@oore/client 0.0.0

package/dist/generated/sdk.gen.js

@@ -0,0 +1,1791 @@
+// This file is auto-generated by @hey-api/openapi-ts
+import { client } from './client.gen.js';
+/**
+ * Health check
+ *
+ * Returns daemon build metadata when the daemon is running.
+ */
+export const healthz = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/healthz',
+    ...options
+});
+/**
+ * Download via scoped token
+ *
+ * Downloads an artifact using a scoped download token. No session auth required —
+ * the token itself is the authorization. For S3/R2 storage, redirects to a presigned URL.
+ */
+export const downloadViaScopedToken = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/install/artifact/{token}',
+    ...options
+});
+/**
+ * Download an artifact from the install delivery route
+ *
+ * Returns local artifact bytes using the signed path token.
+ */
+export const downloadLocalArtifactInstall = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/install/download/{token}',
+    ...options
+});
+/**
+ * Get iOS OTA install manifest
+ *
+ * Returns an Apple property-list manifest authorized by the scoped token in the URL.
+ */
+export const getIosInstallManifest = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/install/ios/{token}/manifest.plist',
+    ...options
+});
+/**
+ * Get Prometheus metrics
+ *
+ * Returns the daemon's Prometheus exposition payload without session
+ * authentication.
+ */
+export const metrics = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/metrics',
+    ...options
+});
+/**
+ * Readiness check
+ *
+ * Reports whether the database, migrations, and runtime encryption key are
+ * ready to serve requests.
+ */
+export const readyz = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/readyz',
+    ...options
+});
+/**
+ * List API tokens
+ *
+ * Returns all API tokens visible to the caller. Admins and owners see all
+ * tokens; other roles see only their own.
+ */
+export const listApiTokens = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/api-tokens',
+    ...options
+});
+/**
+ * Create API token
+ *
+ * Creates a new API token. The plaintext token is returned only in this
+ * response and cannot be retrieved again.
+ */
+export const createApiToken = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/api-tokens',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Revoke API token
+ *
+ * Revokes an API token by ID. Non-admin users can only revoke their own
+ * tokens.
+ */
+export const revokeApiToken = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/api-tokens/{token_id}',
+    ...options
+});
+/**
+ * Revoke scoped download token
+ *
+ * Revokes a scoped download token so it can no longer be used.
+ */
+export const revokeScopedDownloadToken = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/artifact-tokens/{token_id}',
+    ...options
+});
+/**
+ * Download via scoped token from the versioned route
+ *
+ * Resolves a time-limited path token and redirects to the backing storage
+ * URL. The token is the authorization; no session bearer token is used.
+ */
+export const downloadViaScopedTokenV1 = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/artifacts/dl/{token}',
+    ...options
+});
+/**
+ * Download an artifact from local storage
+ *
+ * Returns the artifact bytes using the signed path token.
+ */
+export const downloadLocalArtifact = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/artifacts/download/{token}',
+    ...options
+});
+/**
+ * Get an iOS OTA install manifest from the versioned route
+ *
+ * Returns an Apple property-list manifest authorized by the install token
+ * in the URL.
+ */
+export const getIosInstallManifestV1 = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/artifacts/install/ios/{token}/manifest.plist',
+    ...options
+});
+/**
+ * Download an artifact from the legacy local-storage route
+ *
+ * Backward-compatible alias for signed local artifact downloads.
+ */
+export const downloadLocalArtifactLegacy = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/artifacts/local-download/{token}',
+    ...options
+});
+/**
+ * Upload an artifact to local storage
+ *
+ * Stores a bounded binary artifact using the signed path token. The token
+ * is the authorization; no session bearer token is used.
+ */
+export const uploadLocalArtifact = (options) => (options.client ?? client).put({
+    bodySerializer: null,
+    responseStyle: 'data',
+    url: '/v1/artifacts/local-upload/{token}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/octet-stream',
+        ...options.headers
+    }
+});
+/**
+ * List available artifacts for a bounded set of builds
+ */
+export const listBuildArtifacts = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/artifacts/query',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Generate download link
+ *
+ * Returns a signed download URL for an artifact. URLs expire after 15 minutes.
+ */
+export const generateDownloadLink = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/artifacts/{artifact_id}/download-link',
+    ...options
+});
+/**
+ * Create device install link
+ *
+ * Creates a one-hour install session for an APK or install-ready signed IPA.
+ * QA viewers may use this endpoint through their artifact read permission.
+ */
+export const createArtifactInstallLink = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/artifacts/{artifact_id}/install-link',
+    ...options
+});
+/**
+ * Create scoped download token
+ *
+ * Generates a scoped, time-limited download token for a specific artifact.
+ * The token can be shared with external users who don't have an account.
+ */
+export const createScopedDownloadToken = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/artifacts/{artifact_id}/scoped-token',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List scoped download tokens
+ *
+ * Lists all scoped download tokens for a specific artifact, including expired and revoked ones.
+ */
+export const listScopedDownloadTokens = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/artifacts/{artifact_id}/scoped-tokens',
+    ...options
+});
+/**
+ * List audit log entries
+ *
+ * Returns a paginated, filterable list of audit log entries recording
+ * user and system actions. Owner and admin roles only.
+ */
+export const listAuditLogs = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/audit-logs',
+    ...options
+});
+/**
+ * Local login and recovery
+ *
+ * In Local Only mode, creates a loopback local session and may auto-finalize
+ * first-run owner bootstrap. In Ready External Access mode, every request
+ * requires a short-lived, single-use recovery capability minted by the
+ * local `oore recovery` command over the daemon's Unix management socket.
+ * TCP loopback and forwarding headers do not grant recovery authority.
+ */
+export const localLogin = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/auth/local/login',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Logout
+ *
+ * Invalidates the current session.
+ */
+export const logout = (options) => (options?.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/auth/logout',
+    ...options
+});
+/**
+ * OIDC callback
+ *
+ * Exchanges the authorization code for tokens and creates a session.
+ */
+export const oidcCallback = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/auth/oidc/callback',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Start OIDC login
+ *
+ * Initiates the OIDC authorization code flow for user login.
+ * Only available after setup is complete.
+ */
+export const oidcStart = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/auth/oidc/start',
+    ...options
+});
+/**
+ * Trusted proxy login
+ *
+ * Creates a session from trusted proxy identity headers when remote auth
+ * mode is configured to trusted proxy.
+ */
+export const trustedProxyLogin = (options) => (options?.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/auth/trusted-proxy/login',
+    ...options
+});
+/**
+ * List builds
+ *
+ * Returns builds, optionally filtered by project, pipeline, or status.
+ */
+export const listBuilds = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds',
+    ...options
+});
+/**
+ * Get build detail
+ */
+export const getBuild = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}',
+    ...options
+});
+/**
+ * List build artifacts
+ */
+export const listArtifacts = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}/artifacts',
+    ...options
+});
+/**
+ * Cancel build
+ *
+ * Cancels a queued or running build.
+ */
+export const cancelBuild = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}/cancel',
+    ...options
+});
+/**
+ * Get build logs
+ *
+ * Returns paginated historical build logs.
+ */
+export const getBuildLogs = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}/logs',
+    ...options
+});
+/**
+ * Stream build logs (SSE)
+ *
+ * Server-sent event stream of build logs. Requires a short-lived streaming
+ * token obtained from `POST /v1/builds/{build_id}/stream-token`.
+ */
+export const streamBuildLogs = (options) => (options.client ?? client).sse.get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}/logs/stream',
+    ...options
+});
+/**
+ * Re-run build
+ *
+ * Creates a new build cloning the original build's config_snapshot, branch, and commit_sha.
+ */
+export const rerunBuild = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}/rerun',
+    ...options
+});
+/**
+ * Create stream token
+ *
+ * Exchanges a session token for a short-lived (5 min) streaming token
+ * suitable for use in SSE query parameters.
+ */
+export const createStreamToken = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/builds/{build_id}/stream-token',
+    ...options
+});
+/**
+ * Exchange a frontend pairing code
+ *
+ * Exchanges a short-lived, single-use code created by `oore frontend invite`
+ * for the backend trusted-proxy proof and configured identity header. This
+ * endpoint accepts requests only from configured trusted-proxy peer CIDRs.
+ */
+export const frontendPair = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/frontend/pair',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Search repositories across integrations
+ */
+export const listSourceRepositories = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integration-repositories',
+    ...options
+});
+/**
+ * Fetch a private GitLab repository avatar through Oore
+ */
+export const repositoryAvatar = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integration-repositories/{id}/avatar',
+    ...options
+});
+/**
+ * Generate or rotate a repository-scoped GitLab webhook token
+ */
+export const rotateGitlabRepositoryWebhookSecret = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integration-repositories/{id}/gitlab-webhook-secret',
+    ...options
+});
+/**
+ * List integrations
+ *
+ * Returns all SCM integrations, optionally filtered by provider.
+ */
+export const listIntegrations = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations',
+    ...options
+});
+/**
+ * Complete the GitHub App manifest callback
+ *
+ * Exchanges GitHub's manifest code, stores the integration, and redirects
+ * the browser. Callback errors are rendered as HTML.
+ */
+export const githubCallback = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/integrations/github/callback',
+    ...options
+});
+/**
+ * Complete GitHub App creation
+ *
+ * Finalises the GitHub App manifest flow after the redirect back from GitHub.
+ */
+export const githubComplete = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/github/complete',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Open the GitHub App manifest flow
+ *
+ * Serves the browser form that creates a GitHub App. The sealed `state`
+ * query value authenticates the flow; no session bearer token is used.
+ */
+export const githubCreatePage = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/integrations/github/create',
+    ...options
+});
+/**
+ * Complete the GitHub App installation callback
+ *
+ * Consumes the optional sealed install-state cookie, synchronizes the
+ * installation when authorized, and serves a browser redirect page.
+ */
+export const githubInstalled = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/integrations/github/installed',
+    ...options
+});
+/**
+ * Start GitHub App creation
+ *
+ * Returns a URL to navigate the browser to for GitHub App manifest creation.
+ */
+export const githubStart = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/github/start',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get GitLab OAuth authorization URL
+ */
+export const gitlabAuthorize = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/gitlab/authorize',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Complete the GitLab OAuth callback
+ *
+ * Exchanges GitLab's authorization code and redirects the browser.
+ * Callback errors are rendered as HTML.
+ */
+export const gitlabCallback = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/integrations/gitlab/callback',
+    ...options
+});
+/**
+ * Start GitLab integration
+ *
+ * Creates a GitLab integration with OAuth or personal token auth.
+ */
+export const gitlabStart = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/gitlab/start',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List local git integrations
+ */
+export const listLocalGitIntegrations = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/local-git',
+    ...options
+});
+/**
+ * Create local git integration
+ */
+export const createLocalGitIntegration = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/local-git',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Browse local directories for local repository registration
+ */
+export const browseLocalGitDirectories = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/local-git/directories',
+    ...options
+});
+/**
+ * Delete local git integration
+ */
+export const deleteLocalGitIntegration = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/local-git/{id}',
+    ...options
+});
+/**
+ * Delete integration
+ */
+export const deleteIntegration = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}',
+    ...options
+});
+/**
+ * Get integration detail
+ */
+export const getIntegration = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}',
+    ...options
+});
+/**
+ * Replace a saved GitLab personal access token
+ */
+export const replaceGitlabPersonalToken = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}/gitlab-token',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Check a saved GitLab personal access token
+ */
+export const checkGitlabPersonalToken = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}/gitlab-token/check',
+    ...options
+});
+/**
+ * List integration installations
+ */
+export const listInstallations = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}/installations',
+    ...options
+});
+/**
+ * Sync integration installations
+ *
+ * - **GitHub**: Fetches GitHub App installations and syncs their repositories.
+ * - **GitLab**: Refreshes accessible projects for linked accounts and syncs them as repositories.
+ */
+export const syncInstallations = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}/installations',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List integration repositories
+ */
+export const listRepositories = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/integrations/{id}/repositories',
+    ...options
+});
+/**
+ * List durable operator incidents for the current source manager
+ */
+export const listOperatorIncidents = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/operator-incidents',
+    ...options
+});
+/**
+ * Mark one targeted operator incident notification as read
+ */
+export const markOperatorIncidentRead = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/operator-incidents/{id}/read',
+    ...options
+});
+/**
+ * Validate pipeline config
+ *
+ * Validates a pipeline configuration without persisting it.
+ */
+export const validatePipeline = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/validate',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete pipeline
+ */
+export const deletePipeline = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}',
+    ...options
+});
+/**
+ * Get pipeline detail
+ */
+export const getPipeline = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}',
+    ...options
+});
+/**
+ * Update pipeline
+ */
+export const updatePipeline = (options) => (options.client ?? client).patch({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get Android signing config
+ */
+export const getPipelineAndroidSigning = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/android-signing',
+    ...options
+});
+/**
+ * Update Android signing config
+ *
+ * Upload keystores and configure debug/release signing profiles.
+ */
+export const updatePipelineAndroidSigning = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/android-signing',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get iOS signing config
+ */
+export const getPipelineIosSigning = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/ios-signing',
+    ...options
+});
+/**
+ * Update iOS signing config
+ *
+ * Upload certificates, provisioning profiles, and API credentials.
+ * Request body limit: 10 MiB.
+ */
+export const updatePipelineIosSigning = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/ios-signing',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List registered iOS devices
+ */
+export const listPipelineIosDevices = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/ios-signing/devices',
+    ...options
+});
+/**
+ * Register iOS test device
+ *
+ * Registers a device UDID and optionally triggers a provisioning profile sync.
+ */
+export const registerPipelineIosDevice = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/ios-signing/devices/register',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Sync iOS provisioning profiles
+ *
+ * Re-downloads provisioning profiles from Apple via App Store Connect API.
+ */
+export const syncPipelineIosSigning = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/pipelines/{pipeline_id}/ios-signing/sync',
+    ...options
+});
+/**
+ * List projects
+ */
+export const listProjects = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects',
+    ...options
+});
+/**
+ * Create project
+ */
+export const createProject = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete project
+ */
+export const deleteProject = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}',
+    ...options
+});
+/**
+ * Get project detail
+ */
+export const getProject = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}',
+    ...options
+});
+/**
+ * Update project
+ */
+export const updateProject = (options) => (options.client ?? client).patch({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List available artifacts across a project
+ */
+export const listProjectArtifacts = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/artifacts',
+    ...options
+});
+/**
+ * Create build
+ *
+ * Queues a new build for the specified project.
+ */
+export const createBuild = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/builds',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Preview a Markdown changelog for a manual build.
+ */
+export const previewBuildChangelog = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/builds/changelog-preview',
+    ...options
+});
+/**
+ * List project members
+ */
+export const listProjectMembers = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/members',
+    ...options
+});
+/**
+ * Add a member to a project
+ */
+export const addProjectMember = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/members',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List eligible project member candidates
+ */
+export const listProjectMemberCandidates = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/members/candidates',
+    ...options
+});
+/**
+ * Remove a member from a project
+ */
+export const removeProjectMember = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/members/{user_id}',
+    ...options
+});
+/**
+ * Update a project member's role
+ */
+export const updateProjectMember = (options) => (options.client ?? client).patch({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/members/{user_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List pipelines
+ */
+export const listPipelines = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/pipelines',
+    ...options
+});
+/**
+ * Create pipeline
+ */
+export const createPipeline = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/pipelines',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Discover repository-owned workflows
+ *
+ * Reads supported Oore workflow files from the linked repository without
+ * modifying it. The response contains validated behavior but never raw YAML,
+ * environment values, or source credentials.
+ */
+export const discoverRepositoryWorkflows = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/repository-workflows',
+    ...options
+});
+/**
+ * Delete project retention override (revert to global)
+ */
+export const deleteProjectRetention = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/retention',
+    ...options
+});
+/**
+ * Get project retention (effective policy merged with overrides)
+ */
+export const getProjectRetention = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/retention',
+    ...options
+});
+/**
+ * Update project retention override
+ */
+export const updateProjectRetention = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/projects/{project_id}/retention',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get setup status
+ *
+ * Returns the current setup state and instance ID. This endpoint is
+ * always public and contains no sensitive information.
+ */
+export const getSetupStatus = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    url: '/v1/public/setup-status',
+    ...options
+});
+/**
+ * List runners
+ */
+export const listRunners = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners',
+    ...options
+});
+/**
+ * Register runner
+ *
+ * Registers a new build runner and returns a runner authentication token.
+ */
+export const registerRunner = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/register',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete runner
+ *
+ * Deletes a user-registered runner that has never claimed a build.
+ */
+export const deleteRunner = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}',
+    ...options
+});
+/**
+ * Get runner
+ *
+ * Retrieves a single runner by ID, including its current status and health information.
+ */
+export const getRunner = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}',
+    ...options
+});
+/**
+ * Update runner
+ */
+export const updateRunner = (options) => (options.client ?? client).patch({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Claim job
+ *
+ * Runner claims the next queued build. Returns `null` job if no builds are available.
+ */
+export const claimJob = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/claim',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Runner heartbeat
+ *
+ * Sends a heartbeat from a runner to report its status. Authenticated via runner token.
+ */
+export const runnerHeartbeat = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/heartbeat',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get job status
+ *
+ * Runner checks the current status of its assigned build.
+ */
+export const getJobStatus = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}',
+    ...options
+});
+/**
+ * Get job-scoped Android signing material
+ *
+ * Returns Android signing profiles only to the assigned runner while the
+ * job is active. Both the runner bearer token and job-scoped signing grant
+ * are required.
+ */
+export const getJobAndroidSigning = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/android-signing',
+    ...options
+});
+/**
+ * Create artifact
+ *
+ * Runner creates an artifact record and gets a signed upload URL.
+ */
+export const createArtifact = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/artifacts',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+export const abortArtifact = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/artifacts/{artifact_id}/abort',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+export const completeArtifact = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/artifacts/{artifact_id}/complete',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Discover a private GitLab repository for checkout
+ *
+ * Internal Git smart-HTTP endpoint. The runner token is accepted only for
+ * the repository assigned to this job; GitLab credentials remain server-side.
+ */
+export const gitlabCheckoutDiscovery = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/gitlab/{git_path}',
+    ...options
+});
+/**
+ * Stream a private GitLab upload-pack request
+ */
+export const gitlabCheckoutUploadPack = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/gitlab/{git_path}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/x-git-upload-pack-request',
+        ...options.headers
+    }
+});
+/**
+ * Get job-scoped iOS signing material
+ *
+ * Returns the iOS signing bundle only to the assigned runner while the job
+ * is active. Both the runner bearer token and job-scoped signing grant are
+ * required.
+ */
+export const getJobIosSigning = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/ios-signing',
+    ...options
+});
+/**
+ * Append build logs
+ *
+ * Runner appends log chunks to a build. Max 10,000 lines per build, 4KB per line.
+ */
+export const appendBuildLogs = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/logs',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Update job status
+ *
+ * Runner reports build status transitions and step results.
+ */
+export const updateJobStatus = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/runners/{runner_id}/jobs/{job_id}/status',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get artifact storage settings
+ */
+export const getArtifactStorageSettings = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/artifact-storage',
+    ...options
+});
+/**
+ * Update artifact storage settings
+ *
+ * Configure the storage backend for build artifacts (local, S3, or R2).
+ */
+export const updateArtifactStorageSettings = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/artifact-storage',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get External Access network settings
+ *
+ * Returns effective public URL and allowed frontend origins used by External Access checks.
+ */
+export const getExternalAccessNetworkSettings = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/network',
+    ...options
+});
+/**
+ * Update External Access network settings
+ *
+ * Owner-only update for public URL and allowed frontend origins.
+ */
+export const updateExternalAccessNetworkSettings = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/network',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get current OIDC configuration for External Access
+ *
+ * Returns the current runtime OIDC provider configuration (issuer, client ID,
+ * discovered endpoints). Never exposes the client secret.
+ */
+export const getExternalAccessOidc = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/oidc',
+    ...options
+});
+/**
+ * Configure OIDC for External Access
+ *
+ * Owner-only endpoint to configure runtime OIDC after setup is complete.
+ * Performs provider discovery and stores issuer/client settings.
+ */
+export const configureExternalAccessOidc = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/oidc',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Test OIDC provider connection
+ *
+ * Owner-only endpoint to test OIDC provider discovery without committing changes.
+ * Validates that the issuer URL is reachable and returns discovered endpoints.
+ */
+export const testOidcConnection = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/oidc/test-connection',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get External Access preflight readiness
+ *
+ * Returns check-by-check readiness required before enabling External Access (`runtime_mode=remote`).
+ */
+export const getExternalAccessPreflight = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/preflight',
+    ...options
+});
+/**
+ * Get trusted proxy runtime settings
+ */
+export const getExternalAccessTrustedProxySettings = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/trusted-proxy',
+    ...options
+});
+/**
+ * Update trusted proxy runtime settings
+ */
+export const updateExternalAccessTrustedProxySettings = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/external-access/trusted-proxy',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List notification channels
+ *
+ * Returns all configured notification channels.
+ */
+export const listNotificationChannels = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels',
+    ...options
+});
+/**
+ * Create notification channel
+ *
+ * Creates a new webhook or Mattermost notification channel.
+ */
+export const createNotificationChannel = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Delete notification channel
+ *
+ * Permanently deletes a notification channel and its delivery history.
+ */
+export const deleteNotificationChannel = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels/{id}',
+    ...options
+});
+/**
+ * Get notification channel
+ *
+ * Returns details for a single notification channel.
+ */
+export const getNotificationChannel = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels/{id}',
+    ...options
+});
+/**
+ * Update notification channel
+ *
+ * Updates an existing notification channel. Omitted fields are preserved.
+ */
+export const updateNotificationChannel = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels/{id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * List notification deliveries
+ *
+ * Returns delivery history for a notification channel (most recent 100).
+ */
+export const listNotificationDeliveries = (options) => (options.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels/{id}/deliveries',
+    ...options
+});
+/**
+ * Test notification channel
+ *
+ * Sends a test notification to verify the channel is configured correctly.
+ */
+export const testNotificationChannel = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/notification-channels/{id}/test',
+    ...options
+});
+/**
+ * Get instance preferences
+ */
+export const getInstancePreferences = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/preferences',
+    ...options
+});
+/**
+ * Update instance preferences
+ *
+ * Update instance-wide preferences (e.g. key storage mode).
+ */
+export const updateInstancePreferences = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/preferences',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get global retention policy
+ */
+export const getRetentionPolicy = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/retention',
+    ...options
+});
+/**
+ * Update global retention policy
+ */
+export const updateRetentionPolicy = (options) => (options.client ?? client).put({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/retention',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get last cleanup summary
+ */
+export const getRetentionLastCleanup = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/settings/retention/last-cleanup',
+    ...options
+});
+/**
+ * Verify bootstrap token
+ *
+ * Exchanges a one-time bootstrap token (generated by the CLI) for a
+ * setup session token. Rate-limited: 5 failed attempts per token hash
+ * triggers lockout.
+ */
+export const verifyBootstrapToken = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/setup/bootstrap-token/verify',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Complete setup
+ *
+ * Finalises the setup flow, transitions state to `ready`, inserts the
+ * owner into the users table, and clears the setup session.
+ */
+export const completeSetup = (options) => (options?.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/complete',
+    ...options
+});
+/**
+ * Create local owner (local mode)
+ *
+ * Creates the setup owner without OIDC when runtime mode is `local`.
+ */
+export const setupLocalOwnerCreate = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/local-owner/create',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Configure OIDC provider
+ *
+ * Performs OIDC discovery on the provided issuer URL and stores the
+ * provider configuration. Requires a valid setup session.
+ */
+export const configureOidc = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/oidc/configure',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Claim owner identity from trusted proxy headers
+ *
+ * Creates the owner record from trusted proxy identity headers after the
+ * proxy-authenticated email matches the configured setup owner email.
+ */
+export const setupOwnerClaimTrustedProxy = (options) => (options?.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/owner/claim-trusted-proxy',
+    ...options
+});
+/**
+ * Start owner OIDC flow
+ *
+ * Initiates the OIDC authorization code flow to create the instance owner.
+ * Returns an authorization URL for the frontend to redirect to.
+ */
+export const setupOidcStart = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/owner/start-oidc',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Verify owner OIDC callback
+ *
+ * Completes the setup OIDC flow by exchanging the authorization code
+ * for tokens and creating the owner account.
+ */
+export const setupOidcVerify = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/owner/verify-oidc',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Persist setup mode preferences
+ *
+ * Stores setup-time runtime mode and remote auth mode before owner creation.
+ */
+export const setupPreferences = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/preferences',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get setup summary
+ *
+ * Returns a summary of current setup configuration. Requires a valid
+ * setup session.
+ */
+export const getSetupSummary = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/summary',
+    ...options
+});
+/**
+ * Configure trusted proxy auth during setup
+ *
+ * Upserts trusted proxy settings for remote trusted-proxy mode, including
+ * the expected initial owner email.
+ */
+export const setupTrustedProxyConfigure = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/setup/trusted-proxy/configure',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get backend update state
+ *
+ * Reports whether the backend is managed by the supported macOS launchd
+ * service and whether an update is currently running. Requires owner role.
+ */
+export const getRuntimeUpdateStatus = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/system/update',
+    ...options
+});
+/**
+ * Start a backend update
+ *
+ * Runs the installed updater and hands restart control to the managed
+ * macOS launchd service. Requires owner role.
+ */
+export const startRuntimeUpdate = (options) => (options?.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/system/update',
+    ...options
+});
+/**
+ * List users
+ *
+ * Returns all users. Requires `owner` or `admin` role.
+ */
+export const listUsers = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/users',
+    ...options
+});
+/**
+ * Invite user
+ *
+ * Creates a new user with `invited` status. Requires `owner` or `admin` role.
+ */
+export const inviteUser = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/users/invite',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Get current user
+ *
+ * Returns the profile of the currently authenticated user.
+ */
+export const getMe = (options) => (options?.client ?? client).get({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/users/me',
+    ...options
+});
+/**
+ * Delete user
+ *
+ * Soft-deletes a user. Requires `owner` or `admin` role.
+ */
+export const deleteUser = (options) => (options.client ?? client).delete({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/users/{user_id}',
+    ...options
+});
+/**
+ * Re-enable user
+ *
+ * Re-enables a previously disabled user.
+ */
+export const reEnableUser = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/users/{user_id}/enable',
+    ...options
+});
+/**
+ * Update user role
+ *
+ * Changes a user's role. Requires `owner` or `admin` role.
+ */
+export const updateUserRole = (options) => (options.client ?? client).patch({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v1/users/{user_id}/role',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * GitHub webhook receiver
+ *
+ * Receives push/PR events from GitHub and triggers matching pipelines.
+ * Authenticated via webhook signature verification.
+ */
+export const githubWebhook = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/webhooks/github',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * GitLab webhook receiver
+ *
+ * Receives push/MR events from GitLab and triggers matching pipelines.
+ * Authenticated via webhook secret token.
+ */
+export const gitlabWebhook = (options) => (options.client ?? client).post({
+    responseStyle: 'data',
+    url: '/v1/webhooks/gitlab',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});