@vibexp/api-client 0.42.0 → 0.43.0

package/dist/axios/sdk.gen.js

@@ -743,7 +743,7 @@ export const getProjectResourceCreationMetrics = (options) => (options.client ??
 /**
  * List spec libraries
  *
- * Retrieves all spec libraries for the authenticated user with optional filtering and pagination. Metadata filtering is dynamic: any query parameter named `metadata_<key>` filters on that metadata field, e.g. `metadata_env=prod` matches spec libraries whose metadata `env` equals `prod`. Multiple `metadata_*` parameters are combined (AND).
+ * Retrieves all spec libraries for the authenticated user with optional filtering and pagination. Use the `metadata` parameter to filter on metadata; the undocumented `metadata_<key>` prefix convention is deprecated and will be removed.
  */
 export const listSpecLibraries = (options) => (options.client ?? client).get({
     responseType: 'json',
@@ -792,7 +792,7 @@ export const getBlueprintStats = (options) => (options.client ?? client).get({
 /**
  * List spec libraries by project
  *
- * Retrieves spec libraries for a specific project with optional filtering. Metadata filtering is dynamic: any query parameter named `metadata_<key>` filters on that metadata field, e.g. `metadata_env=prod` matches spec libraries whose metadata `env` equals `prod`. Multiple `metadata_*` parameters are combined (AND).
+ * Retrieves spec libraries for a specific project with optional filtering. Use the `metadata` parameter to filter on metadata; the undocumented `metadata_<key>` prefix convention is deprecated and will be removed.
  */
 export const listSpecLibrariesByProject = (options) => (options.client ?? client).get({
     responseType: 'json',
@@ -1415,11 +1415,16 @@ export const disconnectGitHub = (options) => (options.client ?? client).delete({
     ...options
 });
 /**
- * Handle GitHub webhook events
+ * Retired — use the per-App webhook URL
  *
- * Receives and processes GitHub webhook events (e.g., push, installation changes).
- * This endpoint validates the webhook signature using the configured GitHub webhook secret.
- * This is a public endpoint — no authentication header is required; GitHub signs the payload.
+ * **Retired (410 Gone).** This endpoint verified deliveries against a single
+ * instance-wide webhook secret. Each team now registers its own GitHub App
+ * with its own secret, so there is no single secret left to verify against
+ * and this path cannot be made to work.
+ *
+ * Each team's webhook URL is shown in its GitHub App settings; update it on
+ * GitHub. This path is kept for a release or two so misdirected deliveries
+ * get an explanation rather than a signature error.
  *
  */
 export const handleGitHubWebhook = (options) => (options.client ?? client).post({
@@ -1430,6 +1435,31 @@ export const handleGitHubWebhook = (options) => (options.client ?? client).post(
         ...options.headers
     }
 });
+/**
+ * Handle a GitHub webhook delivery for one team's App
+ *
+ * Receives a GitHub webhook delivery for the App identified by the routing
+ * token in the path. Each team registers its own GitHub App with its own
+ * webhook secret, so the token is what selects which secret the
+ * `X-Hub-Signature-256` HMAC is verified against.
+ *
+ * Public and unauthenticated by necessity — GitHub posts with no session.
+ * The token routes the delivery; the webhook secret authenticates it. The
+ * payload is not parsed until the signature verifies, so no attacker-supplied
+ * byte influences which key it is checked with.
+ *
+ * An unknown or malformed token returns 404 with no detail, so the endpoint
+ * cannot be used to discover which tokens exist.
+ *
+ */
+export const handleGitHubWebhookByToken = (options) => (options.client ?? client).post({
+    url: '/api/v1/webhooks/github/{token}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * List feeds
  *
@@ -3708,6 +3738,44 @@ export const validateEmbeddingProvider = (options) => (options.client ?? client)
         ...options.headers
     }
 });
+/**
+ * List the metadata keys in use
+ *
+ * Returns the distinct metadata keys present on the caller's rows of the requested resource type, optionally narrowed to a single project. Use it to populate the key side of a metadata filter.
+ */
+export const getMetadataKeys = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/metadata/keys',
+    ...options
+});
+/**
+ * List the values stored under a metadata key
+ *
+ * Returns the distinct values stored under one metadata key on the caller's rows of the requested resource type. Values held in an array are flattened and non-string scalars are rendered in their text form, so the result is directly usable as filter input. Supply `q` for typeahead.
+ */
+export const getMetadataValues = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/metadata/values',
+    ...options
+});
 /**
  * Reset the team's search ranking settings to the instance defaults
  *
@@ -3993,6 +4061,566 @@ export const clearEmbeddingsSettings = (options) => (options.client ?? client).d
     url: '/api/v1/{team_id}/settings/embedding-providers/embeddings',
     ...options
 });
+/**
+ * Delete the team's GitHub App configuration
+ *
+ * Removes the team's GitHub App registration. This also disconnects every
+ * installation made through that App, since installations are meaningful
+ * only in the context of the App they were installed from.
+ *
+ */
+export const deleteGitHubAppConfig = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/integrations/github/app',
+    ...options
+});
+/**
+ * Get the team's GitHub App configuration
+ *
+ * Returns the team's GitHub App registration. Secrets are never included —
+ * the response carries `has_private_key`, `has_client_secret` and
+ * `has_webhook_secret` booleans plus the `webhook_url` to paste into GitHub.
+ *
+ */
+export const getGitHubAppConfig = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/integrations/github/app',
+    ...options
+});
+/**
+ * Register the team's GitHub App
+ *
+ * Registers a GitHub App for the team. The `private_key` and `client_secret`
+ * are encrypted at rest and are never returned.
+ *
+ * The webhook secret is **generated by the server**, not supplied by the
+ * caller, and is returned in this response **once only**. It cannot be read
+ * back afterwards; a lost secret must be rotated. Returns 200 (not 201),
+ * matching the provider convention.
+ *
+ */
+export const createGitHubAppConfig = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/integrations/github/app',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Update the team's GitHub App configuration
+ *
+ * Updates the team's GitHub App registration. Every field is optional: an
+ * omitted field keeps the stored value, and an explicitly empty value is
+ * rejected rather than clearing the stored one. Secrets are never returned.
+ *
+ * The webhook secret cannot be set here — it is server-generated and
+ * replaced through rotation.
+ *
+ */
+export const updateGitHubAppConfig = (options) => (options.client ?? client).put({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/integrations/github/app',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Validate the team's GitHub App configuration
+ *
+ * Probes GitHub with the stored credentials and reports whether they work.
+ * This proves the private key belongs to the configured `app_id`, that the
+ * stored slug matches what GitHub reports (a typo there would otherwise
+ * produce a broken install URL), and which permissions the App holds.
+ *
+ * A failed probe is reported in the body with `is_valid: false`, not as an
+ * HTTP error. `error_details` is always one of a fixed set of categories;
+ * the real upstream error is logged server-side only.
+ *
+ * Authorized as a mutation, because it makes the server perform an
+ * authenticated outbound call on the team's behalf.
+ *
+ */
+export const validateGitHubAppConfig = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/integrations/github/app/validate',
+    ...options
+});
+/**
+ * Rotate the GitHub App webhook token
+ *
+ * Mints a new opaque routing token, which changes the App's `webhook_url`.
+ * The previous URL stops resolving immediately, so the new one must be
+ * pasted into the App's settings on GitHub or deliveries will stop.
+ *
+ * This rotates the routing token only, not the webhook secret.
+ *
+ */
+export const rotateGitHubAppWebhookToken = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/integrations/github/app/rotate-webhook-token',
+    ...options
+});
+/**
+ * Delete the team's GitHub App configuration
+ *
+ * Removes the team's GitHub App registration. This also disconnects every
+ * installation made through that App, since installations are meaningful
+ * only in the context of the App they were installed from.
+ *
+ */
+export const deleteGitHubAppConfigSettings = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/github-app',
+    ...options
+});
+/**
+ * Get the team's GitHub App configuration
+ *
+ * Returns the team's GitHub App registration. Secrets are never included —
+ * the response carries `has_private_key`, `has_client_secret` and
+ * `has_webhook_secret` booleans plus the `webhook_url` to paste into GitHub.
+ *
+ */
+export const getGitHubAppConfigSettings = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/github-app',
+    ...options
+});
+/**
+ * Register the team's GitHub App
+ *
+ * Registers a GitHub App for the team. The `private_key` and `client_secret`
+ * are encrypted at rest and are never returned.
+ *
+ * The webhook secret is **generated by the server**, not supplied by the
+ * caller, and is returned in this response **once only**. It cannot be read
+ * back afterwards; a lost secret must be rotated. Returns 200 (not 201),
+ * matching the provider convention.
+ *
+ */
+export const createGitHubAppConfigSettings = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/github-app',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Update the team's GitHub App configuration
+ *
+ * Updates the team's GitHub App registration. Every field is optional: an
+ * omitted field keeps the stored value, and an explicitly empty value is
+ * rejected rather than clearing the stored one. Secrets are never returned.
+ *
+ * The webhook secret cannot be set here — it is server-generated and
+ * replaced through rotation.
+ *
+ */
+export const updateGitHubAppConfigSettings = (options) => (options.client ?? client).put({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/github-app',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Validate the team's GitHub App configuration
+ *
+ * Probes GitHub with the stored credentials and reports whether they work.
+ * This proves the private key belongs to the configured `app_id`, that the
+ * stored slug matches what GitHub reports (a typo there would otherwise
+ * produce a broken install URL), and which permissions the App holds.
+ *
+ * A failed probe is reported in the body with `is_valid: false`, not as an
+ * HTTP error. `error_details` is always one of a fixed set of categories;
+ * the real upstream error is logged server-side only.
+ *
+ * Authorized as a mutation, because it makes the server perform an
+ * authenticated outbound call on the team's behalf.
+ *
+ */
+export const validateGitHubAppConfigSettings = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/github-app/validate',
+    ...options
+});
+/**
+ * Rotate the GitHub App webhook token
+ *
+ * Mints a new opaque routing token, which changes the App's `webhook_url`.
+ * The previous URL stops resolving immediately, so the new one must be
+ * pasted into the App's settings on GitHub or deliveries will stop.
+ *
+ * This rotates the routing token only, not the webhook secret.
+ *
+ */
+export const rotateGitHubAppWebhookTokenSettings = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/github-app/rotate-webhook-token',
+    ...options
+});
+/**
+ * Remove the team's email provider
+ *
+ * Deletes the team's provider, so the team reverts to the instance provider.
+ * A subsequent GET reports `source: "instance"`.
+ *
+ * Deleting when the team has no provider of its own returns 409 rather than
+ * 404: the endpoint exists and the team is addressable, it is simply not in a
+ * state that can serve the request.
+ *
+ */
+export const deleteTeamEmailProvider = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/email-provider',
+    ...options
+});
+/**
+ * Get the team's effective email configuration
+ *
+ * Returns the email configuration in force for the team.
+ *
+ * This **always returns 200**, never 404. A team without its own provider is
+ * inheriting the instance provider, which is a valid state the caller needs
+ * described — it reports `configured: false`, `source: "instance"` and the
+ * instance's `effective_from_address`.
+ *
+ * Readable by any team member: the response carries no credential, and
+ * `effective_from_address` is already in the From: header of every mail those
+ * members receive.
+ *
+ */
+export const getTeamEmailProvider = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/email-provider',
+    ...options
+});
+/**
+ * Configure the team's email provider
+ *
+ * Creates or replaces the team's email provider. Idempotent: the same body
+ * applied twice leaves one row and returns 200 both times.
+ *
+ * `secret` is required the first time. On a team that already has a provider,
+ * omit it to keep the stored credential; sending an empty string is rejected
+ * rather than treated as "clear", because a provider without a credential
+ * cannot send and silently disabling a team's mail is worse than an error.
+ *
+ * A team-supplied `settings.smtp.host` or `settings.mailgun.base_url` that
+ * resolves into a reserved network range is rejected before anything is
+ * stored or dialled.
+ *
+ */
+export const upsertTeamEmailProvider = (options) => (options.client ?? client).put({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/email-provider',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Send a test email with a candidate configuration
+ *
+ * Sends a real message using the configuration **in this request body**, not
+ * the stored one, so credentials can be verified before they are saved. The
+ * body therefore always requires `secret`.
+ *
+ * The recipient is **always the acting user's own account email**. It cannot
+ * be supplied by the caller, so this endpoint cannot be used to send mail to
+ * third parties.
+ *
+ * A failed send is reported in the body with `is_valid: false` and a fixed
+ * `details.error_details` category, not as an HTTP error. A 500 means an
+ * internal fault, not a bad configuration.
+ *
+ * Authorized as a mutation, because it makes the server perform an outbound
+ * send with team-supplied credentials.
+ *
+ */
+export const testTeamEmailProvider = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/email-provider/test',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Remove the team's email provider
+ *
+ * Deletes the team's provider, so the team reverts to the instance provider.
+ * A subsequent GET reports `source: "instance"`.
+ *
+ * Deleting when the team has no provider of its own returns 409 rather than
+ * 404: the endpoint exists and the team is addressable, it is simply not in a
+ * state that can serve the request.
+ *
+ */
+export const deleteTeamEmailProviderSettings = (options) => (options.client ?? client).delete({
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/email-provider',
+    ...options
+});
+/**
+ * Get the team's effective email configuration
+ *
+ * Returns the email configuration in force for the team.
+ *
+ * This **always returns 200**, never 404. A team without its own provider is
+ * inheriting the instance provider, which is a valid state the caller needs
+ * described — it reports `configured: false`, `source: "instance"` and the
+ * instance's `effective_from_address`.
+ *
+ * Readable by any team member: the response carries no credential, and
+ * `effective_from_address` is already in the From: header of every mail those
+ * members receive.
+ *
+ */
+export const getTeamEmailProviderSettings = (options) => (options.client ?? client).get({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/email-provider',
+    ...options
+});
+/**
+ * Configure the team's email provider
+ *
+ * Creates or replaces the team's email provider. Idempotent: the same body
+ * applied twice leaves one row and returns 200 both times.
+ *
+ * `secret` is required the first time. On a team that already has a provider,
+ * omit it to keep the stored credential; sending an empty string is rejected
+ * rather than treated as "clear", because a provider without a credential
+ * cannot send and silently disabling a team's mail is worse than an error.
+ *
+ * A team-supplied `settings.smtp.host` or `settings.mailgun.base_url` that
+ * resolves into a reserved network range is rejected before anything is
+ * stored or dialled.
+ *
+ */
+export const upsertTeamEmailProviderSettings = (options) => (options.client ?? client).put({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/email-provider',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+/**
+ * Send a test email with a candidate configuration
+ *
+ * Sends a real message using the configuration **in this request body**, not
+ * the stored one, so credentials can be verified before they are saved. The
+ * body therefore always requires `secret`.
+ *
+ * The recipient is **always the acting user's own account email**. It cannot
+ * be supplied by the caller, so this endpoint cannot be used to send mail to
+ * third parties.
+ *
+ * A failed send is reported in the body with `is_valid: false` and a fixed
+ * `details.error_details` category, not as an HTTP error. A 500 means an
+ * internal fault, not a bad configuration.
+ *
+ * Authorized as a mutation, because it makes the server perform an outbound
+ * send with team-supplied credentials.
+ *
+ */
+export const testTeamEmailProviderSettings = (options) => (options.client ?? client).post({
+    responseType: 'json',
+    security: [{
+            key: 'ApiKeyAuth',
+            scheme: 'bearer',
+            type: 'http'
+        }, {
+            in: 'cookie',
+            name: 'vx_session',
+            type: 'apiKey'
+        }],
+    url: '/api/v1/{team_id}/settings/email-provider/test',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
 /**
  * List model providers
  *