@vibexp/api-client 0.96.0 → 0.98.0

package/dist/schema.d.ts

@@ -189,6 +189,60 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/setup/status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Report whether the instance needs authentication setup
+         * @description Returns whether this instance is in authentication setup mode, so the web
+         *     app can route to the setup page instead of a login screen that has no
+         *     provider to offer. Public, and deliberately a single boolean: it reveals
+         *     nothing else about the instance's configuration.
+         */
+        get: operations["getSetupStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/setup/session": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Exchange the setup token for a setup session
+         * @description Exchanges the one-time setup token (from the `SETUP URL` the server logs
+         *     at boot while no sign-in provider is enabled) for a short-lived setup
+         *     session, delivered as the `vibexp_setup` cookie.
+         *
+         *     The setup session is **userless**: it is not a user session and signs
+         *     nobody in. It authorizes only the instance authentication settings; every
+         *     other endpoint treats the caller as anonymous. It ends after one hour,
+         *     or as soon as a root instance admin signs in through a provider.
+         *
+         *     Every rejected token — unknown, expired or already consumed — returns the
+         *     same 401. Outside setup mode the endpoint returns 404. Rate-limited per
+         *     client IP.
+         */
+        post: operations["createSetupSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/api-keys": {
         parameters: {
             query?: never;
@@ -3751,6 +3805,246 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/admin/settings/auth/providers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the sign-in identity providers
+         * @description Returns every stored sign-in identity provider in sign-in page order, each
+         *     with its health on the replica serving the request, whether a client secret
+         *     is stored (`has_client_secret`; the secret itself is never returned) and the
+         *     derived `redirect_uri` to register with the identity provider, together with
+         *     the authentication settings `version`. Reading the list resolves the enabled
+         *     providers first, so `health` reflects their current configuration.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        get: operations["listAdminAuthProviders"];
+        put?: never;
+        /**
+         * Create a sign-in identity provider
+         * @description Validates and stores a new provider, taking effect on the next sign-in with
+         *     no restart, and appends one entry (`action: upsert`) to the `auth_providers`
+         *     audit log in the same transaction. The client secret is stored encrypted and
+         *     never returned. A body carrying an unknown field is rejected with 400.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        post: operations["createAdminAuthProvider"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/providers/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Test a sign-in identity provider
+         * @description Checks a stored provider (`id`), an unsaved candidate, or a stored provider
+         *     with some fields replaced (see `AdminAuthProviderTestRequest`): OIDC
+         *     discovery for `oidc` and `google`, a credential check against GitHub for
+         *     `github`. Nothing is stored and nothing is audited. A failed test is still a
+         *     200, reported with `is_valid: false`.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        post: operations["testAdminAuthProvider"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/providers/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Replace a sign-in identity provider
+         * @description Validates and stores a whole replacement of the provider's editable fields
+         *     (`type` and `slug` are immutable), taking effect on the next sign-in, and
+         *     appends one entry (`action: upsert`) to the `auth_providers` audit log in the
+         *     same transaction. Omitting `client_secret` keeps the stored one.
+         *
+         *     Lockout guard: a change that disables the last enabled provider, or the
+         *     provider the calling admin's session was issued by, is rejected with 409
+         *     `lockout_risk` (the problem's `metadata.reason` is `no_enabled_provider` or
+         *     `own_provider`) unless the body sets `confirm_lockout_risk: true`.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        put: operations["updateAdminAuthProvider"];
+        post?: never;
+        /**
+         * Delete a sign-in identity provider
+         * @description Removes the provider, taking effect on the next sign-in, and appends one
+         *     entry (`action: delete`) to the `auth_providers` audit log in the same
+         *     transaction.
+         *
+         *     Lockout guard: deleting the last enabled provider, or the provider the
+         *     calling admin's session was issued by, is rejected with 409 `lockout_risk`
+         *     unless `confirm_lockout_risk=true` is passed.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        delete: operations["deleteAdminAuthProvider"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/allowlist": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the sign-in access allowlist
+         * @description Returns the stored access allowlist. Always 200: with nothing stored both
+         *     lists are empty, `active` is false and `version` is null.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        get: operations["getAdminAuthAllowlist"];
+        /**
+         * Replace the sign-in access allowlist
+         * @description Validates, normalizes and stores a whole replacement of the access
+         *     allowlist, enforced on signed-in users within seconds with no restart, and
+         *     appends one entry (`action: upsert`) to the `auth_allowlist` audit log in the
+         *     same transaction. Use the preview operation first to see who would be
+         *     affected. A body that omits a list, sends one as null, or carries an unknown
+         *     field is rejected with 400.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        put: operations["updateAdminAuthAllowlist"];
+        post?: never;
+        /**
+         * Reset the sign-in access allowlist to open access
+         * @description Removes the stored allowlist, so every user may sign in, and appends one
+         *     entry (`action: delete`) to the `auth_allowlist` audit log. Idempotent and
+         *     unconditional: with nothing stored it is still a 204 and writes no audit
+         *     entry.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        delete: operations["resetAdminAuthAllowlist"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/allowlist/preview": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Preview the impact of a candidate access allowlist
+         * @description Reports the active users who would stop matching if the candidate replaced
+         *     the stored allowlist: their count and a capped sample of their emails.
+         *     Nothing is stored and nothing is audited.
+         *     Instance admin or a first-run setup session; every other request receives 404.
+         */
+        post: operations["previewAdminAuthAllowlist"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/admins": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the instance admins
+         * @description Returns the root admins (the emails named in config.yaml's
+         *     `auth.instance_admins`, read-only) and the admins granted in the database.
+         *     Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+         */
+        get: operations["listAdminInstanceAdmins"];
+        put?: never;
+        /**
+         * Grant instance admin to an existing user
+         * @description Makes an existing, active user an instance admin, named by `user_id` or
+         *     `email`, and appends one entry to the `instance_admins` audit log.
+         *     Idempotent: granting a user who already holds a grant returns it unchanged
+         *     and audits nothing. Only a ROOT admin may grant: a database-granted admin
+         *     receives 403.
+         *     Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+         */
+        post: operations["grantAdminInstanceAdmin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/admins/{user_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a database-granted instance admin
+         * @description Removes the user's instance admin grant and appends one entry to the
+         *     `instance_admins` audit log. Only a ROOT admin may revoke: a database-granted
+         *     admin receives 403.
+         *     Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+         */
+        delete: operations["revokeAdminInstanceAdmin"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/admin/settings/auth/audit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an authentication setting's audit log
+         * @description Returns one page of the audit log of one authentication setting
+         *     (`auth_providers`, `auth_allowlist`, `instance_admins` or `auth_setup`),
+         *     newest first, with each actor's display name resolved. Snapshots never
+         *     contain a credential. Pass the previous page's `next_cursor` to continue.
+         *     Instance-admin only (a setup session is not admitted); non-admin and unauthenticated requests receive 404.
+         */
+        get: operations["listAdminAuthSettingsAudit"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/{team_id}/comments": {
         parameters: {
             query?: never;
@@ -5882,6 +6176,31 @@ export interface components {
             /** @description Enabled login providers, ordered by the admin-defined sort order */
             providers: components["schemas"]["AuthProvider"][];
         };
+        /** @description Whether this instance is in authentication setup mode. Deliberately a single boolean: the endpoint is public, so it says nothing about which providers exist, why setup is required or whether a setup token is outstanding. */
+        SetupStatusResponse: {
+            /**
+             * @description True while the instance has no enabled sign-in provider (or setup was deliberately re-armed) and so must be configured through the setup page.
+             * @example false
+             */
+            setup_required: boolean;
+        };
+        /** @description The one-time setup token from the setup URL the server logged at boot. */
+        CreateSetupSessionRequest: {
+            /**
+             * @description The `token` query parameter of the setup URL.
+             * @example q4f1ZbX0m3c8QmYwU2dK7nL5pR9sT1vA6yB3eH8jC0g
+             */
+            token: string;
+        };
+        /** @description The setup session that was started. The session itself is the `vibexp_setup` cookie; this body only says when it ends. */
+        SetupSessionResponse: {
+            /**
+             * Format: date-time
+             * @description When the setup session stops being valid.
+             * @example 2026-10-02T13:00:00Z
+             */
+            expires_at: string;
+        };
         /** @description Request body for POST /api/v1/auth/dev/login (development environment only) */
         DevLoginRequest: {
             /**
@@ -12942,7 +13261,13 @@ export interface components {
          *     only `has_credential` and, on an upsert's `after`, a `secret` marker
          *     saying whether the credential was `changed` or `unchanged`; the `search`
          *     and `ai_summary` snapshots are the settings' values, which hold no
-         *     credential.
+         *     credential. For `auth_providers` each entry is one provider, reporting
+         *     only `has_client_secret` and, on an upsert's `after`, a `client_secret`
+         *     marker (`changed` or `unchanged`); `auth_allowlist`, `instance_admins`
+         *     and `auth_setup` snapshots hold no credential (the setup token and its
+         *     hash are never recorded). A snapshot of any of these four settings
+         *     carries `source: cli` when the change was made by the `vibexp admin auth`
+         *     commands rather than through this API.
          */
         AdminInstanceSettingsAuditEntry: {
             /**
@@ -12955,7 +13280,7 @@ export interface components {
              * @example email_provider
              * @enum {string}
              */
-            setting: "email_provider" | "search" | "ai_summary";
+            setting: "email_provider" | "search" | "ai_summary" | "auth_providers" | "auth_allowlist" | "instance_admins" | "auth_setup";
             /**
              * @description `upsert` (created or replaced by an admin), `delete` (removed by an
              *     admin) or `import` (the boot-time import from config.yaml, which has no
@@ -13242,59 +13567,466 @@ export interface components {
              */
             expected_version?: number | null;
         };
-        ProjectResponse: components["schemas"]["Project"] & {
+        /**
+         * @description The kind of sign-in identity provider. At most one `google` and one
+         *     `github` provider can be stored; any number of `oidc` providers.
+         * @example oidc
+         * @enum {string}
+         */
+        AdminAuthProviderType: "google" | "github" | "oidc";
+        /**
+         * @description The provider's build outcome on the replica that served the request:
+         *     `healthy` (built and offered for sign-in), `unhealthy` (enabled but it
+         *     failed to build, so it is excluded from sign-in), `disabled` (not enabled,
+         *     so never built) or `unknown` (enabled, but this replica could not resolve
+         *     it for this request).
+         * @example healthy
+         * @enum {string}
+         */
+        AdminAuthProviderHealthStatus: "healthy" | "unhealthy" | "disabled" | "unknown";
+        /**
+         * @description The provider's health as seen by the replica that served the request.
+         *     Health is held in memory per replica and is not persisted.
+         */
+        AdminAuthProviderHealth: {
+            status: components["schemas"]["AdminAuthProviderHealthStatus"];
             /**
-             * @description Whether the project's git URL matches a repository accessible via the team's GitHub App installation
-             * @example true
+             * @description Why an `unhealthy` provider failed to build; null otherwise.
+             * @example null
              */
-            github_connected: boolean;
-        };
-        ResourceSelection: {
+            last_error: string | null;
             /**
-             * @description Migrate every resource of this type in the source project
-             * @example false
+             * Format: date-time
+             * @description When the provider was last built (or tried); null for `disabled` and `unknown`.
              */
-            all?: boolean;
-            /** @description Explicit list of resource IDs to migrate (used when all is false) */
-            ids?: string[];
-        };
-        ResourceSelections: {
-            prompts?: components["schemas"]["ResourceSelection"];
-            artifacts?: components["schemas"]["ResourceSelection"];
-            blueprints?: components["schemas"]["ResourceSelection"];
-            feed_items?: components["schemas"]["ResourceSelection"];
+            checked_at: string | null;
         };
-        MigrationRequest: {
+        /**
+         * @description One sign-in identity provider. The client secret is write-only: it is never
+         *     returned, and `has_client_secret` reports only whether one is stored.
+         */
+        AdminAuthProvider: {
             /**
              * Format: uuid
-             * @description ID of the destination project (must belong to the same team)
-             * @example 01234567-89ab-cdef-0123-456789abcdef
+             * @description Provider id.
              */
-            destination_project_id: string;
-            resources?: components["schemas"]["ResourceSelections"];
+            id: string;
+            type: components["schemas"]["AdminAuthProviderType"];
             /**
-             * @description How slug collisions in the destination project are handled
-             * @default skip
-             * @enum {string}
+             * @description The provider's url-safe name, used in the sign-in URL. Immutable.
+             * @example okta
              */
-            conflict_policy: "skip" | "rename" | "overwrite";
-        };
-        ResourceInventoryItem: {
-            /** @description Resource identifier */
-            id: string;
-            /** @description Human-readable resource name */
-            name: string;
-        };
-        ResourceInventory: {
+            slug: string;
             /**
-             * @description Number of resources of this type in the source project
-             * @example 3
+             * @description The name shown on the sign-in button.
+             * @example Okta
              */
-            count: number;
-            /** @description Resources of this type (omitted when empty) */
-            items?: components["schemas"]["ResourceInventoryItem"][];
+            display_name: string;
+            /** @description Whether the provider is offered for sign-in. */
+            enabled: boolean;
+            /**
+             * @description Position on the sign-in page, ascending.
+             * @example 0
+             */
+            sort_order: number;
+            /**
+             * @description The OAuth client id.
+             * @example 0oa1b2c3d4
+             */
+            client_id: string;
+            /** @description Whether a client secret is stored. */
+            has_client_secret: boolean;
+            /**
+             * @description The OIDC issuer URL; null for `google` and `github`.
+             * @example https://example.okta.com
+             */
+            issuer_url: string | null;
+            /**
+             * @description The redirect URI to register in the identity provider's console. It is
+             *     derived from the instance's own URL, is the same for every provider and
+             *     cannot be changed here.
+             * @example https://vibexp.example.com/api/v1/auth/callback
+             */
+            redirect_uri: string;
+            health: components["schemas"]["AdminAuthProviderHealth"];
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            updated_at: string;
+            /**
+             * Format: uuid
+             * @description Who last saved the provider. Null for the boot-time config import, a
+             *     save made on a setup session, or once that user has been deleted.
+             */
+            updated_by_user_id: string | null;
         };
-        MigrationInventory: {
+        /**
+         * @description Every stored sign-in identity provider, in sign-in page order, with the
+         *     `version` of the instance authentication settings. Send that `version` back
+         *     as `expected_version` when changing a provider.
+         */
+        AdminAuthProviderList: {
+            providers: components["schemas"]["AdminAuthProvider"][];
+            /**
+             * Format: int64
+             * @description The shared version of the authentication settings. Every provider and
+             *     allowlist change increments it.
+             * @example 7
+             */
+            version: number;
+        };
+        /**
+         * @description A provider as stored by a create or an update, with the settings `version`
+         *     after the change. `provider.health` is resolved after the change, so the
+         *     response waits for the provider to be built (for `oidc` and `google`, one
+         *     bounded discovery request) and reports whether sign-in can use it.
+         */
+        AdminAuthProviderSaved: {
+            provider: components["schemas"]["AdminAuthProvider"];
+            /**
+             * Format: int64
+             * @description The shared authentication settings version after the change.
+             * @example 8
+             */
+            version: number;
+        };
+        /**
+         * @description A new sign-in identity provider. `type` and `slug` cannot be changed later.
+         *     `expected_version` is optional: when present, the create is rejected with
+         *     409 unless it equals the current authentication settings `version`.
+         */
+        AdminAuthProviderCreate: {
+            type: components["schemas"]["AdminAuthProviderType"];
+            /**
+             * @description 1-63 lower-case letters, digits or hyphens, not starting with a hyphen.
+             * @example okta
+             */
+            slug: string;
+            /** @example Okta */
+            display_name: string;
+            /**
+             * @description Whether the provider is offered for sign-in. Defaults to true.
+             * @default true
+             */
+            enabled: boolean;
+            /**
+             * @description Position on the sign-in page, ascending. Defaults to 0.
+             * @default 0
+             */
+            sort_order: number;
+            /** @example 0oa1b2c3d4 */
+            client_id: string;
+            /**
+             * @description The OAuth client secret. Stored encrypted and never returned.
+             * @example s3cr3t-value
+             */
+            client_secret: string;
+            /**
+             * @description Required for `oidc` and rejected for `google` and `github`. An absolute
+             *     `https://` URL (`http://` only for localhost) with no query or fragment.
+             * @example https://example.okta.com
+             */
+            issuer_url?: string;
+            /**
+             * Format: int64
+             * @description The `version` the caller last read; omit or null to apply to the current version.
+             */
+            expected_version?: number | null;
+        };
+        /**
+         * @description A whole replacement of a provider's editable fields; `type` and `slug` are
+         *     immutable and are rejected as unknown fields. `display_name`, `enabled`,
+         *     `sort_order`, `client_id` and `expected_version` are required.
+         *
+         *     `client_secret` is write-only. Omit it to keep the stored secret; an empty
+         *     string is rejected. It cannot be omitted when `issuer_url` changes: the
+         *     stored secret is only ever kept for the issuer it was saved with.
+         *
+         *     A change that disables the last enabled provider, or the provider the
+         *     calling admin signed in with, is rejected with 409 `lockout_risk` unless
+         *     `confirm_lockout_risk` is true.
+         */
+        AdminAuthProviderUpdate: {
+            /** @example Okta */
+            display_name: string;
+            enabled: boolean;
+            /** @example 0 */
+            sort_order: number;
+            /** @example 0oa1b2c3d4 */
+            client_id: string;
+            /**
+             * @description A new client secret. Omit to keep the stored one. Never returned.
+             * @example s3cr3t-value
+             */
+            client_secret?: string;
+            /**
+             * @description Required for `oidc`, rejected for `google` and `github`.
+             * @example https://example.okta.com
+             */
+            issuer_url?: string;
+            /**
+             * Format: int64
+             * @description The authentication settings `version` the caller last read.
+             * @example 7
+             */
+            expected_version: number;
+            /**
+             * @description Set to true to apply a change that was rejected with `lockout_risk`.
+             * @default false
+             */
+            confirm_lockout_risk: boolean;
+        };
+        /**
+         * @description What to test. Nothing is stored and nothing is audited.
+         *
+         *     - `id` alone tests the STORED provider with its stored secret.
+         *     - Without `id`, the body is an unsaved candidate: `type`, `client_id` and
+         *       `client_secret` are required (and `issuer_url` for `oidc`).
+         *     - `id` with other fields tests the stored provider with those fields
+         *       replaced, as an edit form does before saving. `type` cannot differ from
+         *       the stored one. When `client_secret` is omitted the stored secret is
+         *       used: it is never sent to a candidate-chosen endpoint (OIDC discovery
+         *       sends no secret, and the GitHub credential check goes only to GitHub).
+         */
+        AdminAuthProviderTestRequest: {
+            /**
+             * Format: uuid
+             * @description A stored provider's id.
+             */
+            id?: string;
+            type?: components["schemas"]["AdminAuthProviderType"];
+            /** @example 0oa1b2c3d4 */
+            client_id?: string;
+            /**
+             * @description The candidate client secret. Never returned.
+             * @example s3cr3t-value
+             */
+            client_secret?: string;
+            /** @example https://example.okta.com */
+            issuer_url?: string;
+        };
+        /**
+         * @description The outcome of a provider test: OIDC discovery for `oidc` and `google`, a
+         *     credential check against GitHub for `github`.
+         */
+        AdminAuthProviderTestResult: {
+            /** @description Whether the provider could be built with the tested configuration. */
+            is_valid: boolean;
+            /**
+             * @description Why the test failed; null when it passed.
+             * @example null
+             */
+            message: string | null;
+        };
+        /**
+         * @description The instance's sign-in access allowlist. A user may sign in when their
+         *     email's domain is in `domains` or the address is in `emails`. With both
+         *     lists empty, or nothing stored, access is open: every user may sign in
+         *     (`active` is false). Root instance admins are always exempt.
+         */
+        AdminAuthAllowlist: {
+            /**
+             * @example [
+             *       "example.com"
+             *     ]
+             */
+            domains: string[];
+            /**
+             * @example [
+             *       "contractor@partner.example"
+             *     ]
+             */
+            emails: string[];
+            /** @description Whether the allowlist restricts sign-in (at least one domain or email). */
+            active: boolean;
+            /**
+             * Format: int64
+             * @description The stored allowlist's own version; null when nothing is stored.
+             * @example 3
+             */
+            version: number | null;
+            /**
+             * Format: date-time
+             * @description When the allowlist was last saved; null when nothing is stored.
+             */
+            updated_at: string | null;
+            /**
+             * Format: uuid
+             * @description Who last saved the allowlist. Null when nothing is stored, for the
+             *     boot-time config import, a save made on a setup session, or once that
+             *     user has been deleted.
+             */
+            updated_by_user_id: string | null;
+        };
+        /**
+         * @description A whole replacement of the access allowlist. Both lists are required (send
+         *     `[]` for none). Entries are trimmed, lower-cased and de-duplicated; a domain
+         *     is a DNS name of at least two labels with no leading `@`. Storing two empty
+         *     lists means open access.
+         *
+         *     `expected_version` is optional: when present, the save is rejected with
+         *     409 unless it equals the stored allowlist's `version` (and when nothing is
+         *     stored, any `expected_version` other than null is a conflict). Omit it for
+         *     last-write-wins.
+         */
+        AdminAuthAllowlistUpdate: {
+            /**
+             * @example [
+             *       "example.com"
+             *     ]
+             */
+            domains: string[];
+            /**
+             * @example [
+             *       "contractor@partner.example"
+             *     ]
+             */
+            emails: string[];
+            /**
+             * Format: int64
+             * @description The `version` the caller last read; omit or null for last-write-wins.
+             */
+            expected_version?: number | null;
+        };
+        /** @description A candidate allowlist to preview. Both lists are required (send `[]` for none). */
+        AdminAuthAllowlistPreviewRequest: {
+            /**
+             * @example [
+             *       "example.com"
+             *     ]
+             */
+            domains: string[];
+            /** @example [] */
+            emails: string[];
+        };
+        /**
+         * @description What replacing the allowlist with a candidate would do: the active
+         *     (non-suspended) users who would stop matching it. Root instance admins are
+         *     exempt and never counted. An open-access candidate affects nobody.
+         */
+        AdminAuthAllowlistImpact: {
+            /**
+             * @description How many active users match neither list of the candidate.
+             * @example 2
+             */
+            count: number;
+            /**
+             * @description Up to 20 of their emails, in alphabetical order.
+             * @example [
+             *       "ada@other.example",
+             *       "bob@other.example"
+             *     ]
+             */
+            sample: string[];
+            /** @description Whether `count` exceeds the number of emails in `sample`. */
+            sample_truncated: boolean;
+        };
+        /** @description One instance admin granted in the database. */
+        AdminInstanceAdmin: {
+            /** Format: uuid */
+            user_id: string;
+            /** @example ada@example.com */
+            email: string;
+            /**
+             * @description The admin's display name, when set.
+             * @example Ada Admin
+             */
+            name: string | null;
+            /**
+             * Format: uuid
+             * @description The root admin who granted it; null once that user has been deleted.
+             */
+            granted_by_user_id: string | null;
+            /** Format: date-time */
+            granted_at: string;
+        };
+        /**
+         * @description The instance's admins. `root_admins` are the emails named in config.yaml's
+         *     `auth.instance_admins`: read-only here, they cannot be granted or revoked.
+         *     `admins` are the users granted in the database, oldest first.
+         */
+        AdminInstanceAdminList: {
+            /**
+             * @description The root admins' normalized emails, sorted.
+             * @example [
+             *       "root@example.com"
+             *     ]
+             */
+            root_admins: string[];
+            admins: components["schemas"]["AdminInstanceAdmin"][];
+        };
+        /**
+         * @description The existing user to make an instance admin, named by exactly one of
+         *     `user_id` or `email`.
+         */
+        AdminInstanceAdminGrant: {
+            /** Format: uuid */
+            user_id?: string;
+            /**
+             * Format: email
+             * @example ada@example.com
+             */
+            email?: string;
+        };
+        /**
+         * @description Which authentication setting's audit log to read.
+         * @example auth_providers
+         * @enum {string}
+         */
+        AdminAuthSettingsAuditSetting: "auth_providers" | "auth_allowlist" | "instance_admins" | "auth_setup";
+        ProjectResponse: components["schemas"]["Project"] & {
+            /**
+             * @description Whether the project's git URL matches a repository accessible via the team's GitHub App installation
+             * @example true
+             */
+            github_connected: boolean;
+        };
+        ResourceSelection: {
+            /**
+             * @description Migrate every resource of this type in the source project
+             * @example false
+             */
+            all?: boolean;
+            /** @description Explicit list of resource IDs to migrate (used when all is false) */
+            ids?: string[];
+        };
+        ResourceSelections: {
+            prompts?: components["schemas"]["ResourceSelection"];
+            artifacts?: components["schemas"]["ResourceSelection"];
+            blueprints?: components["schemas"]["ResourceSelection"];
+            feed_items?: components["schemas"]["ResourceSelection"];
+        };
+        MigrationRequest: {
+            /**
+             * Format: uuid
+             * @description ID of the destination project (must belong to the same team)
+             * @example 01234567-89ab-cdef-0123-456789abcdef
+             */
+            destination_project_id: string;
+            resources?: components["schemas"]["ResourceSelections"];
+            /**
+             * @description How slug collisions in the destination project are handled
+             * @default skip
+             * @enum {string}
+             */
+            conflict_policy: "skip" | "rename" | "overwrite";
+        };
+        ResourceInventoryItem: {
+            /** @description Resource identifier */
+            id: string;
+            /** @description Human-readable resource name */
+            name: string;
+        };
+        ResourceInventory: {
+            /**
+             * @description Number of resources of this type in the source project
+             * @example 3
+             */
+            count: number;
+            /** @description Resources of this type (omitted when empty) */
+            items?: components["schemas"]["ResourceInventoryItem"][];
+        };
+        MigrationInventory: {
             prompts?: components["schemas"]["ResourceInventory"];
             artifacts?: components["schemas"]["ResourceInventory"];
             blueprints?: components["schemas"]["ResourceInventory"];
@@ -14098,31 +14830,26 @@ export interface operations {
             };
         };
     };
-    listAPIKeys: {
+    getSetupStatus: {
         parameters: {
-            query?: {
-                /** @description Page number */
-                page?: number;
-                /** @description Items per page */
-                limit?: number;
-            };
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description API keys retrieved successfully */
+            /** @description Setup status retrieved successfully */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["APIKeyListResponse"];
+                    "application/json": components["schemas"]["SetupStatusResponse"];
                 };
             };
-            /** @description Unauthorized */
-            401: {
+            /** @description The setup status could not be determined */
+            500: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -14132,7 +14859,7 @@ export interface operations {
             };
         };
     };
-    createAPIKey: {
+    createSetupSession: {
         parameters: {
             query?: never;
             header?: never;
@@ -14141,20 +14868,22 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateAPIKeyRequest"];
+                "application/json": components["schemas"]["CreateSetupSessionRequest"];
             };
         };
         responses: {
-            /** @description API key created successfully */
-            201: {
+            /** @description Setup session started */
+            200: {
                 headers: {
+                    /** @description Encrypted, HttpOnly, SameSite=Strict setup-session cookie (`vibexp_setup`) */
+                    "Set-Cookie"?: string;
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["CreateAPIKeyResponse"];
+                    "application/json": components["schemas"]["SetupSessionResponse"];
                 };
             };
-            /** @description Invalid request data */
+            /** @description Malformed request body */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -14163,7 +14892,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
-            /** @description Unauthorized */
+            /** @description The setup token is unknown, expired or already consumed */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -14172,16 +14901,110 @@ export interface operations {
                     "application/problem+json": components["schemas"]["ErrorResponse"];
                 };
             };
-        };
-    };
-    deleteAPIKey: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description API key ID */
-                id: string;
-            };
+            /** @description The instance is not in setup mode */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description The setup session could not be started */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    listAPIKeys: {
+        parameters: {
+            query?: {
+                /** @description Page number */
+                page?: number;
+                /** @description Items per page */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description API keys retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["APIKeyListResponse"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    createAPIKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateAPIKeyRequest"];
+            };
+        };
+        responses: {
+            /** @description API key created successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CreateAPIKeyResponse"];
+                };
+            };
+            /** @description Invalid request data */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    deleteAPIKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description API key ID */
+                id: string;
+            };
             cookie?: never;
         };
         requestBody?: never;
@@ -25480,6 +26303,726 @@ export interface operations {
             };
         };
     };
+    listAdminAuthProviders: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The stored providers and the settings version */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthProviderList"];
+                };
+            };
+            /** @description Not found — the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    createAdminAuthProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAuthProviderCreate"];
+            };
+        };
+        responses: {
+            /** @description The stored provider and the settings version after the change */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthProviderSaved"];
+                };
+            };
+            /**
+             * @description Bad request — a field is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`, with
+             *     `validation_errors` naming it), or the body is malformed or carries an
+             *     unknown field
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /**
+             * @description Conflict — `expected_version` does not match the current version
+             *     (`INSTANCE_SETTINGS_VERSION_CONFLICT`), or the slug is taken or a second
+             *     `google`/`github` provider was sent (`INSTANCE_AUTH_PROVIDER_CONFLICT`);
+             *     nothing was changed
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    testAdminAuthProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAuthProviderTestRequest"];
+            };
+        };
+        responses: {
+            /** @description The outcome of the test */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthProviderTestResult"];
+                };
+            };
+            /**
+             * @description Bad request — the candidate is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`),
+             *     or the body is malformed or carries an unknown field
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — no provider has that `id`, or the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    updateAdminAuthProvider: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Provider id (UUID) */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAuthProviderUpdate"];
+            };
+        };
+        responses: {
+            /** @description The stored provider and the settings version after the change */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthProviderSaved"];
+                };
+            };
+            /**
+             * @description Bad request — a field is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`, with
+             *     `validation_errors` naming it), the provider id is malformed, or the body is
+             *     malformed, omits or nulls a required field, or carries an unknown field
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — no provider has that id, or the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /**
+             * @description Conflict — `expected_version` does not match the current version
+             *     (`INSTANCE_SETTINGS_VERSION_CONFLICT`), or the change risks locking sign-in
+             *     out (`lockout_risk`); nothing was changed
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    deleteAdminAuthProvider: {
+        parameters: {
+            query?: {
+                /** @description The authentication settings `version` the caller last read; omit to apply to the current version. */
+                expected_version?: number;
+                /** @description Set to true to apply a delete that was rejected with `lockout_risk`. */
+                confirm_lockout_risk?: boolean;
+            };
+            header?: never;
+            path: {
+                /** @description Provider id (UUID) */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The provider was deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Bad request — malformed provider id or query parameter */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — no provider has that id, or the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /**
+             * @description Conflict — `expected_version` does not match the current version
+             *     (`INSTANCE_SETTINGS_VERSION_CONFLICT`), or the delete risks locking sign-in
+             *     out (`lockout_risk`); nothing was changed
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    getAdminAuthAllowlist: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The access allowlist */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthAllowlist"];
+                };
+            };
+            /** @description Not found — the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    updateAdminAuthAllowlist: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAuthAllowlistUpdate"];
+            };
+        };
+        responses: {
+            /** @description The stored allowlist */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthAllowlist"];
+                };
+            };
+            /**
+             * @description Bad request — an entry is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`, with
+             *     `validation_errors` naming the list), or the body is malformed, omits or
+             *     nulls a list, or carries an unknown field
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Conflict — `expected_version` does not match the stored version (`INSTANCE_SETTINGS_VERSION_CONFLICT`); nothing was changed */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    resetAdminAuthAllowlist: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Access is now open */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Not found — the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    previewAdminAuthAllowlist: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminAuthAllowlistPreviewRequest"];
+            };
+        };
+        responses: {
+            /** @description The impact of the candidate */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminAuthAllowlistImpact"];
+                };
+            };
+            /**
+             * @description Bad request — an entry is invalid (`INSTANCE_SETTINGS_VALIDATION_FAILED`), or
+             *     the body is malformed, omits or nulls a list, or carries an unknown field
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — the caller is neither an instance admin nor on a setup session */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    listAdminInstanceAdmins: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The instance admins */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminInstanceAdminList"];
+                };
+            };
+            /** @description Not found — the caller is not an instance admin */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    grantAdminInstanceAdmin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AdminInstanceAdminGrant"];
+            };
+        };
+        responses: {
+            /** @description The grant */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminInstanceAdmin"];
+                };
+            };
+            /**
+             * @description Bad request — the body names neither or both of `user_id` and `email`, the
+             *     user is suspended, or the body is malformed or carries an unknown field
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Forbidden — the caller is an instance admin but not a root admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — no such user, or the caller is not an instance admin */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Conflict — the user is a root admin, whose access comes from config.yaml */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    revokeAdminInstanceAdmin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The granted admin's user id (UUID) */
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The grant was revoked */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Bad request — malformed user id */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Forbidden — the caller is an instance admin but not a root admin */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — the user holds no grant, or the caller is not an instance admin */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Conflict — the user is a root admin, whose access comes from config.yaml */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
+    listAdminAuthSettingsAudit: {
+        parameters: {
+            query: {
+                /** @description Which authentication setting's audit log to read. */
+                setting: components["schemas"]["AdminAuthSettingsAuditSetting"];
+                /** @description Opaque cursor from a previous page's `next_cursor`. */
+                cursor?: string;
+                /** @description Page size. */
+                limit?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of audit entries, newest first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminInstanceSettingsAuditPage"];
+                };
+            };
+            /** @description Bad request — missing or unknown `setting`, malformed cursor, or `limit` out of range */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Not found — the caller is not an instance admin */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ErrorResponse"];
+                };
+            };
+        };
+    };
     listComments: {
         parameters: {
             query: {