>;
       test: (kind: SecretProviderKind, probe?: SecretProviderTestRequest) => Promise<SecretProviderTestResult>;
     };
@@ -237,6 +274,13 @@ export function settingsApi(t: Transport): SettingsApi {
         get: () => get<{ configured: boolean; apiUser: string | null; clientIp: string | null; hasKey: boolean }>('/v1/settings/dns-records/namecheap'),
         set: (input) => send<{ ok: boolean; apiUser: string }>('PUT', '/v1/settings/dns-records/namecheap', input),
       },
+      dnsProvider: {
+        get: () => get<DnsProviderSettings>('/v1/settings/dns-records/provider'),
+        set: (input) => send<{ ok: boolean; provider: string }>('PUT', '/v1/settings/dns-records/provider', input),
+        clear: () => send<{ ok: boolean }>('DELETE', '/v1/settings/dns-records/provider'),
+        test: () =>
+          send<{ ok: boolean; provider?: string; zones?: string[]; zoneCount?: number; error?: string }>('POST', '/v1/settings/dns-records/provider/test'),
+      },
       masterKey: {
         get: () => get<{ activeVersion: number; knownVersions: number[]; rotatable: boolean }>('/v1/settings/master-key'),
         rotate: () =>